Secure Programming with Static Analysis Brian Chess, Ph.D.

Chapter 2 Static Analysis Static analysis is the process of analyzing code without executing There are many static analysis tools for detecting security problems They work for a programmer as spelling checker for writers: Detect certain kinds of problems but not all Running them won't guarantee perfect code

Static Analysis Capabilities and Limitations. Unbiased Checking Examining the code, not the program Early checking – knowledge transfter Examine newly discovered types of defects False positives v.s. false negatives Design defects may not be visible in code  Architectural risk analysis

Solving problems with Static Analysis Type Checking Style Checking Program Understanding Program Verification Property Checking Bug Finding Security Review

Type Checking Done mostly at compilation May produce false possitives and false negatives. Examples: Next 2 slides

Type Checking – False Possitive example

Type Checking – False Negative example

Style Checking These are more superficial than type checks They enforce rules related to naming, white space, deprecated functions, commenting, program structure …etc Such defects affect readability and maintainability of a program but does not cause an error PMD (pmd.sourceforge.net) and Parasoft ( style checker for Java,C.

Style Checking Example

Program Understanding Tools to help dealing with large code Simple Examples:Find, Replace, Rename variables, Splitting code..etc More advanced tools: Insight into how a program works Example: Reverse Engineer the design from implementation. Fujaba ( Fujaba allows moving back and forth between Java nad UML.

Fujaba

Program Verification and Property Checking 'Program verification' is checking code adherance to a set of specifications It is not practical to write complete specifications of all of a program 'Property checking' is checking a partial set of specifications 'Sound tools' are tools that claim to produce no false negatives. However, striving for soundness may result in producing false positives Example:

Property Checking Example

Property Checking False Possitive

Bug Finding It is finding behaviour not intended by the programmer "Bug Idioms" are rules in bug finding tools that come with the tool. FindBugs ( is a bug finder for Javawww.findbugs.org Example: Double Checking Lock

Bug Finding Example

Security Review These have techniques similar to the earlier techniques but focus on security issues They can be thought of as hybrid of property checkers and bug finders Property Checker: Secure Specifications to check Bug Finder: common insecure idioms However, security checking should be seen as part of security review. i.e. The tool would suggest review of security suspected fragments of code The good tools would minimize both false positives and negatives

Security Review Example

Assignment Chose one of the static analysis tools mentioned in this chapter and: Download it and install it Learn what it does and how to use it Present us a demo on it Demos are to be presented on Wednesday July 30, 2008