Email	Print Reprint
	add to:
	Del.icio.us Digg Google Furl	Slashdot Y! MyWeb Blink

It's a frequent yet unintended mistake among software developers.

A software developer copies a string in memory, but in doing so, unwittingly creates a vulnerability that can be exploited by an attacker to execute malicious code.

"The malicious code can do anything. It can be used to spread a worm, or insert a back door on a machine, steal the user's identity, steal information anything really," explains Robert Seacord, lead of the Secure Coding Team at the SEI CERT Program.

In fact, a recent study by Jon Heffley and Pascal Meunier found that 64 percent of vulnerabilities in the National Vulnerability Database in 2004 were the result of coding errors.

The coding errors and strategies for avoiding them are the subject of a pair of books by Seacord, Secure Coding in C and C++ and The CERT C Secure Coding Standard, as well as numerous articles such as Wide-Character Format String Vulnerabilities and Validating C and C++ for Safety and Security.

"[The CERT C Secure Coding Standard] is a comprehensive enumeration of coding errors that you can make that lead to vulnerabilities," Seacord explains. By complying with these secure coding guidelines, developers can reduce or eliminate vulnerabilities present in their software before deployment.

The standards are developed using a community process on the CERT Secure Coding wiki and incorporating input from more than 300 industry experts.

Secure Coding Class In addition to writing books and articles, Robert Seacord also teaches Secure Coding in C and C++, a four-day course that provides a detailed explanation of common programming errors in C and C++ and describes how these errors can lead to code that is vulnerable to exploitation. The course concentrates on security issues intrinsic to the C and C++ programming languages and associated libraries. The intent is for this course to be useful to anyone involved in developing secure C and C++ programs regardless of the specific application. Seacord's books are distributed as part of the course materials to supplement the hands-on learning of the course. The four-day course covers string management, dynamic memory management, integral security, formatted output, and file I/O. The next class presentation will be November 3 - 6, 2009.

"Many common coding errors can go undetected during a typical development process. Many of these errors are undiagnosed by compilers, even when run at the highest warning levels," says Seacord. "Consequently, it becomes the programmer's responsibility to recognize and avoid these errors."

Seacord is also working with Sun Microsystems, which was recently acquired by Oracle, to create a secure coding standard for Java, which he hopes to release in the summer of 2010.

RELATED ARTICLES Q&A: Software Testing In A Virtualized World Secure Software Needs Careful Testing -- And Lots Of It Securing the Java Core Petascale Tools and Genomic Evolution Legal Compliance: Open Source and Quality Assurance		TOP 5 ARTICLES No Top Articles.