Discovering vulnerabilities in C C
The purpose of this post is to describe the topic of my Masters project, the goal of the project and why is important to investigate this topic in more depth. The topic is Discovering vulnerabilities in C/C++ code and final goal is to give an overview of vulnerabilities that exist and create a tool which would analyze the source code and find potential vulnerabilities. By doing so it should be possible to identify flows that potentially enable an attacker to pass malicious code.
The C programming language was created in the early 1970s as a system implementation language for the UNIX operating system by Dennis Ritchie. Before 1983, Bjarne Stroustrup added features to C and called that "C with classes" and from that he created in 1985 C++ language. C++ is the most famous descent of C language, but there are others too, like C*, Objective-C. Reason for looking both languages as one is because C++ maintain back compatibility for the C language. Because of that they have similar characteristic and vulnerabilities found in C are also applicable to C++. An important reason for investigating C/C++ languages from a security perspective is wide use of those languages and characteristic of those languages. With Java they are three the most used languages today and significant amount of legacy code was created. Problem with C languages is that it is intended to be a lightweight. This characteristic leads to vulnerabilities when programmers fail to implement the required logic because they assume it is handled by C. These false assumptions, then cause writing beyond boundaries of an array, integer overflows, and calling functions with wrong number of arguments. Source of security problems with the language can be summarized in phrases like:
The C programming language was created in the early 1970s as a system implementation language for the UNIX operating system by Dennis Ritchie. Before 1983, Bjarne Stroustrup added features to C and called that "C with classes" and from that he created in 1985 C++ language. C++ is the most famous descent of C language, but there are others too, like C*, Objective-C. Reason for looking both languages as one is because C++ maintain back compatibility for the C language. Because of that they have similar characteristic and vulnerabilities found in C are also applicable to C++. An important reason for investigating C/C++ languages from a security perspective is wide use of those languages and characteristic of those languages. With Java they are three the most used languages today and significant amount of legacy code was created. Problem with C languages is that it is intended to be a lightweight. This characteristic leads to vulnerabilities when programmers fail to implement the required logic because they assume it is handled by C. These false assumptions, then cause writing beyond boundaries of an array, integer overflows, and calling functions with wrong number of arguments. Source of security problems with the language can be summarized in phrases like:
- Trust the programmer.
- Do not prevent the programmer from doing what needs to be done.
- Keep the language small and simple.
- Provide only one way to do an operation.
- Make it fast, even if it is not guaranteed to be portable.
As can be seen C/C++ unlike many other languages assume and demand level of expertise from a developer that is not always present and that can pose a big problem. Many security professionals recommend using other languages, such as Java but there are reasons because it can not be used different language. Some of the reasons are: maintaining legacy code, programming expertise, development environment, performance or other reasons not pertaining to security. When programs are developed in C/C++, the burden of producing secure code is placed largely on the programmer. Programmers are just people that make mistakes and because of that it is important to help them to build more secure software.
Next step is to understand the vulnerabilities and after that it is important to learn about countermeasures that can prevent those vulnerabilities. As well review of existing tools needs to be made so it can then be seen what enhancements can be made to help programmers code more secure.
download file now