1. Copyright © Coverity, Inc. 2006. All Rights Reserved. This publication, in whole or in part, may not be reproduced, stored in a computerized, or other retrieval system or transmitted in any form, or by any means whatsoever without the prior written permission of Coverity, Inc. Methods of increasing source code security automatically Ben Chelf CTO

2. Coverity Confidential: Do not distribute 10,000 foot view PHP Code C Code Java Code C++ Code SecurityVulnerabilities MAGIC STATIC ANALYSIS BOX dataflow analysis, pointer alias analysis, abstract interpretation, model checking, flow-sensitive, flow- insensitive, context-sensitive, context-insensitive, interprocedural, intraprocedural, solving constraints

3. Coverity Confidential: Do not distribute What to look for? { strcpy(dest, src); strcpy(dest, src);}

4. Coverity Confidential: Do not distribute What to look for? { char src[100]; char src[100]; char dest[50]; char dest[50]; strcpy(dest, src); strcpy(dest, src);}

5. Coverity Confidential: Do not distribute What to look for? { char src[50]; char src[50]; char dest[50]; char dest[50]; strcpy(dest, src); strcpy(dest, src);}

6. Coverity Confidential: Do not distribute What to look for? { char src[50]; char src[50]; char dest[50]; char dest[50]; src[sizeof(dest) – 1] = 0; src[sizeof(dest) – 1] = 0; strcpy(dest, src); strcpy(dest, src);}

7. Coverity Confidential: Do not distribute The Promise of Static Analysis Tools Design ReleaseQA Code Integrate Software Development Process SecurityVulnerabilities BENEFITS Detects problems early in SDLC No test cases required Points to specific LOC Systematic Static Analysis Bugs

8. Coverity Confidential: Do not distribute Research techniques (not exhaustive) Shankar, Talwar, Foster, Wagner (2001)Shankar, Talwar, Foster, Wagner (2001)

9. Coverity Confidential: Do not distribute Research techniques (not exhaustive) Shankar, Talwar, Foster, Wagner (2001)Shankar, Talwar, Foster, Wagner (2001) Ashcraft, Engler (2002)Ashcraft, Engler (2002)

10. Coverity Confidential: Do not distribute Research techniques (not exhaustive) Shankar, Talwar, Foster, Wagner (2001)Shankar, Talwar, Foster, Wagner (2001) Ashcraft, Engler (2002)Ashcraft, Engler (2002) Yang, Kremenek, Xie, Engler (2003)Yang, Kremenek, Xie, Engler (2003)

11. Coverity Confidential: Do not distribute Research techniques (not exhaustive) Shankar, Talwar, Foster, Wagner (2001)Shankar, Talwar, Foster, Wagner (2001) Ashcraft, Engler (2002)Ashcraft, Engler (2002) Yang, Kremenek, Xie, Engler (2003)Yang, Kremenek, Xie, Engler (2003) Huang, Yu, Hang, Tsai, Lee (2004)Huang, Yu, Hang, Tsai, Lee (2004)

12. Coverity Confidential: Do not distribute Research techniques (not exhaustive) Shankar, Talwar, Foster, Wagner (2001)Shankar, Talwar, Foster, Wagner (2001) Ashcraft, Engler (2002)Ashcraft, Engler (2002) Yang, Kremenek, Xie, Engler (2003)Yang, Kremenek, Xie, Engler (2003) Huang, Yu, Hang, Tsai, Lee (2004)Huang, Yu, Hang, Tsai, Lee (2004) Livshits and Lam (2005)Livshits and Lam (2005)

13. Coverity Confidential: Do not distribute Research techniques (not exhaustive) Shankar, Talwar, Foster, Wagner (2001)Shankar, Talwar, Foster, Wagner (2001) Ashcraft, Engler (2002)Ashcraft, Engler (2002) Yang, Kremenek, Xie, Engler (2003)Yang, Kremenek, Xie, Engler (2003) Huang, Yu, Hang, Tsai, Lee (2004)Huang, Yu, Hang, Tsai, Lee (2004) Livshits and Lam (2005)Livshits and Lam (2005) Xie and Aiken (2006)Xie and Aiken (2006)

14. Coverity Confidential: Do not distribute Research techniques (not exhaustive) Shankar, Talwar, Foster, Wagner (2001)Shankar, Talwar, Foster, Wagner (2001) Ashcraft, Engler (2002)Ashcraft, Engler (2002) Yang, Kremenek, Xie, Engler (2003)Yang, Kremenek, Xie, Engler (2003) Huang, Yu, Hang, Tsai, Lee (2004)Huang, Yu, Hang, Tsai, Lee (2004) Livshits and Lam (2005)Livshits and Lam (2005) Xie and Aiken (2006)Xie and Aiken (2006) Jovanovic, Kuregel, Kirda (2006)Jovanovic, Kuregel, Kirda (2006)

15. Coverity Confidential: Do not distribute Research techniques (not exhaustive) Shankar, Talwar, Foster, Wagner (2001)Shankar, Talwar, Foster, Wagner (2001) Ashcraft, Engler (2002)Ashcraft, Engler (2002) Yang, Kremenek, Xie, Engler (2003)Yang, Kremenek, Xie, Engler (2003) Huang, Yu, Hang, Tsai, Lee (2004)Huang, Yu, Hang, Tsai, Lee (2004) Livshits and Lam (2005)Livshits and Lam (2005) Xie and Aiken (2006)Xie and Aiken (2006) Jovanovic, Kuregel, Kirda (2006)Jovanovic, Kuregel, Kirda (2006) …many others…many others

16. Coverity Confidential: Do not distribute Making it work in the real world PHP Code C Code Java Code C++ Code Build Systems Parsing Code Analysis time Configuration for the code Noise versus False Positives What to report Reviewing the results

17. Coverity Confidential: Do not distribute Evil Tetris /* /* * Set times to 0 except for * Set times to 0 except for * high score on each level. * high score on each level. */ for (i = MINLEVEL; */ for (i = MINLEVEL; i < NLEVELS; i < NLEVELS; i++) levelfound[i] = 0; i++) levelfound[i] = 0; for (i = 0, sp = scores; for (i = 0, sp = scores; i < nscores; i < nscores; i++, sp++) { if (levelfound[sp->hs_level]) sp->hs_time = 0; else { sp->hs_time = 1; levelfound[sp->hs_level] = 1; } } i++, sp++) { if (levelfound[sp->hs_level]) sp->hs_time = 0; else { sp->hs_time = 1; levelfound[sp->hs_level] = 1; } }

18. Coverity Confidential: Do not distribute Do you use X? if (getuid() != 0 && if (getuid() != 0 && geteuid == 0) { ErrorF(“only root”); exit(1); } geteuid == 0) { ErrorF(“only root”); exit(1); } Since without the parentheses, the code is simply checking to see if the geteuid function in libc was loaded somewhere other than address 0 (which is pretty much guaranteed to be true), it was reporting it was safe to allow risky options for all users, and thus a security hole was born. - Alan Coopersmith, Sun Developer