SECURE PROGRAMMING WITH STATIC ANALYSIS
PART I: SOFTWARE SECURITY AND STATIC ANALYSIS THE SOFTWARE SECURITY PROBLEM 1 1 DEFENSIVE PROGRAMMING IS NOT ENOUGH 1 2 SECURITY FEATURES != SECURE FEATURES 1 3 THE QUALITY FALLACY 1 4 STATIC ANALYSIS IN THE BIG PICTURE 1 5 CLASSIFYING VULNERABILITIES THE SEVEN PERNICIOUS KINGDOMS 1 6 SUMMARY INTRODUCTION TO STATIC ANALYSIS 2 1 CAPABILITIES AND LIMITATIONS OF STATIC ANALYSIS 2 2 SOLVING PROBLEMS WITH STATIC ANALYSIS TYPE CHECKING STYLE CHECKING PROGRAM UNDERSTANDING PROGRAM VERI?CATION AND PROPERTY CHECKING BUG FINDING SECURITY REVIEW 2 3 A LITTLE THEORY, A LITTLE REALITY SUCCESS CRITERIA ANALYZING THE SOURCE VS ANALYZING COMPILED CODE SUMMARY CONTENTS STATIC ANALYSIS AS PART OF THE CODE REVIEW PROCESS 3 1 PERFORMING A CODE REVIEW THE REVIEW CYCLE STEER CLEAR OF THE EXPLOITABILITY TRAP 3 2 ADDING SECURITY REVIEW TO AN EXISTING DEVELOPMENT PROCESS ADOPTION ANXIETY START SMALL, RATCHET UP 3 3 STATIC ANALYSIS METRICS STATIC ANALYSIS INTERNALS 4 1 BUILDING A MODEL LEXICAL ANALYSIS PARSING ABSTRACT SYNTAX SEMANTIC ANALYSIS TRACKING CONTROL FLOW TRACKING DATA?OW TAINT PROPAGATION POINTER ALIASING 4 2 ANALYSIS ALGORITHMS CHECKING ASSERTIONS NAÏVE LOCAL ANALYSIS APPROACHES TO LOCAL ANALYSIS GLOBAL ANALYSIS RESEARCH TOOLS 4 3 RULES RULE FORMATS RULES FOR TAINT PROPAGATION RULES IN PRINT 4 4 REPORTING RESULTS GROUPING AND SORTING RESULTS ELIMINATING UNWANTED RESULTS EXPLAINING THE SIGNI?CANCE OF THE RESULTS PART II: PERVASIVE PROBLEMS HANDLING INPUT 5 1 WHAT TO VALIDATE VALIDATE ALL INPUT VALIDATE INPUT FROM ALL SOURCES ESTABLISH TRUST BOUNDARIES 5 2 HOW TO VALIDATE USE STRONG INPUT VALIDATION AVOID BLACKLISTING DON’T MISTAKE USABILITY FOR SECURITY REJECT BAD DATA MAKE GOOD INPUT VALIDATION THE DEFAULT CHECK INPUT LENGTH BOUND NUMERIC INPUT 5 3 PREVENTING METACHARACTER VULNERABILITIES USE PARAMETERIZED REQUESTS PATH MANIPULATION COMMAND INJECTION LOG FORGING BUFFER OVER?OW 6 1 INTRODUCTION TO BUFFER OVER?OW EXPLOITING BUFFER OVER?OW VULNERABILITIES BUFFER ALLOCATION STRATEGIES TRACKING BUFFER SIZES 6 2 STRINGS INHERENTLY DANGEROUS FUNCTIONS BOUNDED STRING OPERATIONS COMMON PITFALLS WITH BOUNDED FUNCTIONS MAINTAINING THE NULL TERMINATOR CHARACTER SETS, REPRESENTATIONS, AND ENCODINGS FORMAT STRINGS BETTER STRING CLASSES AND LIBRARIES BRIDE OF BUFFER OVER?OW 7 1 INTEGERS WRAP-AROUND ERRORS TRUNCATION AND SIGN EXTENSION CONVERSION BETWEEN SIGNED AND UNSIGNED METHODS TO DETECT AND PREVENT INTEGER OVER?OW 7 2 RUNTIME PROTECTION SAFER PROGRAMMING LANGUAGES SAFER C DIALECTS DYNAMIC BUFFER OVER?OW PROTECTIONS DYNAMIC PROTECTION BENCHMARK RESULTS ERRORS AND EXCEPTIONS 8 1 HANDLING ERRORS WITH RETURN CODES CHECKING RETURN VALUES IN C CHECKING RETURN VALUES IN JAVA 8 2 MANAGING EXCEPTIONS CATCH EVERYTHING AT THE TOP LEVEL THE VANISHING EXCEPTION CATCH ONLY WHAT YOU’RE PREPARED TO CONSUME KEEP CHECKED EXCEPTIONS IN CHECK 8 3 PREVENTING RESOURCE LEAKS C AND C++ JAVA 8 4 LOGGING AND DEBUGGING CENTRALIZE LOGGING KEEP DEBUGGING AIDS AND BACK-DOOR ACCESS CODE OUT OF PRODUCTION CLEAN OUT BACKUP FILES DO NOT TOLERATE EASTER EGGS PART III: FEATURES AND FLAVORS WEB APPLICATIONS 9 1 INPUT AND OUTPUT VALIDATION FOR THE WEB EXPECT THAT THE BROWSER HAS BEEN SUBVERTED ASSUME THAT THE BROWSER IS AN OPEN BOOK PROTECT THE BROWSER FROM MALICIOUS CONTENT 9 2 HTTP CONSIDERATIONS USE POST, NOT GET REQUEST ORDERING ERROR HANDLING REQUEST PROVENANCE 9 3 MAINTAINING SESSION STATE USE STRONG SESSION IDENTI?ERS ENFORCE A SESSION IDLE TIMEOUT AND A MAXIMUM SESSION LIFETIME BEGIN A NEW SESSION UPON AUTHENTICATION 9 4 USING THE STRUTS FRAMEWORK FOR INPUT VALIDATION SETTING UP THE STRUTS VALIDATOR USE THE STRUTS VALIDATOR FOR ALL ACTIONS VALIDATE EVERY PARAMETER MAINTAIN THE VALIDATION LOGIC XML AND WEB SERVICES WORKING WITH XML USE A STANDARDS-COMPLIANT XML PARSER TURN ON VALIDATION BE CAUTIOUS ABOUT EXTERNAL REFERENCES KEEP CONTROL OF DOCUMENT QUERIES USING WEB SERVICES INPUT VALIDATION WSDL WORRIES OVER EXPOSURE NEW OPPORTUNITIES FOR OLD ERRORS JAVASCRIPT HIJACKING: A NEW FRONTIER PRIVACY AND SECRETS PRIVACY AND REGULATION IDENTIFYING PRIVATE INFORMATION HANDLING PRIVATE INFORMATION OUTBOUND PASSWORDS KEEP PASSWORDS OUT OF SOURCE CODE DON’T STORE CLEAR-TEXT PASSWORDS RANDOM NUMBERS GENERATING RANDOM NUMBERS IN JAVA GENERATING RANDOM NUMBERS IN C AND C++ CRYPTOGRAPHY CHOOSE A GOOD ALGORITHM DON’T ROLL YOUR OWN SECRETS IN MEMORY MINIMIZE TIME SPENT HOLDING SECRETS SHARE SECRETS SPARINGLY ERASE SECRETS SECURELY PREVENT UNNECESSARY DUPLICATION OF SECRETS PRIVILEGED PROGRAMS IMPLICATIONS OF PRIVILEGE PRINCIPLE OF LEAST PRIVILEGE THIS TIME WE MEAN IT: DISTRUST EVERYTHING MANAGING PRIVILEGE PUTTING LEAST PRIVILEGE INTO PRACTICE RESTRICT PRIVILEGE ON THE FILESYSTEM BEWARE OF UNEXPECTED EVENTS PRIVILEGE ESCALATION ATTACKS FILE ACCESS RACE CONDITIONS INSECURE TEMPORARY FILES STANDARD FILE DESCRIPTORS PART IV: STATIC ANALYSIS IN PRACTICE SOURCE CODE ANALYSIS EXERCISES FOR JAVA EXERCISE 13 0 INSTALLATION EXERCISE 13 1 BEGIN WITH THE END IN MIND EXERCISE 13 2 AUDITING SOURCE CODE MANUALLY EXERCISE 13 3 RUNNING FORTIFY SCA EXERCISE 13 4 UNDERSTANDING RAW ANALYSIS RESULTS EXERCISE 13 5 ANALYZING A FULL APPLICATION EXERCISE 13 6 TUNING RESULTS WITH AUDIT WORKBENCH EXERCISE 13 7 AUDITING ONE ISSUE EXERCISE 13 8 PERFORMING A COMPLETE AUDIT EXERCISE 13 9 WRITING CUSTOM RULES SOURCE CODE ANALYSIS EXERCISES FOR C EXERCISE 14 0 INSTALLATION EXERCISE 14 1 BEGIN WITH THE END IN MIND EXERCISE 14 2 AUDITING SOURCE CODE MANUALLY EXERCISE 14 3 RUNNING FORTIFY SCA EXERCISE 14 4 UNDERSTANDING RAW ANALYSIS RESULTS EXERCISE 14 5 ANALYZING A FULL APPLICATION EXERCISE 14 6 TUNING RESULTS WITH AUDIT WORKBENCH EXERCISE 14 7 AUDITING ONE ISSUE EXERCISE 14 8 PERFORMING A COMPLETE AUDIT EXERCISE 14 9 WRITING CUSTOM RULES EPILOGUE REFERENCES