175
votes
Accepted
Why are programs written in C and C++ so frequently vulnerable to overflow attacks?
C and C++, contrary to most other languages, traditionally do not check for overflows. If the source code says to put 120 bytes in an 85-byte buffer, the CPU will happily do so. This is related to the ...
- 326k
58
votes
Why are programs written in C and C++ so frequently vulnerable to overflow attacks?
Note that there is some amount of circular reasoning involved: Security issues are frequently linked to C and C++. But how much of that is due to inherent weaknesses of these languages, and how much ...
- 911
58
votes
Can I rely on these GitHub repository files?
Compilation is not a directly verifiable deterministic process across compiler versions, library versions, operating systems, or a number of other different variables. The only way to verify is to ...
- 135k
52
votes
Accepted
What security measure one should implement before executing user uploaded files?
It is impossible to analyze a program to find out if it will do anything malicious. That is true regardless of whether you are attempting to analyze the source or compiled code.
The way to do what ...
- 5,482
43
votes
Accepted
How to best obfuscate a built-in key in an application?
Hard-coded credentials are considered a vulnerability. Cisco gets caught time and time again, and have to issue a fix to remove them every time.
No matter how many layers of obfuscation you employ, ...
- 53.6k
37
votes
Why are programs written in C and C++ so frequently vulnerable to overflow attacks?
Actually, "heartbleed" was not really a buffer overflow. To make things more "efficient", they put many smaller buffers into one big buffer. The big buffer contained data from various clients. The bug ...
- 2,135
28
votes
What security measure one should implement before executing user uploaded files?
This is a really hard problem, and one all online code judges has to solve. Basically, you are asking how you can prevent somebody who can execute arbitrary code on your machine from taking it over.
...
- 381
26
votes
Why are programs written in C and C++ so frequently vulnerable to overflow attacks?
First, as others have mentioned, C/C++ is sometimes characterized as a glorified macro assembler: it is meant to be "close to the iron", as a language for system-level programming.
So for instance, ...
- 439
22
votes
Accepted
Can I rely on these GitHub repository files?
Polynomial tells you what may happen, and how to solve it. Here I will illustrate it:
I ran both binaries through strings and diffed them. That enough shows some completely harmless differences, in ...
- 336
9
votes
Accepted
How does using unsigned integers protect against integer overflow attacks?
Using unsigned integers does not prevent overflow. A k-bit variable can only represent 2k different values. No matter how you interpret the bits.
What you're probably referring to is the fact that ...
- 810
8
votes
How to best obfuscate a built-in key in an application?
log into a website using built-in credentials.
Going over HTTP(S) is always going to be an enormous hurdle to any obfuscation, especially if the website you are logging into has a regular username/...
- 3,139
7
votes
What security measure one should implement before executing user uploaded files?
In the particular case of a puzzle website, consider the alternative: don't bother. Ask participants to upload the output so you don't have to run untrusted code. This saves you computing power, ...
- 2,144
7
votes
Is it possible to crack g++ rand()?
The compiler itself is irrelevant; the rand() function is implemented in libc.
The glibc implementation uses a linear congruential generator (LCG) or a linear feedback shift register (LFSR) for its ...
- 135k
7
votes
What are attackers trying to achieve when doing attacks on local programs such as buffer overflows?
An aspect which hasn't been mentioned yet very clearly: suppose you have a multi-user system (as all modern PC OSes like Windows, Linux, Unix and so on are), and suppose you are a normal (non-...
- 567
7
votes
Accepted
Encrypting password string in C++
No, you shouldn't encrypt the password on the client if the transmission of data is secured.
If you got it all perfect, you're not likely to add any security to the process.
If you don't get it ...
- 18.7k
6
votes
Accepted
Will Intel's MPX extension make C/C++ completely safe to use?
Firstly, C++ has enough degrees of freedom that a computer cannot make it completely safe. C++ literally gives you full access to anything the CPU can do.
Functions like fscanf are just routines that ...
- 1,700
6
votes
What do you search for in Open Source code to be sure there isn't malicious code?
If you want to be 100% sure that some git repo doesn't contain malicious code, write it yourself; anything else will be an uphill battle.
If someone's really truly trying to hide malicious code in ...
- 58.8k
5
votes
Accepted
Protecting master password in memory
I think that having sensitive data (whether it is the password, or derived key, etc) in memory is not something that most systems deal with.
That being said, here are several possible mitigation ...
- 14k
5
votes
How to programatically verify a file signature?
With all due respect, you are trying to reinvent the wheel for something that you don't understand very well. You are trying to hand-roll your own RSA signature verification code so that your app can ...
- 58.8k
4
votes
Why are programs written in C and C++ so frequently vulnerable to overflow attacks?
I will probably touch on some things some of the other answers have already stated.. but.. I find the question itself to be erroneous and "vulnerable".
As asked, the question is assuming a lot ...
- 149
4
votes
Do I need to run security on sockets in C++?
The Secure Sockets Layer does indeed refer to the operating system concept of sockets.
Sockets are a generalized form of inter-process communication. At the most basic level a socket allows you to ...
- 1,396
4
votes
is it possible to craft exploits for non-open source C/C++ software without fuzzing?
Yes, it's completely possible. You can read through all of the assembly, determine what conditions are not accounted for, and then exploit them. In fact, even when using fuzzing, you will need to ...
- 3,322
4
votes
Accepted
Is it secure to store my mysql password in a const std::string?
Hardcoding of secrets is never a good idea.
Use a configuration file, to read from. This way you will be able to swiftly change the password if required and prevent the password from leaking through ...
4
votes
Accepted
Issue with openssl base64 decode function while decoding jwt payload
The reason is that base64-encoded strings should be a multiple of 4 characters in length. If the base-64 string is not a multiple of 4 characters in length, then pad it using the '=' characters.
The ...
- 22.7k
4
votes
How to best obfuscate a built-in key in an application?
Don't bother with the app - check the data instead (if you need to)
Really, the only use case where you'd care about this kind of login is if the server has to trust the data produced by the app - and ...
- 621
3
votes
Accepted
How can I check my program for vulnerabilities over TCP?
You can attempt to look for classes of vulnerabilities, but the complexity of the code will likely exhaust you before you exhaust even the smallest possibility space. This is why compiler aware ...
- 291
3
votes
Accepted
C++ : memset on a struct containing std::wstring - Is it a risk?
I believe the issue lies with the fact that std::wstring is not necessarily a simple structure in the traditional C sense.
Instead it'll be a class with an internal state, structure and possible a ...
- 1,890
3
votes
protect c ++ application via an automatic hardware binding
Someone with a debugger (like gdb, or anything else that can use the Linux Kernel's tracing capabilities and can utilize binaries) will have an easy time figuring out how to circumvent your copy ...
- 5,928
Only top scored, non community-wiki answers of a minimum length are eligible