programming-for-dummies

Secure Computing 641
start. The idea is that if programmers focus on security when designing a
program, they won’t have to waste time patching up their programs later.
The first type of security involves examining the code of a program to
remove any flaws. The most common type of flaw involves code that works
but can be manipulated to cause an unexpected result. A common example
of this type of problem is a buffer overflow.
A buffer overflow occurs when a program expects data that fits a certain
size, such as accepting up to ten characters for a password. If you feed the
computer data that’s larger than expected, such as a 12-character password,
the program should just ignore these extra 2 characters. However, a computer
might accidentally store these extra two characters in its memory.
Normally such excess data would be harmless, but sometimes this excess
data gets stored in a part of memory that contains other data that the computer
uses, such as a list of tasks the computer will follow next. By flooding
the computer with excess data, a hacker can literally change the computer’s
behavior.
One way to exploit this flaw is to shove excessive data to flood the computer’s
memory and then tack on an extra set of commands for the computer
to follow. This tacked-on command then gets buried in the computer’s
memory, which causes the computer to follow those instructions.
Oftentimes, those instructions tell the computer to weaken its defenses,
such as opening a hole in the firewall to let the hacker into the computer.
To prevent problems, such as buffer overflows, programmers need to sift
through their code and make sure that their code handles unexpected data
correctly rather than just dumping it anywhere in memory. Examining code
can be tedious, so programmers often use special testing tools that can spot
such problems automatically.
Book VII
Chapter 3
Computer Security
Buffer overflow problems are especially common in programs written in C
and C++. That’s why more programmers are flocking to newer languages, like
C# and Java, because these languages prevent buffer overflows, which can
result in more secure and reliable software.
Security by design
Most security patches close common flaws in programs, but just removing
these flaws is like locking a screen door to keep out intruders. A more proactive
solution is to design security into a program from the beginning, which is like
getting rid of a screen door and replacing it with a solid metal door instead.