Questions tagged [source-code]
Security relative to source-code edition, protection and management.
235
questions
29
votes
2
answers
4k
views
Identifying the author(s) of a piece of malware
When a new piece of malware appears, people can try to determine where it comes from, and who its authors could be.
How do security experts attempt to identify the authors of a new publicly disclosed ...
- 465
86
votes
6
answers
81k
views
How do large companies protect their source code?
I recently read the canonical answer of our ursine overlord to the question on How do certification authorities store their private root keys?
I then just had to ask myself:
How do large companies (e....
- 9,580
6
votes
1
answer
98
views
Safely Experimenting With Sockets
I'm learning about TCP/IP and (Berkeley/UNIX) socket programming. Let's say I have two scenarios:
1) I write two programs in C, a client and a server, and bind them each to a non-well-known port on ...
- 305
-1
votes
2
answers
760
views
How do researchers identify vulnerability in closed source software? [closed]
Came across an article, it is about the new BadWinmail vulnerability in Outlook. Being a closed-source software, how do researchers manage to point out that Outlook is not sandboxing the flash?
Is ...
- 17
3
votes
1
answer
5k
views
When can I commit an OpenSSL Certificate (.pem) to source control?
That is to say, in what cases does it make sense to commit .cer files, or a stack of .cer files in a .pem, to internal source control like SVN or Git?
If it's just a list of signed public keys, I ...
- 640
69
votes
7
answers
10k
views
Does one need to be a good programmer to perform secure source code analysis?
A person has good knowledge of overall security risks, knows what OWASP Top 10 vulnerabilities are, and has certifications like CEH, CISSP, OSCP, etc. which are more black-box testing. And also he has ...
- 1,507
2
votes
2
answers
2k
views
Way to find security bugs in Scala source code open-source way?
I looked on Web to find way for finding security bugs specially SQL Injection and XSS in Scala code with little success. Some posts recommended to write custom detectors for FindBugs plugin, others ...
- 1,507
29
votes
5
answers
12k
views
When can I commit a Private Key to source control?
That is to say, in what cases does it make sense to commit an unencrypted keypair to internal source control like SVN or Git?
Related question that discusses an encrypted private key: Is it bad ...
- 640
0
votes
0
answers
724
views
Unable to do transformation of findbugs xml reports due to integration issue with findsecbugs plugin
I am trying to integrate the find-security-bugs plugin for findbugs using maven. I am able to run findbugs with maven and perform transformation from xml to html without any issue. I am able to run ...
- 1,507
1
vote
0
answers
659
views
Findbugs Source Code Analyzer not able to detect vulnerabilities in JSP file?
I am using FindBugs to do source code analysis along with Find Security Bugs plugin to specifically detect security vulnerabilities like SQL Injection, XSS, etc. I installed the FindBugs plugin for ...
- 1,507
0
votes
1
answer
892
views
Having trouble with FindBugs exclude filter
I installed FindBugs plugin in Eclipse for Source Code Analysis with FindSecurityBugs plugin to find out security issues with the code. I want to filter out certain false positives and want to exclude ...
- 1,507
0
votes
1
answer
140
views
Security of Data and Source Code in a 3rd Party Hosting Environment [closed]
What expectation should I have for the security of my data and codebase hosted with a 3rd party e.g. godaddy, or any other similar hosting provider.
How common is it that some IT employee within the ...
- 1,203
2
votes
0
answers
2k
views
Any worthy open source Java Source Code Analysis tool from finding Security Vulnerabilities perspective? [closed]
I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links ...
- 1,507
4
votes
1
answer
461
views
How could a publicly available stream cipher (RC4) be kept secret so long?
I'm reading about the cryptographic function called RC4.
Apparently, its method was kept secret from 1987 until 1994 despite being available to the public for licensing and use.
How did it stay ...
- 579
6
votes
2
answers
2k
views
Keeping passwords out of source code
Secrets should not be in source code and in version control because of two reasons:
External threat: An attacker can exploit a vulnerability to get access to files/source of your website/application. ...
- 215
7
votes
1
answer
2k
views
Never heard of compiler vulnerabilities when compiling?
Does there exist any real source code that exploits a compiler vulnerability? I mean code that during compilation causes a buffer overflow in the compiler resulting in execution of arbitrary code.
...
- 516
3
votes
1
answer
91
views
Solution for Enterprise SW Eng. with Github and NPM [closed]
Can anyone share an architecture or framework that supports the use of Open Source software in enterprise software development environments?
I'm seeking solutions to manage and mitigate the risk of ...
- 181
7
votes
2
answers
211
views
Searching vulnerabilities via similar code comparison. Is it a viable attack vector?
Consider the following scenario:
the attacker scans (optimally automatically) open codebases (eg. GitHub) for vulnerable code fragments by checking bug reports and patches.
the attacker scans for ...
- 643
8
votes
1
answer
664
views
Are there any type safe languages with deterministic compilers?
This article about BIND9 concludes with the statement:
The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in this ...
- 50.6k
5
votes
2
answers
2k
views
Source code scanning - PCI Requirement - Service Provider
I've been doing a lot of research regarding the requirements for source code scanning but haven't found anything conclusive when it comes to my question below. So I need some guidance from PCI Experts ...
- 103
1
vote
2
answers
181
views
Can pre-compiled binaries be different than if someone builds from source himself?
Given that I have an "acceptable" source code of some program (Tor was mentioned in a previous version of this question), where "acceptable" means that I trust this source code and want to use it for ...
- 1,843
2
votes
1
answer
2k
views
Source code of Firefox Add-ons
How can I be sure that a browser add-on that is released under the GPL is actually really using the source code that was published?
I read somewhere that the source code of Chrome add-ons is viewable ...
24
votes
6
answers
7k
views
Source code as password
Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'?
As an ...
- 735
1
vote
0
answers
136
views
Vetting new IT development staff [closed]
In the realm of software development what would be the best way to vet prospective employees?
We handle potentially sensitive information, and a code base which could be potentially lucrative to ...
- 473
5
votes
7
answers
8k
views
Software Testing vs (Web) Penetration Testing
I would like to ask about the differences between Software Testing and Web Application Penetration Testing.
I am aware of usage different tools in both disciplines Software Testing (JIRA/Selenium) ...
- 1,590
3
votes
1
answer
1k
views
How to set up a multi-developer environment with emphasis on source code security?
One of my clients runs a small software development company (15 employees) with PHP as their sole server side development language. They are having a networked environment with all the computers ...
1
vote
2
answers
7k
views
Source code disclosure vulnerability
I am a bit confused about the discussion here about hiding javascript source code. Let's say if I browse to a url like this: http://www.example.com/site/somejs.js and then what I see is something like ...
- 715
1
vote
1
answer
288
views
What precautions I can take to secure software against user?
I want to build a client that connects to my server and uses server API. You can consider this as a banking application because data security is the most important thing. Since the users or hackers ...
- 662
2
votes
0
answers
650
views
rootkits subverting the windows kernel source code [closed]
I just purchased the book "rootkits: subverting the windows kernel" by Greg Hoglund and James Butler for a research project at work.
However, this book constantly refers to the source code that can be ...
- 129
5
votes
2
answers
2k
views
What are the security risks in leaving 'sudo' inside my production code?
I have a script that can only run successfully with root permissions
But in development it's really hard to run with root permissions (in my development environment) so I add 'sudo' when ever it's ...
- 207
3
votes
2
answers
2k
views
Expose the source code repository externally or allow VPN access?
To allow third party consultants, offshore developers and contractors working on the code, we can expose our Git repository externally. Or we can grant VPN access to the external parties and limit ...
- 905
34
votes
4
answers
11k
views
Which security measures does PyPI and similar third-party software repositories take?
PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)).
How does PyPI prevent people from uploading malware?
When I ...
- 3,904
5
votes
2
answers
232
views
Can we verify that an app store ships the same code I have been shown?
When thinking about which messaging solution to use on my new "smart"phone I reflexively tended towards open source products, figuring that I could trust these more to actually provide the security ...
- 265
55
votes
5
answers
5k
views
Should security-critical code be reused or rewritten?
Usually, in programming, reusing code is always a better idea than writing your own implementation of an algorithm. If an implementation has been around for a long time and is still used by lots of ...
- 795
2
votes
1
answer
835
views
Code deployment in PCI CDE
The PCI DSS v3 standard states the following:
Network Segmentation
To be considered out of scope for PCI DSS, a system component must be properly isolated (segmented) from the CDE, such that ...
- 33.8k
45
votes
3
answers
7k
views
How safe are signed git tags? Only as safe as SHA-1 or somehow safer?
How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around.
So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
- 744
1
vote
3
answers
4k
views
What are main differences between Source Code Analysis vs Static Application Security Testing(SAST)?
Do these 2 terminologies refer to the same thing?
https://www.owasp.org/index.php/Source_Code_Analysis_Tools
http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis#.NET
Some of the ...
- 329
31
votes
0
answers
2k
views
Can you prove that an open source program is running the same code that it claims to be? [duplicate]
So if a group has made open source software, and the source code is available on github, and is bundled with an executable in their main download, can it be proven that the executable is compiled from ...
- 411
0
votes
1
answer
222
views
How can I prove to users of the software that the binaries I post match source code that's been inspected and verified by a third party? [duplicate]
If I have software that's like TrueCrypt where security is very important, but unlike TrueCrypt because mine won't mysteriously go offline for seemingly no reason at all, how can I prove that my ...
- 492
14
votes
3
answers
2k
views
What are the security implications of 'open-source' vs. 'source-available'?
In light of the current fiasco surrounding TrueCrypt, I have received considerable criticism from current clients and peers in the IT industry for my continued support of the open-source model. Such ...
- 1,334
17
votes
2
answers
24k
views
Are private git repositories safe?
I've heard from several people that private repository servers like BitBucket are not really safe. I've heard rumours about code being stolen and used by people even out of private repositories.
Is ...
- 273
1
vote
2
answers
315
views
Open Source OS - code you see vs code you get
In this question I will use the example of Linux OS, but I am also interested in general situation.
Linux OS distributions are famous for being open source and thus rather secure. But how can you be ...
- 421
1
vote
2
answers
1k
views
Static code analysis strategies [closed]
Imagine: We have been given the source code of several software programs, some open source, others proprietary. What's the best strategy to analyze the source code in each case?
For example: We know ...
- 147
3
votes
5
answers
1k
views
What is the security flaw in this example of "magic parameters"?
I am reading OWASP Testing Guide v3:
Example 1: Magic Parameters
Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For simplicity, the GET request may be: ...
- 437
17
votes
5
answers
38k
views
How can one secure a password/key in source code [duplicate]
If there is a need for source code to have a password in it, how
should this be secured? This is purely an example, but say there is an
app that is using an API, and you don't want to expose your ...
- 273
1
vote
0
answers
81
views
Tracking checkins from generic users
Im trying to implement a better system to monitor checkins to our repository. We have some generic users everyone can use, I have recently disallowed them from checking in as those users however there ...
- 11
0
votes
2
answers
200
views
Displaying a video through the web whilst hiding the location
I felt this fit more here than SO, if not, please vote to migrate.
We've been approached by a company who would like to use our platform to host their videos. The issue is that right now, we use the ...
- 103
5
votes
0
answers
6k
views
AngularJS Static Analysis Tools [closed]
I am setting up a software security initiative at a small software company. Part of this is selecting a static analysis tool for early and automated detection of security vulnerabilities.
Many ...
- 371
4
votes
2
answers
770
views
If Apache is configured to parse PHP can users see PHP source code?
If Apache is configured to parse PHP and not allow to index files, are there other ways users can see PHP source code, either with or without intention?
- 141
127
votes
7
answers
67k
views
Is using Git for deploying a bad practice?
I tend to use Git for deploying production code to the web server. That usually means that somewhere a master Git repository is hosted somewhere accessible over ssh, and the production server serves ...
- 1,373