58
votes
Can I rely on these GitHub repository files?
Compilation is not a directly verifiable deterministic process across compiler versions, library versions, operating systems, or a number of other different variables. The only way to verify is to ...
- 136k
52
votes
Accepted
What security measure one should implement before executing user uploaded files?
It is impossible to analyze a program to find out if it will do anything malicious. That is true regardless of whether you are attempting to analyze the source or compiled code.
The way to do what ...
- 5,472
43
votes
Accepted
How to best obfuscate a built-in key in an application?
Hard-coded credentials are considered a vulnerability. Cisco gets caught time and time again, and have to issue a fix to remove them every time.
No matter how many layers of obfuscation you employ, ...
- 55.5k
28
votes
What security measure one should implement before executing user uploaded files?
This is a really hard problem, and one all online code judges has to solve. Basically, you are asking how you can prevent somebody who can execute arbitrary code on your machine from taking it over.
...
- 381
22
votes
Accepted
Can I rely on these GitHub repository files?
Polynomial tells you what may happen, and how to solve it. Here I will illustrate it:
I ran both binaries through strings and diffed them. That enough shows some completely harmless differences, in ...
- 336
9
votes
Accepted
How does using unsigned integers protect against integer overflow attacks?
Using unsigned integers does not prevent overflow. A k-bit variable can only represent 2k different values. No matter how you interpret the bits.
What you're probably referring to is the fact that ...
- 810
8
votes
How to best obfuscate a built-in key in an application?
log into a website using built-in credentials.
Going over HTTP(S) is always going to be an enormous hurdle to any obfuscation, especially if the website you are logging into has a regular username/...
- 3,299
7
votes
What security measure one should implement before executing user uploaded files?
In the particular case of a puzzle website, consider the alternative: don't bother. Ask participants to upload the output so you don't have to run untrusted code. This saves you computing power, ...
- 2,154
6
votes
How to make a file detected by anti virus
There is a standard file treated by all AV software I have used - the EICAR test file but this is used for testing the deployment and integration of a malware scanner, not its database. The only ...
- 18.8k
6
votes
What do you search for in Open Source code to be sure there isn't malicious code?
If you want to be 100% sure that some git repo doesn't contain malicious code, write it yourself; anything else will be an uphill battle.
If someone's really truly trying to hide malicious code in ...
- 59.3k
5
votes
How to programatically verify a file signature?
With all due respect, you are trying to reinvent the wheel for something that you don't understand very well. You are trying to hand-roll your own RSA signature verification code so that your app can ...
- 59.3k
5
votes
Accepted
Issue with openssl base64 decode function while decoding jwt payload
The reason is that base64-encoded strings should be a multiple of 4 characters in length. If the base-64 string is not a multiple of 4 characters in length, then pad it using the '=' characters.
The ...
- 24k
4
votes
Do I need to run security on sockets in C++?
The Secure Sockets Layer does indeed refer to the operating system concept of sockets.
Sockets are a generalized form of inter-process communication. At the most basic level a socket allows you to ...
- 1,426
4
votes
is it possible to craft exploits for non-open source C/C++ software without fuzzing?
Yes, it's completely possible. You can read through all of the assembly, determine what conditions are not accounted for, and then exploit them. In fact, even when using fuzzing, you will need to ...
- 3,322
4
votes
Accepted
Is it secure to store my mysql password in a const std::string?
Hardcoding of secrets is never a good idea.
Use a configuration file, to read from. This way you will be able to swiftly change the password if required and prevent the password from leaking through ...
4
votes
How to best obfuscate a built-in key in an application?
Don't bother with the app - check the data instead (if you need to)
Really, the only use case where you'd care about this kind of login is if the server has to trust the data produced by the app - and ...
- 845
3
votes
Over 100 scanner requests 5 min after domain registration
This is just the background noise of the internet. Having a publicly routable IP address is all it takes to get scanned. There are countless systems constantly probing the entire internet, some for ...
- 13.2k
3
votes
Accepted
How to generate CSR(Certificate Signing Request) using C++ and openssl
If you compare the output from openssl req -in yourcsr.pem -text with CSR created by the usual openssl commands you will find, that the version is shown as 1 in your CSR while 0 in the usual CSR:
...
- 208k
3
votes
Accepted
Are Optimization Flags Harmful?
In the bug report you linked, the developer tries to overwrite the password in memory. This changes only the memory contents and has no other side effects.
An optimizing compiler may change the code ...
- 34.4k
3
votes
Accepted
Some vulnerable projects in C or C++ for a lecture?
Open Security Training has some great resources to teach developers about secure code practices including a virtual machine with compilers and vulnerable code samples
Also look at NIST's SAMATE TEST ...
- 111
3
votes
protect c ++ application via an automatic hardware binding
Someone with a debugger (like gdb, or anything else that can use the Linux Kernel's tracing capabilities and can utilize binaries) will have an easy time figuring out how to circumvent your copy ...
- 6,284
3
votes
Accepted
How can I check my program for vulnerabilities over TCP?
You can attempt to look for classes of vulnerabilities, but the complexity of the code will likely exhaust you before you exhaust even the smallest possibility space. This is why compiler aware ...
- 291
3
votes
Accepted
Why is this not a buffer overflow?
You have to check the addresses of the char arrays, because your assumption that yy starts right after xx in memory is not necessarily true. I modified your code a bit so that it prints the addresses:
...
- 76
3
votes
Exploitation tactics for heap over-reading?
There are two distinct questions here:
How easy is it to trigger the vulnerability? In other words, how easy is it to make the program do something it isn't supposed to do?
How severe is the ...
3
votes
Accepted
Is malware programmed in high-level language will be more detected than malware programmed in low-level language?
What the processor sees when it is executing is never the source code - it sees machine code, which in its human-readable format is called assembly code.
When you compile a program, in any compiled ...
- 111
3
votes
How to best obfuscate a built-in key in an application?
How do I best obfuscate this key so that it isn't visible in a file dump of the executable? Are there best practices for that as well?
There is a system where you encrypt your key using AES, and the ...
- 34.4k
3
votes
How to best obfuscate a built-in key in an application?
Security becomes more challenging in this area, but this is a legitimate question. You should look very carefully at the scenario to see whether additional user or device authentication are possible; ...
- 203
Only top scored, non community-wiki answers of a minimum length are eligible