Find & fix the flaws in your code
•Download as PPTX, PDF•
1 like•842 views
Discover how to create a viable Connected Car business model and drive consumer uptake through a safer driving experience. Everyone is aware of the need to worry about security but it isn't just about security--it's about all of the coding fundamentals including code quality, security, and open source management. In this presentation you will learn how to: -Measure the gaps in your developer's code first: Nearly 90% of all detected security holes can be traced back to just ten types of vulnerabilities -Educate your developers: 57% of people don't think automotive software development teams have the skills necessary to combat software security threats -Empower your developers with the right policies, processes, and tools to fill these gaps: 48% of people believe one of the main challenges of security automobile software is due to lack of defined corporate application security policies
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Find & fix the flaws in your code
Similar to Find & fix the flaws in your code (20)
More from Rogue Wave Software
More from Rogue Wave Software (20)
Recently uploaded
Recently uploaded (20)
Find & fix the flaws in your code
- 1. 1© 2015 Rogue Wave Software, Inc. All Rights Reserved. 1 Find & fix the flaws in your code Connected Cars Conference London, UK
- 2. 2© 2015 Rogue Wave Software, Inc. All Rights Reserved. 2 How confident are you in your code? Lots of vulnerabilities in automotive software development Measure your gaps, find your gaps, use the right tools for these gaps
- 3. 3© 2015 Rogue Wave Software, Inc. All Rights Reserved. 3 The top ten automotive cybersecurity vulnerabilities of 2015 Numeric errors Cryptographic issues Code injection Code Resource management errors Improper access control Improper input validation Information exposure Access Control Memory buffer problems
- 4. 4© 2015 Rogue Wave Software, Inc. All Rights Reserved. 4 Code CWE-17 : Weaknesses introduced during development including specification, design and implementation 4.4% • Somewhat of a catchall for a number of design or implementation flaws: – mismanaging passwords, storing plaintext passwords, hardcoded passwords – Improper handling of API contracts – Improper or absent error handling – Improperly handling time and state • Also code generation issues, like compiler removing “unneeded” code added for security
- 5. 5© 2015 Rogue Wave Software, Inc. All Rights Reserved. 5 Example: chrony (NTP) CVE-2015-1822 http://listengine.tuxfamily.org/chrony.tuxfamily.org/ch rony-announce/2015/04/msg00002.html chrony does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.
- 6. 6© 2015 Rogue Wave Software, Inc. All Rights Reserved. 6 chrony example: fail
- 7. 7© 2015 Rogue Wave Software, Inc. All Rights Reserved. 7 chrony example: fix
- 8. 8© 2015 Rogue Wave Software, Inc. All Rights Reserved. 8 Code issues: remediation • Design review – Use well-identified coding patterns – Create consistent API contracts – Track use and storage of encrypted data and passwords • Manual analysis – Identify unclean code—poor quality likely points to unidentified security issues – Handle all errors! Use well-identified coding patterns Design review Create consistent API contracts Track use and storage of encrypted data and passwords
- 9. 9© 2015 Rogue Wave Software, Inc. All Rights Reserved. 9 What do you need to know?
- 10. 10© 2015 Rogue Wave Software, Inc. All Rights Reserved. 10 Awareness Awareness of these top ten issues can help with nearly 90% of all vulnerabilities in embedded software 88%
- 11. 11© 2015 Rogue Wave Software, Inc. All Rights Reserved. 11 Best practices Clean design Methodical process Good tools Careful analysis 1 2 3 4
- 12. 12© 2015 Rogue Wave Software, Inc. All Rights Reserved. 12 Tools Tools only work when you’re using them Make sure they’re part of your processes Validation Build
- 13. 13© 2015 Rogue Wave Software, Inc. All Rights Reserved. 13 Black boxes Don’t ignore the black boxes They’re part of the system design too font engines web browsers PDF viewers speech rec engines graphics toolkits Adobe Flash & AIR
- 14. 14© 2015 Rogue Wave Software, Inc. All Rights Reserved. 14 Bugs can be found in very stable code, so plan on OTA updates to address deployed systems Over-the-air (OTA)
- 15. 15© 2015 Rogue Wave Software, Inc. All Rights Reserved. 15 Why wait until it’s too late?
- 16. 16© 2015 Rogue Wave Software, Inc. All Rights Reserved. 16 Security matters 50% of defects are introduced in implementation and build, yet the cost of defects increases exponentially throughout the build cycle. 50% 90% of developers say it is somewhat to very difficult to secure applications in automobiles. 90%
- 17. 17© 2015 Rogue Wave Software, Inc. All Rights Reserved. 17 What can you do?
- 18. 18© 2015 Rogue Wave Software, Inc. All Rights Reserved. 18 Start with strong OSS
- 19. 19© 2015 Rogue Wave Software, Inc. All Rights Reserved. 19 Open source is everywhere 80% of developers admit to having open source software in their code. 80% 70% of development organizations don’t have clear policies, procedures, and tools for using open source code. 70%
- 20. 20© 2015 Rogue Wave Software, Inc. All Rights Reserved. 20 How do you protect against OSS flaws? OSS Policy Acquisition & approval Support & maintenance Tracking Audit & governanceTraining Legal compliance Community interaction
- 21. 21© 2015 Rogue Wave Software, Inc. All Rights Reserved. 21 Use all features of SCA
- 22. 22© 2015 Rogue Wave Software, Inc. All Rights Reserved. 22 SCA – not your same old tool 37% of developers aren’t using automated scanning tools during development 37% 57% of developers don’t think automotive teams have the skills necessary to combat software security threats 57%
- 23. 23© 2015 Rogue Wave Software, Inc. All Rights Reserved. 23 SCA can detect weaknesses Buffer overflows Un-validated user input Memory and resource leaks Information leakage Cross-site scripting Injection Vulnerable coding practices Banned APIs Infinite loops Concurrency violations Dereferencing NULL pointers Usage of uninitialized data Resource management Memory allocation errors
- 24. 24© 2015 Rogue Wave Software, Inc. All Rights Reserved. 24 SCA can detect weaknesses CWE CWE/SANS Top 25 MISRA CERT DISA STIG OWASP Or create your own
- 25. 25© 2015 Rogue Wave Software, Inc. All Rights Reserved. 25 Now you can be confident in your code? Lots of vulnerabilities in automotive software development Measure your gaps, find your gaps, use the right tools for these gaps Attend our upcoming webinar for the top 10 Tools can help make these vulnerabilities less daunting Open source tools can help mitigate risks SCA can help detect and help strengthen weaknesses
- 26. 26© 2015 Rogue Wave Software, Inc. All Rights Reserved. 26 • US government repository of standards-based vulnerability data • Over 70,000 vulnerabilities • Updated continuously from companies and security experts • https://nvd.nist.gov/ National Vulnerability Database Mitre • Standardized categorization of cybersecurity vulnerabilities • Common Weakness Enumeration (CWE): http://cwe.mitre.org/ • Common Vulnerabilities and Exposures (CVE): http://cve.mitre.org/
- 27. 27© 2015 Rogue Wave Software, Inc. All Rights Reserved. 27
Editor's Notes
- This issue had fixes in a couple of files, but this is probably the most important spot. The problem here is pretty subtle, and you’d need to understand the surrounding context to make a lot of sense of it, but due to the logical OR you can come through this path when issue token is set to one, yet you don’t have a valid time stamp. Meaning, you’re allowing the caller to get the next token without properly checking the request.
- The fix changes the code a bit, but fundamentally, it makes the control logic easier to see and much clearer. This is a good practice to get into—don’t use a bunch of tricky nested conditionals or pile up statements with side-effects, or you might not get the result you intended. For the fix, we clear the “issue token” flag at the start, and we only set it if we pass through the conditionals and have a valid timestamp. Now the attacker gets caught if they issue bad requests.
- Only 30% of developers believe that software updates should be handled by OTA
- Modern SCA discovers issues far deeper in code and then ever before - due to cutting-edge algorithms and faster hardware - allowing tools to go well beyond simple defects into very complex interactions, standards compliance, and custom checkers.
- SCA products are now engineered so the tool pushes the chosen security coding standards and their associated checkers and taxonomies to every developer's desktop. Everyone is notified as they write their code if they have violated the standards or introduced any vulnerabilities or defects. Fix any potential software security problems immediately, before code check-in. This frees up valuable developer time to work on more critical assignments.
- Most organizations need to comply with multiple coding standards to ensure software security. Klocwork includes built-in checkers to support all of the leading standards. Klocwork ships with hundreds of checkers. Our source code analysis engine can be tailored to enforce the rules for compliance with each standard by enabling or disabling individual checkers or full checker groups to meet the specific needs of your software development environment and processes. We've also worked with some of the largest consumer, military, communications, electronic, mobile and other companies in the world to create a checker API, providing your teams the ability to quickly and easily create customized security checkers.
- The statistics we’ve used on the frequency of vulnerability problems is from this data. They provide a fantastic resource, but there’s a huge amount of info there. We’ve tried to boil that vast repository of vulnerability info into the tips that will best help the embedded engineer. We are focused on finding problems that affect software that could be used within an automotive telematics or infotainment system. We screened the vulnerability database to remove web, server, scripting, CRM or anything else that wasn’t embedded, however the types of problems we’re discussing are common to a large number of varying types of embedded systems, not just automotive. All of the examples come from actual source code—we look at some of the real vulnerabilities reported this year and see how they were fixed.