1. Secure Code Scanners
Cameron Davidson

2. Secure Code Analysis by definition
Scanning an application for security vulnerabilities, which usually involves the source code itself.
Matches will be displayed to the user usually with an explanation of the vulnerability and possibly a solution if one is known
Manual review is time consuming

3. Scanner Variety Pattern Matching Behavior Matching Unit Level
Technology Level
System Level

4. Importance
Features
Deadlines
Risk Acceptance

5. Common Mistakes Hard-code Authentication Input Checks Data Encryption
Layer 8 - The Human Layer

6. UDP Chat Program Standalone Client/Server Base Multi-threaded
Command-line
C++

7. UDP Chat Program Prompts for a username Broadcasts username
Other instances of the program will receive these broadcasts
User picks a username from a list
Chat request is sent
Other user responds to request

8. Flawfinder C/C++ source code scanner Static Scans Command-line
Open Source
Reports finding and sorts by risk level

9. RATS Rough Auditing Tool for Security Similar to Flawfinder
Contains Databases for Perl, PHP, and Python
Performs basic analysis ruling out non-problematic conditions
Suggests possible known remedies

10. Cppcheck Static Analysis Automatic Variable Checking
Array Bounds Checking
Class Checking (unused function, variable initialization, memory duplication)
Deprecated/Superseded Functions

11. Cppcheck Exception Safety Checks Memory Leaks Resource Leaks
Invalid STL Function Use
Stylistic/Performance Errors

12. Scan Results Fixed Size String Buffer
Fear that fixed buffer is too small to hold data
c string equivalent to char[]
Always null terminated
C++ has no bounds checking for arrays
Fill the buffer and continue writing into other memory

13. Scan Results Fixed Size String Buffer Dynamic allocation
Set size is an integer:
Datagram packet body size = 255
+ 1 reserved for terminating null character

14. Scan Results
strcpy
Copies source string to a destination string (buffer)
strcpy(destinationString, sourceString)
No checks in place for the size of the destination buffer

15. Scan Results Strcpy Alternatives Strncpy
Takes third parameter as size of destination buffer
Will fill buffer to the end up to the number of characters of the source string
Disregard the rest
Strlcpy
Similar to Strncpy
Will fill buffer with source string up to 1 less than the size of the destination
Leaving the final slot assigning a null character

16. Scan Results Gethostbyname Socket level API
Read and Send data over the network
Easy conversion between Domain Name and IP
Deprecated function
Does not function well with newer protocols (e.g IPv6)
Attackers can forge DNS results or set results to large values

17. Scan Results Gethostbyname Newer, sleeker function getaddrinfo
Full compatibility with IPv6 and newer protocols
Parameter can specify desired protocol

18. In Conclusion
Network based applications should intentionally be designed with higher security
Use code scanners
Reduce time
Reduce development costs
More refined system
Know that people use your software