SlideShare a Scribd company logo

Gimme shelter: Tips on protecting proprietary and open source code

•Download as PPTX, PDF•
•
Rogue Wave Software
Rogue Wave Software

Presented at ESC Minneapolis - September 2016. This presentation aims to train and retain by walking through real examples of the top security defects and open source liability issues for embedded systems today. Based on data from the National Vulnerability Database and recent court decisions, attendees will be exposed to lesser known but vital research on security and licensing to better prepare their teams to combat risks.

Software
1 of 39
1© 2016 Rogue Wave Software, Inc. All Rights Reserved. 1 Gimme shelter: Tips on protecting proprietary and open source code Rod Cope, CTO ESC Minneapolis 2016
2© 2016 Rogue Wave Software, Inc. All Rights Reserved. 2 Rod Cope, CTO Rogue Wave Software Presenter
3© 2016 Rogue Wave Software, Inc. All Rights Reserved. 3 Agenda • Top security defects –Research methodology –Vulnerabilities countdown –Best practices for prevention • Legal considerations • Q&A
4© 2016 Rogue Wave Software, Inc. All Rights Reserved. 4 Top security defects
5© 2016 Rogue Wave Software, Inc. All Rights Reserved. 5 Research methodology
6© 2016 Rogue Wave Software, Inc. All Rights Reserved. 6 National Vulnerability Database MITRE Categorized 8000+ NVD entries from 2015 as embedded or not Filtered to include only those vulnerabilities with an identified CWE Sorted list and added up the numbers Research methodology
7© 2016 Rogue Wave Software, Inc. All Rights Reserved. 7 Vulnerabilities countdown
8© 2016 Rogue Wave Software, Inc. All Rights Reserved. 8 Cryptographic issues CWE-310: Weaknesses related to the use of cryptography Vulnerabilities countdown Numeric errors CWE-189: Improper calculation or conversion of numbers 10 Remediation: provide clear bounds, sanity check all calculated variables, detect overflows, etc. Remediation: review design with crypto expert, validate errors are checked, verify non-standard control flow, etc. 9
9© 2016 Rogue Wave Software, Inc. All Rights Reserved. 9 Number eight: Code injection
10© 2016 Rogue Wave Software, Inc. All Rights Reserved. 10 Code injection CWE-94: Improper control of generation of code • Primarily affects interpreted environments such as PHP, Perl, or Python, so less common in most embedded environments • Can affect black box components containing unexpected interpreters (Type 1 or TrueType fonts, PostScript, PDF, etc.) 3.7%
11© 2016 Rogue Wave Software, Inc. All Rights Reserved. 11 Example: Windows RT CVE-2015-0093 http://technet.microsoft.com/security/bulletin/MS15-021 Adobe Font Driver allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability”
12© 2016 Rogue Wave Software, Inc. All Rights Reserved. 12 Code injection: remediation Identify all black box components and ensure you’re using most recent Identify use of unsafe data as it flows through system (e.g. SQL injection attacks) with tools Carefully clean any externally acquired information before using system, shell, scripting, or SQL Design review Automated static analysis Manual analysis
13© 2016 Rogue Wave Software, Inc. All Rights Reserved. 13 Resource management errors CWE-399: Improper management of system resources Vulnerabilities countdown Code weaknesses CWE-17: Weaknesses introduced during development, including specification, design, and implementation 7 Remediation: use well-identified coding patterns, create consistent API contracts, identify unclean code, etc. Remediation: examine assumptions, add C++ wrappers to prevent misused/dangling resources, use fuzz testing, etc. 6
14© 2016 Rogue Wave Software, Inc. All Rights Reserved. 14 Number five: Improper access control
15© 2016 Rogue Wave Software, Inc. All Rights Reserved. 15 Improper access control CWE-284: Software does not restrict or incorrectly restricts access to a resource from unauthorized actor 7.1% • Improper privilege management • Improper ownership management • Improper authorization • Incorrect user management • Improper authentication • Origin validation error • Improper restriction of communication channel to intended endpoints
16© 2016 Rogue Wave Software, Inc. All Rights Reserved. 16 Example: stunnel (TLS proxy) CVE-2015-3644 https://www.stunnel.org/CVE-2015-3644.html stunnel when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers to bypass authentication
17© 2016 Rogue Wave Software, Inc. All Rights Reserved. 17 stunnel example: fail
18© 2016 Rogue Wave Software, Inc. All Rights Reserved. 18 stunnel example: fix
19© 2016 Rogue Wave Software, Inc. All Rights Reserved. 19 Improper access control: remediation Very carefully manage setting, management, and handling of privileges Architecture and design Compartmentalize system with safe areas that have unambiguous trust boundaries, don’t allow sensitive data to leave trust boundary, exercise caution when interfacing outside of trust boundary Use principle of least privilege to decide when to drop system privileges
20© 2016 Rogue Wave Software, Inc. All Rights Reserved. 20 Information exposure CWE-200: Intentional or unintentional disclosure of information to an actor not explicitly authorized Vulnerabilities countdown Improper input validation CWE-20: Incorrect or missing validation on input that can affect program’s control flow or data flow 4 Remediation: assume all data is malicious, check data on both client and server-side, use same character encodings, etc. Remediation: perform weakness analysis, compartmentalize system, perform fuzz testing, etc. 3 Access control CWE-264: Weaknesses related to the management of permissions, privileges, or other security features Remediation: perform weakness analysis, examine the granting of access controls, etc. 2
21© 2016 Rogue Wave Software, Inc. All Rights Reserved. 21 Number one: Memory buffer problems
22© 2016 Rogue Wave Software, Inc. All Rights Reserved. 22 Memory buffer problems CWE-119: Software can read or write to locations outside of the boundaries of the memory buffer 25.6% • Not checking size of input on copy • Bug allowing writing to arbitrary locations • Out-of-bounds read • Pointers outside expected range • Untrusted pointer dereference • Uninitialized pointers • Expired pointer references • Access of memory beyond buffer end
23© 2016 Rogue Wave Software, Inc. All Rights Reserved. 23 Example: GNU libc CVE-2015-1472 https://sourceware.org/ml/libc-alpha/2015-02/msg00119.html Under certain conditions wscanf can allocate too little memory for the to-be-scanned arguments and overflow the allocated buffer. The implementation now correctly computes the required buffer size when using malloc
24© 2016 Rogue Wave Software, Inc. All Rights Reserved. 24 GNU libc example: fail
25© 2016 Rogue Wave Software, Inc. All Rights Reserved. 25 GNU libc example: fix
26© 2016 Rogue Wave Software, Inc. All Rights Reserved. 26 Memory buffer problems: remediation Use to easily identify most problems of this type Perform fuzz testing Carefully examine all buffer access Automated static code analysis Dynamic code analysis Manual code analysis
27© 2016 Rogue Wave Software, Inc. All Rights Reserved. 27 Best practices for prevention
28© 2016 Rogue Wave Software, Inc. All Rights Reserved. 28 Awareness Awareness of these top ten issues can help with nearly 90% of all vulnerabilities in embedded software 87.5%
29© 2016 Rogue Wave Software, Inc. All Rights Reserved. 29 Top four best practices • Numeric errors • Code injection • Resource management errors • Improper input validation • Information exposure • Access control • Memory buffer problems • Numeric errors • Cryptographic issues • Code injection • Code • Resource management errors • Information exposure • Access control • Memory buffer problems • Numeric errors • Cryptographic issues • Code injection • Code • Resource management errors • Improper input validation •Numeric errors •Resource management errors •Improper access control •Improper input validation •Information exposure •Access control Clean design Methodical process Good tools Careful analysis
30© 2016 Rogue Wave Software, Inc. All Rights Reserved. 30 Legal considerations
31© 2016 Rogue Wave Software, Inc. All Rights Reserved. 31 History of licensing 19911988 2001 2004 2007 2012 BSD & MIT Licenses GPLv2 Apache 2.0 GPLv3 MPL 2.0CPL · Implied License &/or Estoppel · Implied License &/or Estoppel · Patent Disincentive Clause · Express Patent License · Patent Retaliation Clause · Broad Express Patent License · Anti-Tivoization clause · Patent Non-Assert · Patent Disincentive Clause · Express Patent License · Patent Retaliation Clause
32© 2016 Rogue Wave Software, Inc. All Rights Reserved. 32 Example: GPL/GPL license compatibility http://www.gnu.org/licenses/gpl-faq.html#v2v3Compatibility
33© 2016 Rogue Wave Software, Inc. All Rights Reserved. 33 Case study: Welte v. Fantec (Germany) • GPLv2.0 software used in a media player • Fantec : Fantec’s supplier assured them compliance with GPL terms. • Result: Welte was awarded Attorney’s fees and damages. • German Court stated: – “Here, Defendant was not allowed to rely merely on its suppliers’ assurances that the works supplied did not infringe any third-party rights. – In any case, Defendant should have performed its own review of the software, or have someone preform, by hiring knowledgeable third parties, such a review of the software offered and provided by Defendant – even if this would have resulted in additional costs.”
34© 2016 Rogue Wave Software, Inc. All Rights Reserved. 34 Step 1: Have a license policy • You must decide which licenses are acceptable for your company (and potentially your customers). • The policy depends on how you plan to use the software. • GENIVI has the following policy – Red – GPLv3; LGPLv2/3; BSD 4; MPL1.1; Flora – Yellow – GPLv2; LGPL2.1; AFL 3; OSL 3; OpenSSL; Public domain – Green – MPL 2.0; BSD 2/3; MIT/X11; Apache 1.1/2; Artistic 2/1
35© 2016 Rogue Wave Software, Inc. All Rights Reserved. 35 Step 2: Educate developers • Which software/licenses are acceptable and not • Which software licenses need to be discussed • How and who to contact with questions – Point Person • Disclosure of software use to Point Person
36© 2016 Rogue Wave Software, Inc. All Rights Reserved. 36 Step 3: Compliance Apple - iPhone Mercedes-Benz
37© 2016 Rogue Wave Software, Inc. All Rights Reserved. 37 Roadmap to compliance • 1st appreciate open source software’s benefits • 2nd develop an open source software strategy • 3rd know your code: education, Point Person • 4th know the licenses associated with your code • 5th comply or use different software
38© 2016 Rogue Wave Software, Inc. All Rights Reserved. 38 Q & A
39© 2016 Rogue Wave Software, Inc. All Rights Reserved. 39

Recommended

Information security
Information securityInformation security
Information security
Bhushan Gurav
 
Penetration testing reporting and methodology
Penetration testing reporting and methodologyPenetration testing reporting and methodology
Penetration testing reporting and methodology
Rashad Aliyev
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
Bhushan Gurav
 
Develop, Test & Maintain Secure Systems (While Being PCI Compliant)
Develop, Test & Maintain Secure Systems (While Being PCI Compliant)Develop, Test & Maintain Secure Systems (While Being PCI Compliant)
Develop, Test & Maintain Secure Systems (While Being PCI Compliant)
Security Innovation
 
Security Testing Report Hitachi Application Q1 Sep 2015
Security Testing Report Hitachi Application Q1 Sep 2015Security Testing Report Hitachi Application Q1 Sep 2015
Security Testing Report Hitachi Application Q1 Sep 2015
Hitachi Solutions America, Ltd.
 
Introduction to Web Application Penetration Testing
Introduction to Web Application Penetration TestingIntroduction to Web Application Penetration Testing
Introduction to Web Application Penetration Testing
Netsparker
 
Btpsec Sample Penetration Test Report
Btpsec Sample Penetration Test ReportBtpsec Sample Penetration Test Report
Btpsec Sample Penetration Test Report
btpsec
 
Why Johnny Still Can’t Pentest: A Comparative Analysis of Open-source Black-...
Why Johnny Still Can’t Pentest: A Comparative Analysis of Open-source Black-...Why Johnny Still Can’t Pentest: A Comparative Analysis of Open-source Black-...
Why Johnny Still Can’t Pentest: A Comparative Analysis of Open-source Black-...
Rana Khalil
 

Recommended

Information security
Information securityInformation security
Information security
Bhushan Gurav
 
Penetration testing reporting and methodology
Penetration testing reporting and methodologyPenetration testing reporting and methodology
Penetration testing reporting and methodology
Rashad Aliyev
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
Bhushan Gurav
 
Develop, Test & Maintain Secure Systems (While Being PCI Compliant)
Develop, Test & Maintain Secure Systems (While Being PCI Compliant)Develop, Test & Maintain Secure Systems (While Being PCI Compliant)
Develop, Test & Maintain Secure Systems (While Being PCI Compliant)
Security Innovation
 
Security Testing Report Hitachi Application Q1 Sep 2015
Security Testing Report Hitachi Application Q1 Sep 2015Security Testing Report Hitachi Application Q1 Sep 2015
Security Testing Report Hitachi Application Q1 Sep 2015
Hitachi Solutions America, Ltd.
 
Introduction to Web Application Penetration Testing
Introduction to Web Application Penetration TestingIntroduction to Web Application Penetration Testing
Introduction to Web Application Penetration Testing
Netsparker
 
Btpsec Sample Penetration Test Report
Btpsec Sample Penetration Test ReportBtpsec Sample Penetration Test Report
Btpsec Sample Penetration Test Report
btpsec
 
Why Johnny Still Can’t Pentest: A Comparative Analysis of Open-source Black-...
Why Johnny Still Can’t Pentest: A Comparative Analysis of Open-source Black-...Why Johnny Still Can’t Pentest: A Comparative Analysis of Open-source Black-...
Why Johnny Still Can’t Pentest: A Comparative Analysis of Open-source Black-...
Rana Khalil
 
RIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob HolcombRIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob Holcomb
Priyanka Aash
 
Penetration testing in wireless network
Penetration testing in wireless networkPenetration testing in wireless network
Penetration testing in wireless network
Hadi Fadlallah
 
Penetration Testing Services
Penetration Testing ServicesPenetration Testing Services
Penetration Testing Services
Cyber 51 LLC
 
Pen test methodology
Pen test methodologyPen test methodology
Pen test methodology
Cahyo Darujati
 
Ethical Hacking & Penetration Testing
Ethical Hacking & Penetration TestingEthical Hacking & Penetration Testing
Ethical Hacking & Penetration Testing
Won Ju Jub
 
Penetration testing overview
Penetration testing overviewPenetration testing overview
Penetration testing overview
Supriya G
 
Solving the CIO’s Cybersecurity Dilemma
Solving the CIO’s Cybersecurity DilemmaSolving the CIO’s Cybersecurity Dilemma
Solving the CIO’s Cybersecurity Dilemma
John Gilligan
 
NETWORK PENETRATION TESTING
NETWORK PENETRATION TESTINGNETWORK PENETRATION TESTING
NETWORK PENETRATION TESTING
Er Vivek Rana
 
Extending the 20 critical security controls to gap assessments and security m...
Extending the 20 critical security controls to gap assessments and security m...Extending the 20 critical security controls to gap assessments and security m...
Extending the 20 critical security controls to gap assessments and security m...
John M. Willis
 
Web Application Security Testing Tools
Web Application Security Testing ToolsWeb Application Security Testing Tools
Web Application Security Testing Tools
Eric Lai
 
Vulnerability Assessment and Penetration Testing Report
Vulnerability Assessment and Penetration Testing Report Vulnerability Assessment and Penetration Testing Report
Vulnerability Assessment and Penetration Testing Report
Rishabh Upadhyay
 
Security Testing
Security TestingSecurity Testing
Security Testing
Kiran Kumar
 
Penetration Security Testing
Penetration Security TestingPenetration Security Testing
Penetration Security Testing
Sanjulika Rastogi
 
Assessing network security
Assessing network securityAssessing network security
Assessing network security
Abhinit Kumar Sharma
 
The CIS Critical Security Controls the International Standard for Defense
The CIS Critical Security Controls the International Standard for DefenseThe CIS Critical Security Controls the International Standard for Defense
The CIS Critical Security Controls the International Standard for Defense
EnclaveSecurity
 
Web Application Penetration Tests - Reporting
Web Application Penetration Tests - ReportingWeb Application Penetration Tests - Reporting
Web Application Penetration Tests - Reporting
Netsparker
 
Penetration testing
Penetration testingPenetration testing
Penetration testing
Nameen Singh
 
Vulnerability
VulnerabilityVulnerability
Vulnerability
Mohit Dholakiya
 
Scanning web vulnerabilities
Scanning web vulnerabilitiesScanning web vulnerabilities
Scanning web vulnerabilities
Mohit Dholakiya
 
The Security Vulnerability Assessment Process & Best Practices
The Security Vulnerability Assessment Process & Best PracticesThe Security Vulnerability Assessment Process & Best Practices
The Security Vulnerability Assessment Process & Best Practices
Kellep Charles
 
How to achieve security, reliability, and productivity in less time
How to achieve security, reliability, and productivity in less timeHow to achieve security, reliability, and productivity in less time
How to achieve security, reliability, and productivity in less time
Rogue Wave Software
 
Continuous security: Bringing agility to the secure development lifecycle
Continuous security: Bringing agility to the secure development lifecycleContinuous security: Bringing agility to the secure development lifecycle
Continuous security: Bringing agility to the secure development lifecycle
Rogue Wave Software
 

More Related Content

What's hot

Web Application Security Testing Tools
Web Application Security Testing ToolsWeb Application Security Testing Tools
Web Application Security Testing Tools
Eric Lai
 
Penetration Security Testing
Penetration Security TestingPenetration Security Testing
Penetration Security Testing
Sanjulika Rastogi
 
The Security Vulnerability Assessment Process & Best Practices
The Security Vulnerability Assessment Process & Best PracticesThe Security Vulnerability Assessment Process & Best Practices
The Security Vulnerability Assessment Process & Best Practices
Kellep Charles
 

What's hot (20)

RIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob HolcombRIoT (Raiding Internet of Things) by Jacob Holcomb
RIoT (Raiding Internet of Things) by Jacob Holcomb
 
Penetration testing in wireless network
Penetration testing in wireless networkPenetration testing in wireless network
Penetration testing in wireless network
 
Penetration Testing Services
Penetration Testing ServicesPenetration Testing Services
Penetration Testing Services
 
Pen test methodology
Pen test methodologyPen test methodology
Pen test methodology
 
Ethical Hacking & Penetration Testing
Ethical Hacking & Penetration TestingEthical Hacking & Penetration Testing
Ethical Hacking & Penetration Testing
 
Penetration testing overview
Penetration testing overviewPenetration testing overview
Penetration testing overview
 
Solving the CIO’s Cybersecurity Dilemma
Solving the CIO’s Cybersecurity DilemmaSolving the CIO’s Cybersecurity Dilemma
Solving the CIO’s Cybersecurity Dilemma
 
NETWORK PENETRATION TESTING
NETWORK PENETRATION TESTINGNETWORK PENETRATION TESTING
NETWORK PENETRATION TESTING
 
Extending the 20 critical security controls to gap assessments and security m...
Extending the 20 critical security controls to gap assessments and security m...Extending the 20 critical security controls to gap assessments and security m...
Extending the 20 critical security controls to gap assessments and security m...
 
Web Application Security Testing Tools
Web Application Security Testing ToolsWeb Application Security Testing Tools
Web Application Security Testing Tools
 
Vulnerability Assessment and Penetration Testing Report
Vulnerability Assessment and Penetration Testing Report Vulnerability Assessment and Penetration Testing Report
Vulnerability Assessment and Penetration Testing Report
 
Security Testing
Security TestingSecurity Testing
Security Testing
 
Penetration Security Testing
Penetration Security TestingPenetration Security Testing
Penetration Security Testing
 
Assessing network security
Assessing network securityAssessing network security
Assessing network security
 
The CIS Critical Security Controls the International Standard for Defense
The CIS Critical Security Controls the International Standard for DefenseThe CIS Critical Security Controls the International Standard for Defense
The CIS Critical Security Controls the International Standard for Defense
 
Web Application Penetration Tests - Reporting
Web Application Penetration Tests - ReportingWeb Application Penetration Tests - Reporting
Web Application Penetration Tests - Reporting
 
Penetration testing
Penetration testingPenetration testing
Penetration testing
 
Vulnerability
VulnerabilityVulnerability
Vulnerability
 
Scanning web vulnerabilities
Scanning web vulnerabilitiesScanning web vulnerabilities
Scanning web vulnerabilities
 
The Security Vulnerability Assessment Process & Best Practices
The Security Vulnerability Assessment Process & Best PracticesThe Security Vulnerability Assessment Process & Best Practices
The Security Vulnerability Assessment Process & Best Practices
 

Viewers also liked

Continuous security: Bringing agility to the secure development lifecycle
Continuous security: Bringing agility to the secure development lifecycleContinuous security: Bringing agility to the secure development lifecycle
Continuous security: Bringing agility to the secure development lifecycle
Rogue Wave Software
 
Verification at scale: Fitting static code analysis into continuous integration
Verification at scale: Fitting static code analysis into continuous integrationVerification at scale: Fitting static code analysis into continuous integration
Verification at scale: Fitting static code analysis into continuous integration
Rogue Wave Software
 
Rapid software testing and conformance with static code analysis
Rapid software testing and conformance with static code analysisRapid software testing and conformance with static code analysis
Rapid software testing and conformance with static code analysis
Rogue Wave Software
 
Lucene for Solr Developers
Lucene for Solr DevelopersLucene for Solr Developers
Lucene for Solr Developers
Erik Hatcher
 
Сергей Моренец: "Gradle. Write once, build everywhere"
Сергей Моренец: "Gradle. Write once, build everywhere"Сергей Моренец: "Gradle. Write once, build everywhere"
Сергей Моренец: "Gradle. Write once, build everywhere"
Provectus
 
Call me maybe: Jepsen and flaky networks
Call me maybe: Jepsen and flaky networksCall me maybe: Jepsen and flaky networks
Call me maybe: Jepsen and flaky networks
Shalin Shekhar Mangar
 

Viewers also liked (20)

How to achieve security, reliability, and productivity in less time
How to achieve security, reliability, and productivity in less timeHow to achieve security, reliability, and productivity in less time
How to achieve security, reliability, and productivity in less time
 
Continuous security: Bringing agility to the secure development lifecycle
Continuous security: Bringing agility to the secure development lifecycleContinuous security: Bringing agility to the secure development lifecycle
Continuous security: Bringing agility to the secure development lifecycle
 
Easy offline-first mobile and desktop web apps with PouchDB
Easy offline-first mobile and desktop web apps with PouchDBEasy offline-first mobile and desktop web apps with PouchDB
Easy offline-first mobile and desktop web apps with PouchDB
 
Legal and Practical Concerns with Software Development
Legal and Practical Concerns with Software DevelopmentLegal and Practical Concerns with Software Development
Legal and Practical Concerns with Software Development
 
Open source software support for the enterprise
Open source software support for the enterpriseOpen source software support for the enterprise
Open source software support for the enterprise
 
Test parallelization using Jenkins
Test parallelization using JenkinsTest parallelization using Jenkins
Test parallelization using Jenkins
 
Verification at scale: Fitting static code analysis into continuous integration
Verification at scale: Fitting static code analysis into continuous integrationVerification at scale: Fitting static code analysis into continuous integration
Verification at scale: Fitting static code analysis into continuous integration
 
Static analysis works for mission-critical systems, why not yours?
Static analysis works for mission-critical systems, why not yours? Static analysis works for mission-critical systems, why not yours?
Static analysis works for mission-critical systems, why not yours?
 
Rapid software testing and conformance with static code analysis
Rapid software testing and conformance with static code analysisRapid software testing and conformance with static code analysis
Rapid software testing and conformance with static code analysis
 
What if you could eliminate the hidden costs of development?
What if you could eliminate the hidden costs of development?What if you could eliminate the hidden costs of development?
What if you could eliminate the hidden costs of development?
 
Lucene for Solr Developers
Lucene for Solr DevelopersLucene for Solr Developers
Lucene for Solr Developers
 
Apache Solr Changes the Way You Build Sites
Apache Solr Changes the Way You Build SitesApache Solr Changes the Way You Build Sites
Apache Solr Changes the Way You Build Sites
 
Solr Performance Monitoring with SPM
Solr Performance Monitoring with SPMSolr Performance Monitoring with SPM
Solr Performance Monitoring with SPM
 
Hackathon
HackathonHackathon
Hackathon
 
Сергей Моренец: "Gradle. Write once, build everywhere"
Сергей Моренец: "Gradle. Write once, build everywhere"Сергей Моренец: "Gradle. Write once, build everywhere"
Сергей Моренец: "Gradle. Write once, build everywhere"
 
Call me maybe: Jepsen and flaky networks
Call me maybe: Jepsen and flaky networksCall me maybe: Jepsen and flaky networks
Call me maybe: Jepsen and flaky networks
 
Lucene's Latest (for Libraries)
Lucene's Latest (for Libraries)Lucene's Latest (for Libraries)
Lucene's Latest (for Libraries)
 
Why I want to Kazan
Why I want to KazanWhy I want to Kazan
Why I want to Kazan
 
What's New in Apache Solr 4.10
What's New in Apache Solr 4.10What's New in Apache Solr 4.10
What's New in Apache Solr 4.10
 
Meet Solr For The Tirst Again
Meet Solr For The Tirst AgainMeet Solr For The Tirst Again
Meet Solr For The Tirst Again
 

Similar to Gimme shelter: Tips on protecting proprietary and open source code

Shifting the conversation from active interception to proactive neutralization
Shifting the conversation from active interception to proactive neutralization Shifting the conversation from active interception to proactive neutralization
Shifting the conversation from active interception to proactive neutralization
Rogue Wave Software
 
The road towards better automotive cybersecurity
The road towards better automotive cybersecurityThe road towards better automotive cybersecurity
The road towards better automotive cybersecurity
Rogue Wave Software
 
Find & fix the flaws in your code
Find & fix the flaws in your codeFind & fix the flaws in your code
Find & fix the flaws in your code
Rogue Wave Software
 
Reacting to Advanced, Unknown Attacks in Real-Time with Lastline
Reacting to Advanced, Unknown Attacks in Real-Time with LastlineReacting to Advanced, Unknown Attacks in Real-Time with Lastline
Reacting to Advanced, Unknown Attacks in Real-Time with Lastline
Lastline, Inc.
 
Vulnerabilities are bugs, Let's Test For Them!
Vulnerabilities are bugs, Let's Test For Them!Vulnerabilities are bugs, Let's Test For Them!
Vulnerabilities are bugs, Let's Test For Them!
VAddy
 
Five ways to protect your software supply chain from hacks, quacks, and wrecks
Five ways to protect your software supply chain from hacks, quacks, and wrecksFive ways to protect your software supply chain from hacks, quacks, and wrecks
Five ways to protect your software supply chain from hacks, quacks, and wrecks
Rogue Wave Software
 

Similar to Gimme shelter: Tips on protecting proprietary and open source code (20)

Shifting the conversation from active interception to proactive neutralization
Shifting the conversation from active interception to proactive neutralization Shifting the conversation from active interception to proactive neutralization
Shifting the conversation from active interception to proactive neutralization
 
The road towards better automotive cybersecurity
The road towards better automotive cybersecurityThe road towards better automotive cybersecurity
The road towards better automotive cybersecurity
 
Primer: The top ten automotive cybersecurity vulnerabilities of 2015
Primer: The top ten automotive cybersecurity vulnerabilities of 2015Primer: The top ten automotive cybersecurity vulnerabilities of 2015
Primer: The top ten automotive cybersecurity vulnerabilities of 2015
 
How enterprises learned to stop worrying and love open source
How enterprises learned to stop worrying and love open sourceHow enterprises learned to stop worrying and love open source
How enterprises learned to stop worrying and love open source
 
Create code confidence for better application security
Create code confidence for better application security Create code confidence for better application security
Create code confidence for better application security
 
Find & fix the flaws in your code
Find & fix the flaws in your codeFind & fix the flaws in your code
Find & fix the flaws in your code
 
Cyber security - It starts with the embedded system
Cyber security - It starts with the embedded systemCyber security - It starts with the embedded system
Cyber security - It starts with the embedded system
 
Reacting to Advanced, Unknown Attacks in Real-Time with Lastline
Reacting to Advanced, Unknown Attacks in Real-Time with LastlineReacting to Advanced, Unknown Attacks in Real-Time with Lastline
Reacting to Advanced, Unknown Attacks in Real-Time with Lastline
 
Q1 2016 Open Source Security Report: Glibc and Beyond
Q1 2016 Open Source Security Report: Glibc and BeyondQ1 2016 Open Source Security Report: Glibc and Beyond
Q1 2016 Open Source Security Report: Glibc and Beyond
 
Vulnerabilities are bugs, Let's Test For Them!
Vulnerabilities are bugs, Let's Test For Them!Vulnerabilities are bugs, Let's Test For Them!
Vulnerabilities are bugs, Let's Test For Them!
 
Using Analyzers to Resolve Security Problems
Using Analyzers to Resolve Security ProblemsUsing Analyzers to Resolve Security Problems
Using Analyzers to Resolve Security Problems
 
Vulnerabilities are bugs, Let's test for them!
Vulnerabilities are bugs, Let's test for them!Vulnerabilities are bugs, Let's test for them!
Vulnerabilities are bugs, Let's test for them!
 
Types of Vulnerability Scanning An in depth investigation.pdf
Types of Vulnerability Scanning An in depth investigation.pdfTypes of Vulnerability Scanning An in depth investigation.pdf
Types of Vulnerability Scanning An in depth investigation.pdf
 
Manoj Purandare - Application Security - Secure Code Assessment Program - Pre...
Manoj Purandare - Application Security - Secure Code Assessment Program - Pre...Manoj Purandare - Application Security - Secure Code Assessment Program - Pre...
Manoj Purandare - Application Security - Secure Code Assessment Program - Pre...
 
Manoj Purandare - Application Security - Secure Code Assessment Program - Pre...
Manoj Purandare - Application Security - Secure Code Assessment Program - Pre...Manoj Purandare - Application Security - Secure Code Assessment Program - Pre...
Manoj Purandare - Application Security - Secure Code Assessment Program - Pre...
 
Manoj Purandare - Application Security - Secure Code Assessment Program - Pre...
Manoj Purandare - Application Security - Secure Code Assessment Program - Pre...Manoj Purandare - Application Security - Secure Code Assessment Program - Pre...
Manoj Purandare - Application Security - Secure Code Assessment Program - Pre...
 
When is free not free: The true costs of open source
When is free not free: The true costs of open sourceWhen is free not free: The true costs of open source
When is free not free: The true costs of open source
 
Five ways to protect your software supply chain from hacks, quacks, and wrecks
Five ways to protect your software supply chain from hacks, quacks, and wrecksFive ways to protect your software supply chain from hacks, quacks, and wrecks
Five ways to protect your software supply chain from hacks, quacks, and wrecks
 
Create code confidence for better application security
Create code confidence for better application securityCreate code confidence for better application security
Create code confidence for better application security
 
IT6701-Information Management Unit 2
IT6701-Information Management Unit 2IT6701-Information Management Unit 2
IT6701-Information Management Unit 2
 

More from Rogue Wave Software

Leveraging open banking specifications for rigorous API security – What’s in...
Leveraging open banking specifications for rigorous API security – What’s in...Leveraging open banking specifications for rigorous API security – What’s in...
Leveraging open banking specifications for rigorous API security – What’s in...
Rogue Wave Software
 
Getting the most from your API management platform: A case study
Getting the most from your API management platform: A case studyGetting the most from your API management platform: A case study
Getting the most from your API management platform: A case study
Rogue Wave Software
 
Advanced technologies and techniques for debugging HPC applications
Advanced technologies and techniques for debugging HPC applicationsAdvanced technologies and techniques for debugging HPC applications
Advanced technologies and techniques for debugging HPC applications
Rogue Wave Software
 
Three big mistakes with APIs and microservices
Three big mistakes with APIs and microservices Three big mistakes with APIs and microservices
Three big mistakes with APIs and microservices
Rogue Wave Software
 
Open source applied - Real world use cases (Presented at Open Source 101)
Open source applied - Real world use cases (Presented at Open Source 101)Open source applied - Real world use cases (Presented at Open Source 101)
Open source applied - Real world use cases (Presented at Open Source 101)
Rogue Wave Software
 
How to migrate SourcePro apps from Solaris to Linux
How to migrate SourcePro apps from Solaris to LinuxHow to migrate SourcePro apps from Solaris to Linux
How to migrate SourcePro apps from Solaris to Linux
Rogue Wave Software
 
Approaches to debugging mixed-language HPC apps
Approaches to debugging mixed-language HPC appsApproaches to debugging mixed-language HPC apps
Approaches to debugging mixed-language HPC apps
Rogue Wave Software
 

More from Rogue Wave Software (20)

The Global Influence of Open Banking, API Security, and an Open Data Perspective
The Global Influence of Open Banking, API Security, and an Open Data PerspectiveThe Global Influence of Open Banking, API Security, and an Open Data Perspective
The Global Influence of Open Banking, API Security, and an Open Data Perspective
 
No liftoff, touchdown, or heartbeat shall miss because of a software failure
No liftoff, touchdown, or heartbeat shall miss because of a software failureNo liftoff, touchdown, or heartbeat shall miss because of a software failure
No liftoff, touchdown, or heartbeat shall miss because of a software failure
 
Disrupt or be disrupted – Using secure APIs to drive digital transformation
Disrupt or be disrupted – Using secure APIs to drive digital transformationDisrupt or be disrupted – Using secure APIs to drive digital transformation
Disrupt or be disrupted – Using secure APIs to drive digital transformation
 
Leveraging open banking specifications for rigorous API security – What’s in...
Leveraging open banking specifications for rigorous API security – What’s in...Leveraging open banking specifications for rigorous API security – What’s in...
Leveraging open banking specifications for rigorous API security – What’s in...
 
Adding layers of security to an API in real-time
Adding layers of security to an API in real-timeAdding layers of security to an API in real-time
Adding layers of security to an API in real-time
 
Getting the most from your API management platform: A case study
Getting the most from your API management platform: A case studyGetting the most from your API management platform: A case study
Getting the most from your API management platform: A case study
 
Advanced technologies and techniques for debugging HPC applications
Advanced technologies and techniques for debugging HPC applicationsAdvanced technologies and techniques for debugging HPC applications
Advanced technologies and techniques for debugging HPC applications
 
The forgotten route: Making Apache Camel work for you
The forgotten route: Making Apache Camel work for youThe forgotten route: Making Apache Camel work for you
The forgotten route: Making Apache Camel work for you
 
Are open source and embedded software development on a collision course?
Are open source and embedded software development on a collision course?Are open source and embedded software development on a collision course?
Are open source and embedded software development on a collision course?
 
Three big mistakes with APIs and microservices
Three big mistakes with APIs and microservices Three big mistakes with APIs and microservices
Three big mistakes with APIs and microservices
 
5 strategies for enterprise cloud infrastructure success
5 strategies for enterprise cloud infrastructure success5 strategies for enterprise cloud infrastructure success
5 strategies for enterprise cloud infrastructure success
 
PSD2 & Open Banking: How to go from standards to implementation and compliance
PSD2 & Open Banking: How to go from standards to implementation and compliancePSD2 & Open Banking: How to go from standards to implementation and compliance
PSD2 & Open Banking: How to go from standards to implementation and compliance
 
Java 10 and beyond: Keeping up with the language and planning for the future
Java 10 and beyond: Keeping up with the language and planning for the futureJava 10 and beyond: Keeping up with the language and planning for the future
Java 10 and beyond: Keeping up with the language and planning for the future
 
How to keep developers happy and lawyers calm (Presented at ESC Boston)
How to keep developers happy and lawyers calm (Presented at ESC Boston)How to keep developers happy and lawyers calm (Presented at ESC Boston)
How to keep developers happy and lawyers calm (Presented at ESC Boston)
 
Open source applied - Real world use cases (Presented at Open Source 101)
Open source applied - Real world use cases (Presented at Open Source 101)Open source applied - Real world use cases (Presented at Open Source 101)
Open source applied - Real world use cases (Presented at Open Source 101)
 
How to migrate SourcePro apps from Solaris to Linux
How to migrate SourcePro apps from Solaris to LinuxHow to migrate SourcePro apps from Solaris to Linux
How to migrate SourcePro apps from Solaris to Linux
 
Approaches to debugging mixed-language HPC apps
Approaches to debugging mixed-language HPC appsApproaches to debugging mixed-language HPC apps
Approaches to debugging mixed-language HPC apps
 
Enterprise Linux: Justify your migration from Red Hat to CentOS
Enterprise Linux: Justify your migration from Red Hat to CentOSEnterprise Linux: Justify your migration from Red Hat to CentOS
Enterprise Linux: Justify your migration from Red Hat to CentOS
 
Walk through an enterprise Linux migration
Walk through an enterprise Linux migrationWalk through an enterprise Linux migration
Walk through an enterprise Linux migration
 
How to keep developers happy and lawyers calm
How to keep developers happy and lawyers calmHow to keep developers happy and lawyers calm
How to keep developers happy and lawyers calm
 

Recently uploaded

%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
masabamasaba
 
AI & Machine Learning Presentation Template
AI & Machine Learning Presentation TemplateAI & Machine Learning Presentation Template
AI & Machine Learning Presentation Template
Presentation.STUDIO
 
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
Health
 
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
masabamasaba
 
Architecture decision records - How not to get lost in the past
Architecture decision records - How not to get lost in the pastArchitecture decision records - How not to get lost in the past
Architecture decision records - How not to get lost in the past
Papp Krisztián
 
%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...
%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...
%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...
masabamasaba
 

Recently uploaded (20)

Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...
Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...
Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...
 
%in kempton park+277-882-255-28 abortion pills for sale in kempton park
%in kempton park+277-882-255-28 abortion pills for sale in kempton park %in kempton park+277-882-255-28 abortion pills for sale in kempton park
%in kempton park+277-882-255-28 abortion pills for sale in kempton park
 
%in Midrand+277-882-255-28 abortion pills for sale in midrand
%in Midrand+277-882-255-28 abortion pills for sale in midrand%in Midrand+277-882-255-28 abortion pills for sale in midrand
%in Midrand+277-882-255-28 abortion pills for sale in midrand
 
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
 
AI & Machine Learning Presentation Template
AI & Machine Learning Presentation TemplateAI & Machine Learning Presentation Template
AI & Machine Learning Presentation Template
 
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
 
%in Rustenburg+277-882-255-28 abortion pills for sale in Rustenburg
%in Rustenburg+277-882-255-28 abortion pills for sale in Rustenburg%in Rustenburg+277-882-255-28 abortion pills for sale in Rustenburg
%in Rustenburg+277-882-255-28 abortion pills for sale in Rustenburg
 
WSO2CON 2024 - Freedom First—Unleashing Developer Potential with Open Source
WSO2CON 2024 - Freedom First—Unleashing Developer Potential with Open SourceWSO2CON 2024 - Freedom First—Unleashing Developer Potential with Open Source
WSO2CON 2024 - Freedom First—Unleashing Developer Potential with Open Source
 
Artyushina_Guest lecture_YorkU CS May 2024.pptx
Artyushina_Guest lecture_YorkU CS May 2024.pptxArtyushina_Guest lecture_YorkU CS May 2024.pptx
Artyushina_Guest lecture_YorkU CS May 2024.pptx
 
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
 
Architecture decision records - How not to get lost in the past
Architecture decision records - How not to get lost in the pastArchitecture decision records - How not to get lost in the past
Architecture decision records - How not to get lost in the past
 
Direct Style Effect Systems - The Print[A] Example - A Comprehension Aid
Direct Style Effect Systems - The Print[A] Example - A Comprehension AidDirect Style Effect Systems - The Print[A] Example - A Comprehension Aid
Direct Style Effect Systems - The Print[A] Example - A Comprehension Aid
 
WSO2CON2024 - It's time to go Platformless
WSO2CON2024 - It's time to go PlatformlessWSO2CON2024 - It's time to go Platformless
WSO2CON2024 - It's time to go Platformless
 
%in Stilfontein+277-882-255-28 abortion pills for sale in Stilfontein
%in Stilfontein+277-882-255-28 abortion pills for sale in Stilfontein%in Stilfontein+277-882-255-28 abortion pills for sale in Stilfontein
%in Stilfontein+277-882-255-28 abortion pills for sale in Stilfontein
 
%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...
%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...
%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...
 
%in tembisa+277-882-255-28 abortion pills for sale in tembisa
%in tembisa+277-882-255-28 abortion pills for sale in tembisa%in tembisa+277-882-255-28 abortion pills for sale in tembisa
%in tembisa+277-882-255-28 abortion pills for sale in tembisa
 
WSO2CON 2024 Slides - Open Source to SaaS
WSO2CON 2024 Slides - Open Source to SaaSWSO2CON 2024 Slides - Open Source to SaaS
WSO2CON 2024 Slides - Open Source to SaaS
 
WSO2CON 2024 - API Management Usage at La Poste and Its Impact on Business an...
WSO2CON 2024 - API Management Usage at La Poste and Its Impact on Business an...WSO2CON 2024 - API Management Usage at La Poste and Its Impact on Business an...
WSO2CON 2024 - API Management Usage at La Poste and Its Impact on Business an...
 
WSO2CON 2024 - How to Run a Security Program
WSO2CON 2024 - How to Run a Security ProgramWSO2CON 2024 - How to Run a Security Program
WSO2CON 2024 - How to Run a Security Program
 
WSO2Con2024 - Enabling Transactional System's Exponential Growth With Simplicity
WSO2Con2024 - Enabling Transactional System's Exponential Growth With SimplicityWSO2Con2024 - Enabling Transactional System's Exponential Growth With Simplicity
WSO2Con2024 - Enabling Transactional System's Exponential Growth With Simplicity
 

Gimme shelter: Tips on protecting proprietary and open source code

  • 1. 1© 2016 Rogue Wave Software, Inc. All Rights Reserved. 1 Gimme shelter: Tips on protecting proprietary and open source code Rod Cope, CTO ESC Minneapolis 2016
  • 2. 2© 2016 Rogue Wave Software, Inc. All Rights Reserved. 2 Rod Cope, CTO Rogue Wave Software Presenter
  • 3. 3© 2016 Rogue Wave Software, Inc. All Rights Reserved. 3 Agenda • Top security defects –Research methodology –Vulnerabilities countdown –Best practices for prevention • Legal considerations • Q&A
  • 4. 4© 2016 Rogue Wave Software, Inc. All Rights Reserved. 4 Top security defects
  • 5. 5© 2016 Rogue Wave Software, Inc. All Rights Reserved. 5 Research methodology
  • 6. 6© 2016 Rogue Wave Software, Inc. All Rights Reserved. 6 National Vulnerability Database MITRE Categorized 8000+ NVD entries from 2015 as embedded or not Filtered to include only those vulnerabilities with an identified CWE Sorted list and added up the numbers Research methodology
  • 7. 7© 2016 Rogue Wave Software, Inc. All Rights Reserved. 7 Vulnerabilities countdown
  • 8. 8© 2016 Rogue Wave Software, Inc. All Rights Reserved. 8 Cryptographic issues CWE-310: Weaknesses related to the use of cryptography Vulnerabilities countdown Numeric errors CWE-189: Improper calculation or conversion of numbers 10 Remediation: provide clear bounds, sanity check all calculated variables, detect overflows, etc. Remediation: review design with crypto expert, validate errors are checked, verify non-standard control flow, etc. 9
  • 9. 9© 2016 Rogue Wave Software, Inc. All Rights Reserved. 9 Number eight: Code injection
  • 10. 10© 2016 Rogue Wave Software, Inc. All Rights Reserved. 10 Code injection CWE-94: Improper control of generation of code • Primarily affects interpreted environments such as PHP, Perl, or Python, so less common in most embedded environments • Can affect black box components containing unexpected interpreters (Type 1 or TrueType fonts, PostScript, PDF, etc.) 3.7%
  • 11. 11© 2016 Rogue Wave Software, Inc. All Rights Reserved. 11 Example: Windows RT CVE-2015-0093 http://technet.microsoft.com/security/bulletin/MS15-021 Adobe Font Driver allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability”
  • 12. 12© 2016 Rogue Wave Software, Inc. All Rights Reserved. 12 Code injection: remediation Identify all black box components and ensure you’re using most recent Identify use of unsafe data as it flows through system (e.g. SQL injection attacks) with tools Carefully clean any externally acquired information before using system, shell, scripting, or SQL Design review Automated static analysis Manual analysis
  • 13. 13© 2016 Rogue Wave Software, Inc. All Rights Reserved. 13 Resource management errors CWE-399: Improper management of system resources Vulnerabilities countdown Code weaknesses CWE-17: Weaknesses introduced during development, including specification, design, and implementation 7 Remediation: use well-identified coding patterns, create consistent API contracts, identify unclean code, etc. Remediation: examine assumptions, add C++ wrappers to prevent misused/dangling resources, use fuzz testing, etc. 6
  • 14. 14© 2016 Rogue Wave Software, Inc. All Rights Reserved. 14 Number five: Improper access control
  • 15. 15© 2016 Rogue Wave Software, Inc. All Rights Reserved. 15 Improper access control CWE-284: Software does not restrict or incorrectly restricts access to a resource from unauthorized actor 7.1% • Improper privilege management • Improper ownership management • Improper authorization • Incorrect user management • Improper authentication • Origin validation error • Improper restriction of communication channel to intended endpoints
  • 16. 16© 2016 Rogue Wave Software, Inc. All Rights Reserved. 16 Example: stunnel (TLS proxy) CVE-2015-3644 https://www.stunnel.org/CVE-2015-3644.html stunnel when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers to bypass authentication
  • 17. 17© 2016 Rogue Wave Software, Inc. All Rights Reserved. 17 stunnel example: fail
  • 18. 18© 2016 Rogue Wave Software, Inc. All Rights Reserved. 18 stunnel example: fix
  • 19. 19© 2016 Rogue Wave Software, Inc. All Rights Reserved. 19 Improper access control: remediation Very carefully manage setting, management, and handling of privileges Architecture and design Compartmentalize system with safe areas that have unambiguous trust boundaries, don’t allow sensitive data to leave trust boundary, exercise caution when interfacing outside of trust boundary Use principle of least privilege to decide when to drop system privileges
  • 20. 20© 2016 Rogue Wave Software, Inc. All Rights Reserved. 20 Information exposure CWE-200: Intentional or unintentional disclosure of information to an actor not explicitly authorized Vulnerabilities countdown Improper input validation CWE-20: Incorrect or missing validation on input that can affect program’s control flow or data flow 4 Remediation: assume all data is malicious, check data on both client and server-side, use same character encodings, etc. Remediation: perform weakness analysis, compartmentalize system, perform fuzz testing, etc. 3 Access control CWE-264: Weaknesses related to the management of permissions, privileges, or other security features Remediation: perform weakness analysis, examine the granting of access controls, etc. 2
  • 21. 21© 2016 Rogue Wave Software, Inc. All Rights Reserved. 21 Number one: Memory buffer problems
  • 22. 22© 2016 Rogue Wave Software, Inc. All Rights Reserved. 22 Memory buffer problems CWE-119: Software can read or write to locations outside of the boundaries of the memory buffer 25.6% • Not checking size of input on copy • Bug allowing writing to arbitrary locations • Out-of-bounds read • Pointers outside expected range • Untrusted pointer dereference • Uninitialized pointers • Expired pointer references • Access of memory beyond buffer end
  • 23. 23© 2016 Rogue Wave Software, Inc. All Rights Reserved. 23 Example: GNU libc CVE-2015-1472 https://sourceware.org/ml/libc-alpha/2015-02/msg00119.html Under certain conditions wscanf can allocate too little memory for the to-be-scanned arguments and overflow the allocated buffer. The implementation now correctly computes the required buffer size when using malloc
  • 24. 24© 2016 Rogue Wave Software, Inc. All Rights Reserved. 24 GNU libc example: fail
  • 25. 25© 2016 Rogue Wave Software, Inc. All Rights Reserved. 25 GNU libc example: fix
  • 26. 26© 2016 Rogue Wave Software, Inc. All Rights Reserved. 26 Memory buffer problems: remediation Use to easily identify most problems of this type Perform fuzz testing Carefully examine all buffer access Automated static code analysis Dynamic code analysis Manual code analysis
  • 27. 27© 2016 Rogue Wave Software, Inc. All Rights Reserved. 27 Best practices for prevention
  • 28. 28© 2016 Rogue Wave Software, Inc. All Rights Reserved. 28 Awareness Awareness of these top ten issues can help with nearly 90% of all vulnerabilities in embedded software 87.5%
  • 29. 29© 2016 Rogue Wave Software, Inc. All Rights Reserved. 29 Top four best practices • Numeric errors • Code injection • Resource management errors • Improper input validation • Information exposure • Access control • Memory buffer problems • Numeric errors • Cryptographic issues • Code injection • Code • Resource management errors • Information exposure • Access control • Memory buffer problems • Numeric errors • Cryptographic issues • Code injection • Code • Resource management errors • Improper input validation •Numeric errors •Resource management errors •Improper access control •Improper input validation •Information exposure •Access control Clean design Methodical process Good tools Careful analysis
  • 30. 30© 2016 Rogue Wave Software, Inc. All Rights Reserved. 30 Legal considerations
  • 31. 31© 2016 Rogue Wave Software, Inc. All Rights Reserved. 31 History of licensing 19911988 2001 2004 2007 2012 BSD & MIT Licenses GPLv2 Apache 2.0 GPLv3 MPL 2.0CPL · Implied License &/or Estoppel · Implied License &/or Estoppel · Patent Disincentive Clause · Express Patent License · Patent Retaliation Clause · Broad Express Patent License · Anti-Tivoization clause · Patent Non-Assert · Patent Disincentive Clause · Express Patent License · Patent Retaliation Clause
  • 32. 32© 2016 Rogue Wave Software, Inc. All Rights Reserved. 32 Example: GPL/GPL license compatibility http://www.gnu.org/licenses/gpl-faq.html#v2v3Compatibility
  • 33. 33© 2016 Rogue Wave Software, Inc. All Rights Reserved. 33 Case study: Welte v. Fantec (Germany) • GPLv2.0 software used in a media player • Fantec : Fantec’s supplier assured them compliance with GPL terms. • Result: Welte was awarded Attorney’s fees and damages. • German Court stated: – “Here, Defendant was not allowed to rely merely on its suppliers’ assurances that the works supplied did not infringe any third-party rights. – In any case, Defendant should have performed its own review of the software, or have someone preform, by hiring knowledgeable third parties, such a review of the software offered and provided by Defendant – even if this would have resulted in additional costs.”
  • 34. 34© 2016 Rogue Wave Software, Inc. All Rights Reserved. 34 Step 1: Have a license policy • You must decide which licenses are acceptable for your company (and potentially your customers). • The policy depends on how you plan to use the software. • GENIVI has the following policy – Red – GPLv3; LGPLv2/3; BSD 4; MPL1.1; Flora – Yellow – GPLv2; LGPL2.1; AFL 3; OSL 3; OpenSSL; Public domain – Green – MPL 2.0; BSD 2/3; MIT/X11; Apache 1.1/2; Artistic 2/1
  • 35. 35© 2016 Rogue Wave Software, Inc. All Rights Reserved. 35 Step 2: Educate developers • Which software/licenses are acceptable and not • Which software licenses need to be discussed • How and who to contact with questions – Point Person • Disclosure of software use to Point Person
  • 36. 36© 2016 Rogue Wave Software, Inc. All Rights Reserved. 36 Step 3: Compliance Apple - iPhone Mercedes-Benz
  • 37. 37© 2016 Rogue Wave Software, Inc. All Rights Reserved. 37 Roadmap to compliance • 1st appreciate open source software’s benefits • 2nd develop an open source software strategy • 3rd know your code: education, Point Person • 4th know the licenses associated with your code • 5th comply or use different software
  • 38. 38© 2016 Rogue Wave Software, Inc. All Rights Reserved. 38 Q & A
  • 39. 39© 2016 Rogue Wave Software, Inc. All Rights Reserved. 39