Secure Software Development
Taxonomy of Coding Errors
Docsity.com
Prepare for your exams
Study with the several resources on Docsity
Earn points to download
Earn points by helping other students or get them with a premium plan
Guidelines and tips
Prepare for your exams
Study with the several resources on Docsity
Earn points to download
Earn points by helping other students or get them with a premium plan
Taxonomy of Coding Errors: Understanding Common Software Vulnerabilities, Slides of Software Engineering
An overview of common coding errors and vulnerabilities in application development, focusing on application vulnerabilities, web application attacks, application patching, and the goal of taxonomy. It covers various types of coding errors, including input validation and representation, api abuse, security features, time and state, error handling, code quality, encapsulation, and environment.
Typology: Slides
2012/2013
1 / 18
This page cannot be seen from the preview
Don't miss anything!
Related documents
Partial preview of the text
Download Taxonomy of Coding Errors: Understanding Common Software Vulnerabilities and more Slides Software Engineering in PDF only on Docsity!
Secure Software Development
Taxonomy of Coding Errors
Application Vulnerabilities
application vulnerabilities >> # OS vulnerabilities
- Most "popular" applications – change over time
- prevalence
- inability to effectively patch
- Current targets: browsers and client-side applications
Application Patching
- Much Slower than Operating System Patching
- Zero-Day Vulnerability: a flaw in software code is discovered and code exploiting the flaw appears before a fix or patch is available - Adobe Acrobat, Reader, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862) - Microsoft Office Web Components ActiveX Control Code Execution Vulnerability (CVE-2009-1136) - Microsoft Active Template Library Header Data Remote Code Execution Vulnerability ( 0015 ) CVE-2008- - Microsoft DirectX DirectShow QuickTime Video Remote Code Execution Vulnerability ( 1537 ) CVE-2009- - Adobe Reader Remote Code Execution Vulnerability (CVE-2009-1493) - Microsoft PowerPoint Remote Code Execution Vulnerability (CVE-2009-0556)
Goal of Taxonomy
- List of common coding mistakes
- Support for software developers to avoid making mistakes
- Useful in automated tools
- Real time
- Compile time
- Teaching aid
- NOT an attack taxonomy
Taxonomy of Coding Errors
- Positive approach
- Incomplete and imperfect
- Practical and based on real world experiences
- Focus on large enterprise software
Components
- Phylum: type or particular kind of coding error
- Kingdom: a collection of phyla that share a common theme
Input Validation and Representation
- Caused by meta-characters, alternate encoding, and numeric representations
- Problem: trusting input
- Examples: buffer overflow, cross-site scripting, SQL injection, etc.
API Abuse
- API: contact between a caller and a callee
- Common problem: caller failing to honor its end of contract
- Example: failing to perform expected actions
- Both sides may violate contract
Time and State
- Distributed computation: more than 1 component communicate, share states, uses system resources
- Time requirements for distributed computing
- Interactions between threads, processes, time, and information
Error Handling
- Junk input
- Class of programming contract
- Similar to API abuse
- Very common
- Producing errors or giving out too much information
Encapsulation
- Drawing boundaries between things and setting up barriers between them
- Trust and trust models
Environment
- Machine the software runs on
- Connection to the external context
- Things outside of the code but critical to the security of the software