Download Taxonomy of Coding Errors: Understanding Common Software Vulnerabilities and more Slides Software Engineering in PDF only on Docsity!

Secure Software Development

Taxonomy of Coding Errors

Application Vulnerabilities

• application vulnerabilities >> # OS vulnerabilities

• Most "popular" applications – change over time
  • prevalence
  • inability to effectively patch
• Current targets: browsers and client-side applications

Application Patching

• Much Slower than Operating System Patching
• Zero-Day Vulnerability: a flaw in software code is discovered and code exploiting the flaw appears before a fix or patch is available - Adobe Acrobat, Reader, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862) - Microsoft Office Web Components ActiveX Control Code Execution Vulnerability (CVE-2009-1136) - Microsoft Active Template Library Header Data Remote Code Execution Vulnerability ( 0015 ) CVE-2008- - Microsoft DirectX DirectShow QuickTime Video Remote Code Execution Vulnerability ( 1537 ) CVE-2009- - Adobe Reader Remote Code Execution Vulnerability (CVE-2009-1493) - Microsoft PowerPoint Remote Code Execution Vulnerability (CVE-2009-0556)

Goal of Taxonomy

• List of common coding mistakes
• Support for software developers to avoid making mistakes
• Useful in automated tools
  • Real time
  • Compile time
• Teaching aid
• NOT an attack taxonomy

Taxonomy of Coding Errors

• Positive approach
• Incomplete and imperfect
• Practical and based on real world experiences
• Focus on large enterprise software

Components

• Phylum: type or particular kind of coding error
• Kingdom: a collection of phyla that share a common theme

Input Validation and Representation

• Caused by meta-characters, alternate encoding, and numeric representations
• Problem: trusting input
• Examples: buffer overflow, cross-site scripting, SQL injection, etc.

API Abuse

• API: contact between a caller and a callee
• Common problem: caller failing to honor its end of contract
• Example: failing to perform expected actions
• Both sides may violate contract

Time and State

• Distributed computation: more than 1 component communicate, share states, uses system resources
• Time requirements for distributed computing
• Interactions between threads, processes, time, and information

Error Handling

• Junk input
• Class of programming contract
• Similar to API abuse
• Very common
• Producing errors or giving out too much information

Encapsulation

• Drawing boundaries between things and setting up barriers between them
• Trust and trust models

Environment

• Machine the software runs on
• Connection to the external context
• Things outside of the code but critical to the security of the software