Secure Coding in C and C++

C/C++ developers.

• Getting familiar with essential cyber security concepts
• Identify vulnerabilities and their consequences
• Learn the security best practices in C and C++
• Input validation approaches and principles

General C/C++ development.

Day 1

Cyber security basics

• What is security?
• Threat and risk
• Cyber security threat types
• Consequences of insecure software
   - Constraints and the market
   - The dark side

Memory management vulnerabilities

• Assembly basics and calling conventions
   - x64 assembly essentials
   - Registers and addressing
   - Most common instructions
   - Calling conventions on x64
      - Calling convention – what it is all about
      - The stack frame
      - Stacked function calls
  
  
• Buffer overflow
   - Memory management and security
   - Vulnerabilities in the real world
   - Buffer security issues
   - Buffer overflow on the stack
      - Buffer overflow on the stack – stack smashing
      - Exploitation – Hijacking the control flow
      - Lab – Buffer overflow 101, code reuse
      - Exploitation – Arbitrary code execution
      - Injecting shellcode
      - Lab – Code injection, exploitation with shellcode
   - Buffer overflow on the heap
      - Unsafe unlinking
      - Case study – Heartbleed
    - Pointer manipulation
      - Modification of jump tables
      - Overwriting function pointers
  
  
• Best practices and some typical mistakes
   - Unsafe functions
   - Dealing with unsafe functions
   - Lab – Fixing buffer overflow
   - What’s the problem with asctime()?
   - Lab – The problem with asctime()
   - Using std::string in C++
   - Unterminated strings
   - readlink() and string termination
   - Manipulating C-style strings in C++
   - Malicious string termination
   - Lab – String termination confusion
   - String length calculation mistakes
   - Off-by-one errors
   - Allocating nothing

Day 2

Memory management hardening

• Securing the toolchain
   - Securing the toolchain in C and C++
   - Compiler warnings and security
   - Using FORTIFY_SOURCE
   - Lab – Effects of FORTIFY
   - AddressSanitizer (ASan)
      - Using AddressSanitizer (ASan)
      - ASan changes to the prologue
      - ASan changes to memory read/write operations
      - ASan changes to the epilogue
      - Lab – Using AddressSanitizer
   - Stack smashing protection
      - Detecting BoF with a stack canary
      - Argument cloning
      - Stack smashing protection on various platforms
      - SSP changes to the prologue and epilogue
      - Lab – Effects of stack smashing protection
  
  
• Runtime protections
   - Runtime instrumentation
   - Address Space Layout Randomization (ASLR)
      - ASLR on various platforms
      - Lab – Effects of ASLR
      - Circumventing ASLR – NOP sleds
      - Circumventing ASLR – memory leakage
   - Non-executable memory areas
      - The NX bit
      - Write XOR Execute (W^X)
      - NX on various platforms
      - Lab – Effects of NX
      - NX circumvention – Code reuse attacks
         - Return-to-libc / arc injection
      - Return Oriented Programming (ROP)
         - Protection against ROP

Common software security weaknesses

• Security features
   - Authentication
      - Authentication basics
      - Multi-factor authentication
      - Authentication weaknesses
      - Case study – PayPal 2FA bypass
• Password management
   - Inbound password management
      - Storing account passwords
      - Password in transit
      - Lab – Is just hashing passwords enough?
      - Dictionary attacks and brute forcing
      - Salting
      - Adaptive hash functions for password storage
      - Password policy
         - NIST authenticator requirements for memorized secrets
   - Case study – The Ashley Madison data breach
      - The dictionary attack
      - The ultimate crack
      - Exploitation and the lessons learned
   - Password database migration

Code quality

• Code quality and security
• Data handling
   - Type mismatch
   - Lab – Type mismatch
   - Initialization and cleanup
      - Constructors and destructors
      - Initialization of static objects
      - Lab – Initialization cycles
      - Array disposal in C++
      - Lab – Mixing delete and delete[]
• Memory and pointers
   - Memory and pointer issues
   - Pointer handling pitfalls
   - Pointer usage in C and C++
      - Use after free
      - Lab – Use after free
      - Lab – Runtime instrumentation
      - Double free
      - Memory leak
      - Smart pointers and RAII
      - Smart pointer challenges

Day 3

Common software security weaknesses

• Input validation
   - Input validation principles
      - Blacklists and whitelists
      - Data validation techniques
      - What to validate – the attack surface
      - Where to validate – defense in depth
      - When to validate – validation vs transformations
      - Validation with regex
      - Regular expression denial of service (ReDoS)
      - Lab – ReDoS in C++
      - Dealing with ReDoS
   - Injection
      - Injection principles
      - Injection attacks
      - Code injection
         - OS command injection
            - Lab – Command injection
            - OS command injection best practices
            - Avoiding command injection with the right APIs
            - Lab – Command injection best practices
            - Case study – Shellshock
            - Lab – Shellshock
   - Process control – library injection
      - Library hijacking
      - Lab – Library hijacking
   - Integer handling problems
      - Representing signed numbers
      - Integer visualization
      - Integer promotion
      - Integer overflow
      - Lab – Integer overflow
      - Signed / unsigned confusion
      - Case study – The Stockholm Stock Exchange
      - Lab – Signed / unsigned confusion
      - Integer truncation
      - Lab – Integer truncation
      - Case study – WannaCry
      - Best practices
         - Upcasting
         - Precondition testing
         - Postcondition testing
         - Using big integer libraries
         - Best practices in C
         - UBSan changes to arithmetics
        - Lab – Handling integer overflow on the toolchain level in C and C++
   - Files and streams
      - Path traversal
      - Lab – Path traversal
      - Path traversal-related examples
      - Virtual resources
      - Path traversal best practices
      - Lab – Path canonicalization
   - Format string issues
      - The problem with printf()
      - Lab – Exploiting format string

Wrap up

• Secure coding principles
   - Principles of robust programming by Matt Bishop
   - Secure design principles of Saltzer and Schröder

And now what?

• Software security sources and further reading
• C and C++ resources