Questions tagged [source-code]
Security relative to source-code edition, protection and management.
46
questions
76
votes
19
answers
6k
views
What security resources should a white-hat *developer* follow these days? [closed]
What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days?
Do Include:
Late breaking information on new security issues (RSS, Twitter, etc)
A website that tracks ...
10
votes
5
answers
28k
views
Hiding JavaScript source code
In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...
- 10.1k
46
votes
15
answers
12k
views
Should we protect web application source code from being stolen by web hosts through obfuscation?
Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code or even steal your business? If so, how should this be dealt with? How should we obfuscate?
...
- 741
34
votes
4
answers
11k
views
Which security measures does PyPI and similar third-party software repositories take?
PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)).
How does PyPI prevent people from uploading malware?
When I ...
- 3,904
22
votes
4
answers
7k
views
Malwares source repositories. Where? [closed]
As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
- 2,020
86
votes
6
answers
81k
views
How do large companies protect their source code?
I recently read the canonical answer of our ursine overlord to the question on How do certification authorities store their private root keys?
I then just had to ask myself:
How do large companies (e....
- 9,580
45
votes
3
answers
7k
views
How safe are signed git tags? Only as safe as SHA-1 or somehow safer?
How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around.
So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
- 744
21
votes
6
answers
24k
views
How can I enumerate all the saved RSA keys in the Microsoft CSP?
I have an application that is creating several keys and storing them in various stores (in this case the Machine store).
How can I enumerate all the keys on a given Windows system?
...
- 50.6k
17
votes
5
answers
16k
views
Obfuscating JavaScript code
Some Flash developers are afraid of JavaScript. Their point of view:
Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
- 273
17
votes
5
answers
38k
views
How can one secure a password/key in source code [duplicate]
If there is a need for source code to have a password in it, how
should this be secured? This is purely an example, but say there is an
app that is using an API, and you don't want to expose your ...
- 273
11
votes
2
answers
736
views
What is considered the simplest (or lightest) secure development lifecycle?
Microsoft has there simplified SDL:
"The Security Development Lifecycle (SDL) is a security assurance process that is focused on software development."
"The process outlined in this paper sets ...
- 13.8k
9
votes
7
answers
935
views
Proving running code on a website is unchanged
Can it be proved to the user that the running code behind a website with security related code is the same as published?
I'm currently looking at a few new project ideas and one involves secure ...
- 212
87
votes
6
answers
20k
views
How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me? [duplicate]
I depend on PHP CLI for all kinds of personal and (hopefully, soon) professional/mission-critical "business logic". (This could be any other language and the exact same problem would still stand; I'm ...
- 711
26
votes
4
answers
9k
views
Example of a backdoor submitted to an open source project?
To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself.
I'm researching some source modeling techniques, and we're ...
- 361
22
votes
2
answers
5k
views
Is there a way to verify a binary against the sources?
It seems like there is no practical way to verify the full integrity path of precompiled and packaged software? I can check the downloaded package itself by hashes, but I have no verification if the ...
- 381
10
votes
4
answers
7k
views
How to protect ftp account information in the source code of a program
I wrote a game which stores high score information on an ftp server.
In the the source code I need to write out the ftp link with the account name and password in it.
For example:
url = new URL("ftp:...
- 283
7
votes
1
answer
2k
views
Do blackbox penetration tests make sense if a whitebox audit would be possible as well?
Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the ...
- 7,379
0
votes
2
answers
219
views
secure the code of a server physically rented to the client
My company rents a Debian server to the clients, that they have to connect to their own network.
The server provides various services, an administration interface, and connects to the online service ...
- 125
127
votes
8
answers
26k
views
Why is storing passwords in version control a bad idea?
My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?"
I gave him an answer that ...
- 6,514
93
votes
7
answers
5k
views
How do I know a piece of software only does what the author claims?
Without being a programmer or a computer expert, how can I know if a particular program or any piece of software in general doesn't have hidden unwanted functions compromising privacy and security?
- 999
29
votes
2
answers
4k
views
Identifying the author(s) of a piece of malware
When a new piece of malware appears, people can try to determine where it comes from, and who its authors could be.
How do security experts attempt to identify the authors of a new publicly disclosed ...
- 465
29
votes
5
answers
12k
views
When can I commit a Private Key to source control?
That is to say, in what cases does it make sense to commit an unencrypted keypair to internal source control like SVN or Git?
Related question that discusses an encrypted private key: Is it bad ...
- 640
15
votes
4
answers
13k
views
What's the standard way to encrypt a file with a public key in Java?
I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the server?...
9
votes
3
answers
3k
views
PHP mail() Header Injection Prevention
This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
- 863
7
votes
2
answers
2k
views
In Visual Studio, what are the risks of simply opening an untrusted project? What are the mitigations?
I'm looking at the source code of some potentially hostile code. As usual, VS 2012 is giving me the security warning: "You should only open projects from a trustworthy source" ... "ask me for every ...
- 50.6k
2
votes
2
answers
3k
views
Manually exploiting blind SQL injection in SELECT statement in X-Forwarded-For header
I am struggling exploiting this vulnerability in the code below:
<?php
ini_set('display_errors', 0);
define("INDEX", 1);
include '../db.php';
if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) &&...
- 23
1
vote
2
answers
315
views
Open Source OS - code you see vs code you get
In this question I will use the example of Linux OS, but I am also interested in general situation.
Linux OS distributions are famous for being open source and thus rather secure. But how can you be ...
- 421
45
votes
8
answers
9k
views
Should I bother teaching buffer overflows any more?
The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
- 1,565
31
votes
4
answers
15k
views
Is $_SERVER[ ] a safe source of data in PHP?
Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
- 419
24
votes
6
answers
7k
views
Source code as password
Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'?
As an ...
- 735
14
votes
6
answers
5k
views
Code Analysis: Binary vs Source
While conducting a software security assessment, if you have access to the source code of a compiled application (say C++), would you ever do any analysis upon the compiled version, either with any ...
- 1,617
14
votes
9
answers
62k
views
Programming language for network security
I am working as a tester now. I am planning to move to the domain of security such as a CEH or CISSP. But many say that to be a great hacker you need to know at least one programming language well. I ...
- 386
13
votes
4
answers
1k
views
What does defense in depth entail for a web app?
I'm assuming it means different layers of security from app-level security to server hardening to personnel training, but what are each of those layers and what are some good resources for each level ...
- 3,242
8
votes
3
answers
3k
views
Is there any way to use Nuget securely?
Visual Studio now includes a Package Manager that downloads and updates software packages from the internet. The common name for this is "Nuget"
The problem I have is that anyone can pretend to be ...
- 50.6k
8
votes
4
answers
2k
views
Scripting a search through php files for dangerous calls for manual review
I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed.
Does anyone have any recommendations for ...
- 16.1k
8
votes
1
answer
3k
views
Is Request.getHeader("host") vulnerable?
If the following is the code snippet, what would be your suggestions?
<script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script>
Is this a clear ...
- 1,131
8
votes
1
answer
664
views
Are there any type safe languages with deterministic compilers?
This article about BIND9 concludes with the statement:
The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in this ...
- 50.6k
5
votes
1
answer
914
views
Data loss protection in software artifacts
Data loss protection is a major concern to every industry. The software engineering process involves multiple points for potential data loss, as a number of parties are involved other than the client ...
- 213
5
votes
4
answers
6k
views
How to prevent source code theft in web application development
I'm developing a webapplication working with PHP, SQL DB and other technologies. I'm always considering someone stealing the source code or using it to other means.
How can you prevent someone from ...
- 173
4
votes
2
answers
2k
views
Code Injection detection on Web Servers
Recently I found one of my web servers hacked with malicious code injected to websites hosted there. It wasn't exactly my fault, as I shared the server with other people and someone put some unsafe ...
- 539
4
votes
1
answer
1k
views
Peer review of C# cryptography for Azure Table security
Edit: Update - I am researching how to implement AES with authentication in an efficient way for this project. If you have the time I'd appreciate your skill in finding the best implementation for ...
- 50.6k
4
votes
3
answers
1k
views
Ken Thompson's compiler hack
I have gone through Ken Thompson's compiler hack paper; can't we just go through the compiler's source code and check for any backdoor, what was the article's point?
Can we be sure that there are no ...
- 255
2
votes
1
answer
2k
views
PHP assert code injection
Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php.
$entityId = $_GET["name"];
public function getMetaData($entityId) {
assert('...
- 43
2
votes
2
answers
143
views
VCS to manipulate returned trees to prevent leaks? [closed]
I am wondering if there is any system that would change source code trees in subtle from version control systems in ways that are hard to discover (i.e. whitespaces at the ends of lines, perhaps even ...
- 6,514
2
votes
4
answers
6k
views
Writing file shredder
I want to write a simple file shredder in c++, i.e. a program that deletes a file so that it is not recoverable. Would the following be a secure and correct way to do that?
(1) Open the file with
...
- 3,861
0
votes
2
answers
449
views
Check integrity of GnuPG inside of GPGTools?
Is it possible to check the integrity of the GnuPG files inside of the downloaded installation package of GPGTools?
I know how to check the integrity of the .dmg file (compare the SHA1 hash), but I ...
- 381