Secure coding in C and C++ masterclass ARM (SCICAC++MCARM)

Day 1

• Cyber security basics
  • What is security?
  • Threat and risk
  • Cyber security threat types – the CIA triad
  • Cyber security threat types – the STRIDE model
  • Consequences of insecure software
• Memory management vulnerabilities
  • Assembly basics and calling conventions
  • Buffer overflow
  • Best practices and some typical mistakes

Day 2

• Memory management vulnerabilities
  • Unterminated strings
  • readlink() and string termination
  • Manipulating C-style strings in C++
  • Malicious string termination
  • Lab – String termination confusion
  • String length calculation mistakes
  • Off-by-one errors
  • Allocating nothing
  • Testing for typical mistakes
• Memory management hardening
  • Securing the toolchain
  • Runtime protections
• Common software security weaknesses
  • Code quality
  • Memory and pointers
  • Pointer usage in C and C++
  • Use after free
  • Lab – Use after free
  • Lab – Runtime instrumentation
  • Double free
  • Smart pointers
  • Testing for memory and pointer issues

Day 3

• Common software security weaknesses
  • Time and state
  • Race conditions
  • File race condition
• Cryptography for developers
  • Cryptography basics
  • OpenSSL in brief
  • Elementary algorithms
    • Hashing
    • Random number generation
  • Confidentiality protection
  • Integrity protection
  • Public Key Infrastructure (PKI)
  • Transport security

Day 4

• Common software security weaknesses
• Input validation
  • Input validation principles
  • Denylists and allowlists
  • What to validate – the attack surface
  • Where to validate – defense in depth
  • When to validate – validation vs transformations
• Injection
  • Injection principles
  • Injection attacks
  • Code injection
  • OS command injection
  • Lab – Command injection
  • OS command injection best practices
  • Avoiding command injection with the right APIs
  • Lab – Command injection best practices
  • Case study – Shellshock
  • Lab – Shellshock
  • Case study – Command injection in AVTECH IP cameras
  • Testing for command injection
• Process control
  • Library injection
  • Lab – Library hijacking
  • Library injection best practices
• Integer handling problems
  • Representing signed numbers
  • Integer visualization
  • Integer promotion
  • Integer overflow
  • Lab – Integer overflow
  • Signed / unsigned confusion
  • Case study – The Stockholm Stock Exchange
  • Lab – Signed / unsigned confusion
  • Integer truncation
  • Lab – Integer truncation
  • Case study – WannaCry
  • Best practices
  • Upcasting
  • Precondition testing
  • Postcondition testing
  • Best practices in C
  • Lab – Handling integer overflow on the toolchain level in C and C++
  • Best practices in C++
  • Lab – Integer handling best practices in C++
  • Testing for numeric problems
• Files and streams
  • Path traversal
  • Lab – Path traversal
  • Path traversal-related examples
  • Case study – File spoofing in WinRAR
  • Virtual resources
  • Path traversal best practices
  • Lab – Path canonicalization
  • Testing for path traversal

Day 5

• Security testing
  • Security testing vs functional testing
  • Manual and automated methods
  • Black box, white box, and hybrid testing
  • Security testing methodology
  • Security testing – goals and methodologies
  • Overview of security testing processes
• Identifying and rating assets
  • Preparation and scoping
  • Identifying assets
  • Identifying the attack surface
  • Assigning security requirements
  • Lab – Identifying and rating assets
• Threat modeling
  • SDL threat modeling
  • Mapping STRIDE to DFD
  • DFD example
  • Attack trees
  • Attack tree example
  • Lab – Crafting an attack tree
  • Misuse cases
  • Misuse case examples
  • Risk analysis
  • Lab – Risk analysis
• Accomplishing the tests
  • Reporting, recommendations, and review
• Security testing techniques and tools
  • Code analysis
  • Static Application Security Testing (SAST)
  • Lab – Using static analysis tools
  • Dynamic analysis
  • Security testing at runtime
  • Penetration testing
  • Memory inspection and analysis
  • Lab – Dumping process memory
  • Stress testing
  • Dynamic Application Security Testing (DAST)
  • Fuzzing
  • Fuzzing techniques
  • Fuzzing – Observing the process
  • American Fuzzy Lop (AFL)
• Common software security weaknesses
  • Errors
  • Error and exception handling principles
  • Error handling
  • Returning a misleading status code
  • Error handling in C
  • Error handling in C++
  • Using std::optional safely
  • Information exposure through error reporting
  • Case study – Information leakage via errors in Apache Superset
  • Exception handling
  • In the catch block. And now what?
  • Empty catch block
  • Exception handling in C++
  • Lab – Exception handling mess
  • Testing for error and exception handling problems
• Denial of service
  • Flooding
  • Resource exhaustion
  • Sustained client engagement
  • Denial of service problems in C/C++
  • Infinite loop
  • Economic Denial of Sustainability (EDoS)
  • Amplification
  • Some amplification examples
  • Algorithmic complexity issues
  • Regular expression denial of service (ReDoS)
  • Lab – ReDoS
  • Dealing with ReDoS
  • Hash table collision
  • How do hash tables work?
  • Hash collision against hash tables
• Wrap up
  • Secure coding principles
  • Principles of robust programming by Matt Bishop
  • Secure design principles of Saltzer and Schroeder
  • And now what?
  • Software security sources and further reading
  • C and C++ resources
  • Security testing resources