Question

Are there any known methods that can be used to make your software immune to viruses? To be more specific, the development is done in .NET. Is there anything built into .NET that would help with this? I had someone specifically ask me about this and I did not have the slightest clue.

Update: Immunity in this situation would mean immune to exploitation. At least I believe that’s what the person asking the question to me wanted to know.

I realize this is an extremely open ended question and that software development is way off from being at a point where it software developed can really be immune to viruses.

Answer 1

When you say immune to viruses, do you mean immune to exploitation? I think any software being immune to viruses is some way off for any development platform.

In general, there are two important activities that lead to secure software

• 1) Safety by design – does the
  inherent design of a system allow an
  attacker to control the host machine. However, a secure design won’t protect against insecure coding.
• 2) Secure coding – most
  importantly, don’t trust user input. However, secure coding won’t protect against an insecure design.

There are several features of .NET that help reduce the liklihood of exploitation.

• 1) .NET takes care of memory
  allocation and destruction. This helps prevent exploitable heap corruption.
• 2) .NET, by default, will bounds check array accesses. In C based languages, overwriting, or underwriting into arrays has allowed attackers to write memory into the target process.
  .
• 3) .NET execution model is not
  vulnerable to stack overflows in the
  same way as the normal x86 execution
  model. Arrays are allocated on the
  heap.
• 4) you can set Code Access permissions, if used properly these help prevent untrusted code performing privileged actions on the host machine.