Question

Can some one please tell me an approach for finding security flaws in a given code. For ex: in a given socket program. Any good examples or good book recommendations are welcome.

Thanks & Regards,

Mousey

Answer 1

The lowest hanging fruit in this category would be to simply search the source for functions which are commonly misused or are difficult use safely such as:

• strcpy
• strcat
• sprintf
• gets

then start looking at ones that are not inherintly too bad, but could be misused. Particularly anything that writes to a buffer can potentially be hazardous if misused.

• memcpy
• memmove
• recv/read
• send/write
• the entire printf family should always have a constant for the format string

NOTE: all of these (except gets) can be used correctly, so don’t think it’s a flaw just because the function is used, instead take a look at how it is used. Also note that gets is always a flaw.

NOTE2: this list is not exhaustive, do a little research about commonly misused functions and how they can be avoided.

As far as tools, I recommend things like valgrind and splint