Oleksii Dykan - Secure Coding guidlines

This was presented at the Swift Usergroup Netherlands. Would you like to speak/present? Visit https://swift.amsterdam for more information.

Oleksii will talk us through the Secure Coding document by Apple. It will include the following topics : buffer overflow/underflows, invalidated inputs, social engineering. He will describe techniques to use and factors to consider to make your code more secure from different types of attack.
Oleksii is an iOS developer from Ukraine who is currently located in Rotterdam. He works for WeAreReasonablePeople where they create all kinds of software and UI prototypes.

Transcript

1. SECURE CODING GUIDE
2. X What is Secure Coding Guide? Secure Coding Guide
3. X Hacker vs Attacker Secure Coding Guide
4. X Types of Vulnerabilities Buffer overflows / underflows Unvalidated input Social Engineering etc. Secure Coding Guide
5. X Buffer overflows / underflows Secure Coding Guide #include <stdio.h> #include <string.h> void doit(void) { char buf[128]; gets(buf); printf("%s\n", buf); } int main(void) { printf("So... The End...\n"); doit(); printf("or... maybe not?\n"); return 0; }
6. X Buffer overflows / underflows Secure Coding Guide #include <stdio.h> #include <string.h> void doit(void) { char buf[128]; gets(buf); printf("%s\n", buf); } int main(void) { printf("So... The End...\n"); doit(); printf("or... maybe not?\n"); return 0; }
7. X Buffer overflows / underflows Secure Coding Guide #include <stdio.h> #include <string.h> void doit(void) { char buf[128]; gets(buf); printf("%s\n", buf); } int main(void) { printf("So... The End...\n"); doit(); printf("or... maybe not?\n"); return 0; }
8. X Buffer overflows / underflows Secure Coding Guide #include <stdio.h> #include <string.h> void doit(void) { char buf[128]; gets(buf); printf("%s\n", buf); } int main(void) { printf("So... The End...\n"); doit(); printf("or... maybe not?\n"); return 0; }
9. X Buffer overflows / underflows Secure Coding Guide #include <stdio.h> #include <string.h> void doit(void) { char buf[128]; gets(buf); printf("%s\n", buf); } int main(void) { printf("So... The End...\n"); doit(); printf("or... maybe not?\n"); return 0; }
10. X Buffer overflows / underflows Secure Coding Guide #include <stdio.h> #include <string.h> void doit(void) { char buf[128]; gets(buf); printf("%s\n", buf); } int main(void) { printf("So... The End...\n"); doit(); printf("or... maybe not?\n"); return 0; }
11. X Buffer overflows / underflows Secure Coding Guide #include <stdio.h> #include <string.h> void doit(void) { char buf[128]; gets(buf); printf("%s\n", buf); } int main(void) { printf("So... The End...\n"); doit(); printf("or... maybe not?\n"); return 0; }
12. X Buffer overflows / underflows Secure Coding Guide #include <stdio.h> #include <string.h> void doit(void) { char buf[128]; gets(buf); printf("%s\n", buf); } int main(void) { printf("So... The End...\n"); doit(); printf("or... maybe not?\n"); return 0; } … buf[0] buf[127] . . . … return address … Buffer overflow
13. X Other types of overflows Heap overflows Integer overflow Pointer arithmetic Secure Coding Guide
14. X How to avoid these overflow? Use functions that check the bounds (i.e. fgets instead of gets) Secure Coding Guide
15. X How to avoid these overflow? Use functions that check the bounds (i.e. fgets instead of gets) Some things are done by OS Secure Coding Guide
16. X How to avoid these overflow? Use functions that check the bounds (i.e. fgets instead of gets) Some things are done by OS DON’T USE C Secure Coding Guide
17. X Unvalidated input Format string vulnerabilities URL commands Code insertion Social engineering Secure Coding Guide
18. X Format string vulnerability Secure Coding Guide Let’s Code!
19. X Social engineering attacks Tricking people into normal security procedures. An example: Phishing Secure Coding Guide
20. X Social engineering attacks myapp://cmd/delete?file=cached data that is slowing down your system.,key_from_my_bitcon_wallet.txt Secure Coding Guide
21. X Social engineering attacks myapp://cmd/delete?file=cached data that is slowing down your system.,key_from_my_bitcon_wallet.txt Secure Coding Guide
22. X Other types of vulnerabilities Insecure file operations Secure Coding Guide
23. X Other types of vulnerabilities Insecure file operations Race conditions Secure Coding Guide
24. X Other types of vulnerabilities Insecure file operations Race conditions Secure Coding Guide
25. X And finally… Secure Coding Guide