Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd
Upload
406 views

Secure Coding in C and C++

This document outlines a 4-day course on secure coding in C and C++. The course covers topics like buffer overflows, integer overflows, input validation, file handling, network security, encryption, authentication, thread safety, logging and error handling, and anti-reversing techniques.

Uploaded by

Temperory Mail
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
406 views

Secure Coding in C and C++

This document outlines a 4-day course on secure coding in C and C++. The course covers topics like buffer overflows, integer overflows, input validation, file handling, network security, encryption, authentication, thread safety, logging and error handling, and anti-reversing techniques.

Uploaded by

Temperory Mail
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 7

C and C++ Secure Coding

4-day course

Syllabus
C and C++ Secure Coding 4-Day Course
Course description

Secure Programming is the last line of defense against attacks targeted toward our systems.
This course shows you how to identify security flaws & implement security countermeasures in
different areas of the software development lifecycle and apply these skills to improve the
overall quality of the products and applications. Using sound programming techniques and best
practices shown in this course, you can produce high-quality code that stands up to attack.

The course covers major security principles in C/C++ and software vulnerabilities caused be
unsecure coding. The objectives of the course are to acquaint students with security concepts
and terminology, and to provide them with a solid foundation for developing software using the
best practices in C/C++. By course completion, students should be proficient in secure
programming and have learnt the basics of security analysis and design. Students should then
be able to develop, design and maintain applications using security methods and techniques for
the C/C++ language.

Target audience

Members of the software development team:


C / C++ Developers
Designers & Architects

Prerequisites

Before attending this course, students should be familiar with:


C/C++ language
Background in memory management
Background in OS mechanisms

1|P age
Course topics
Day 1

Buffer Overflows and Code Injections

Stack Overflows attacks


Heap overflows attacks
Array indexing attacks
Format strings attacks
Unsafe API’s
Safer API’s
Stack guards
Compiler checks
Better ways to manipulate strings and buffers.

Integer Overflows

Int / Double overflows


Integer conversion rules
Signed and unsigned problems
Safe integer usage
Enforcing limits on integer values
Preventing lost or misinterpreted data due to conversion
Using secure integer libraries

Safe API

Dangerous and banned APIs


Real-World Risks
Using safe API’s
The ‘n’ Functions
Detecting Dangerous APIs
Alternatives
StrSafe

2|P age
Secure Memory Usage

Secure memory handling


Erasing Data
Secure pointer usage
Memory Dumps
Use smart pointers for resource management
Ensure pointer arithmetic
Avoid null pointer dereferencing
Ensure sensitive data is not paged to disk

LAB
Hands on lab #1

Day 2
Input Validation

What is considered Input?


Common Errors - Unbounded string copies, Null-termination errors, Truncation, Write
outside array bounds, Off-by-one errors, Improper data sanitization
Black List VS. White List Validation
ATTACK SCENARIO: Canonicalization
String Manipulation and Comparison
Data Type Conversion
Regular Expressions
Validation practices - Validating format strings, Validating buffer input, Validating
filenames & URLs, Validating emails

Secure File Handling

Directory Traversal attacks


File canonicalization attacks
Creating files with correct ACLs
Ensure files are closed when no longer needed
Insecure usage of shared directories

3|P age
Application Denial of Service vulnerabilities

Application / OS crash
CPU starvation
Memory starvation
File system starvation
Resource starvation
Triggering high network bandwidth
User level DOS
Exploiting a specific vulnerability to cause DoS

LAB
Hands on lab #2

Day 3
Network Security

Introduction to Networking
Network attacks
Insecure Services
Application Layer Threats and attacks
Traffic Sniffing
Traffic Manipulation
Man-in-the-Middle
Avoiding Server Socket Hijacking
Firewall Friendly Application

Encryption in C/C++

Introduction to cryptography
ATTACK SCENARIO: Weak Encryption
Symmetric encryption
Asymmetric encryption
Transport Level Encryption
Storage Level Encryption
Cryptographic API's – CryptoApi, DPAPI, Crypro++

4|P age
Authentication & Authorization

Authentication scenarios
Common mistakes
Attack scenario: brute force
Authentication protocols
Attack scenario: weak passwords
Authorization models
Access Control List (ACL)
Role Based Access Control (RBAC)
Attack scenario: exposed functionality via anonymous authentication

LAB
Hands on lab #3

Day 4
Thread safety

Concurrency & Race conditions


Mutual Exclusion
Deadlock
Time of Check/Time of Use (TOCTOU)
Files as Locks
Symbolic link attacks
Temporary files
Handling the race window
controlling race objects
using atomic operations

Logging & Error handling

How to use exceptions properly


Process uncaught and unexpected exceptions
Prevent sensitive information disclosure via errors
Declare new exception classes for security
Events you should log
Events you should not log
Log integration with exception management

5|P age
Secure Coding Tips

Prefer Streams to C-Style Input and Output


Do not replace secure functions with less secure functions
Avoid defining macros
Do not ignore values returned by functions or methods
Secure defaults and initializations
The least privilege principle
The defense in depth principle
The segmentation principle
Avoiding hard coded secrets
Use Static Code Tools
Integrating security into the development lifecycle

Anti-reversing

Eliminate “symbolic info”


Obfuscate the program
Code Encryption
Use anti-debugger tricks
Code Checksums
Confusing a Disassembler
Inlining and Outlining sensitive code
Interleaving Code
Existing tools

LAB
Hands on lab #4

6|P age

You might also like