Bjarne Stroustrup, the creator of C++, once said : “C makes it easy to shoot yourself in the foot; C++ makes it harder, but when you do it blows your whole leg off.” He has also said : “Within C++, there is a much smaller and cleaner language struggling to get out.” Both are true.
This talk is for programmers wishing to feel more comfortable navigating the C++ landscape. Motivated by going through well known vulnerability patterns that have been used in exploits for decades, we will explore the programming culture that has developed around the C++ language. Specifically, we will look at programming patterns that navigate around or through some of the dangerous parts of the C++ language. The goal is to build a set of programming practices based in the “smaller and cleaner language” inside C++. And by doing so, we will also build an awareness around code constructs that can potentially “blow your whole leg off”.
Undefined Behavior and Compiler Optimizations can result in programs that display surprising behavior. In this presentation we look at some examples, and I hope to convince you that you should not reason about Undefined Behavior and that you should take care and use your tools.
Reading Other Peoples Code (Web Rebels 2018)Patricia Aas
Someone else's code. Even worse, thousands of lines, maybe hundreds of files of other peoples code. Is there a way to methodically read and understand other peoples work, build their mental models? In this talk I will go through techniques I have developed throughout 18 years of programming. Hopefully you will walk away with a plan on how to approach a new code base. But even more I hope you walk away with a feeling of curiosity, wanting to get to know your fellow programmers through their code.
Software Vulnerabilities in C and C++ (CppCon 2018)Patricia Aas
What does a vulnerability using signed integer overflow look like? Or a stack buffer overflow? How does code like this look and how can we change the way we program to reduce our risk? The first half of this talk will show examples of many different vulnerabilities and describe how these are combined to make the first steps of an exploit. Then we will discuss what kind of programming practices we can employ to reduce the chances of these kinds of bugs creeping into our code.
Secure Programming Practices in C++ (NDC Security 2018)Patricia Aas
This talk is for programmers wishing to feel more comfortable navigating the C++ landscape. We will explore the programming culture that has developed around the C++ language. Specifically, we will look at programming patterns that navigate around or through some of the dangerous parts of the C++ language. The goal is to build a set of programming practices based in the “smaller and cleaner language” inside C++. And by doing so, we will also build an awareness around code constructs that can potentially “blows your whole leg off”.
Thoughts On Learning A New Programming LanguagePatricia Aas
How should we teach a new language to folks that already know how to program?
How do we use what we already know to leapfrog the learning process?
Based on my personal experience and snippets of natural language theory, we will try to explore the cheats and pitfalls when learning a new programming language, but also dig into how we can make it easier.
Learning a new language is often colored by the language you come from.
As a programmer coming from C++ and Java, with some functional programming background, how did I navigate trying to get a grasp of C#? Should be fun for C# developers, but also educational: How do we teach a new language to folks that already know how to program?
Isolating GPU Access in its Own ProcessPatricia Aas
Chromium's process architecture has graphics access restricted to a separate GPU-process. There are several reasons why this could make sense, three common ones are: Security, Robustness and Dependency Separation.
GPU access restricted to a single process requires an efficient framework for communication over IPC from the other processes, and most likely a framework for composition of surfaces. This talk describes both the possible motivations for this kind of architecture and Chromium's solution for the IPC framework. We will demonstrate how a multi-process program can compose into a single window on Linux.
The Anatomy of an Exploit (NDC TechTown 2019)Patricia Aas
Security vulnerabilities and secure coding is often talked about in the abstract by programmers, but rarely understood. In this talk we will walk through simple exploit attempts, and finally a simple stack buffer overflow exploit, how it’s developed and how it’s used.
The goal is to try to get a feeling for the point of view of an "attacker", and to slowly start looking at exploitation as just another programming practice. We will mainly be looking at C and x86_64 assembly, so bring snacks.
Undefined Behavior and Compiler Optimizations can result in programs that display surprising behavior. In this presentation we look at some examples, and I hope to convince you that you should not reason about Undefined Behavior and that you should take care and use your tools.
Reading Other Peoples Code (Web Rebels 2018)Patricia Aas
Someone else's code. Even worse, thousands of lines, maybe hundreds of files of other peoples code. Is there a way to methodically read and understand other peoples work, build their mental models? In this talk I will go through techniques I have developed throughout 18 years of programming. Hopefully you will walk away with a plan on how to approach a new code base. But even more I hope you walk away with a feeling of curiosity, wanting to get to know your fellow programmers through their code.
Software Vulnerabilities in C and C++ (CppCon 2018)Patricia Aas
What does a vulnerability using signed integer overflow look like? Or a stack buffer overflow? How does code like this look and how can we change the way we program to reduce our risk? The first half of this talk will show examples of many different vulnerabilities and describe how these are combined to make the first steps of an exploit. Then we will discuss what kind of programming practices we can employ to reduce the chances of these kinds of bugs creeping into our code.
Secure Programming Practices in C++ (NDC Security 2018)Patricia Aas
This talk is for programmers wishing to feel more comfortable navigating the C++ landscape. We will explore the programming culture that has developed around the C++ language. Specifically, we will look at programming patterns that navigate around or through some of the dangerous parts of the C++ language. The goal is to build a set of programming practices based in the “smaller and cleaner language” inside C++. And by doing so, we will also build an awareness around code constructs that can potentially “blows your whole leg off”.
Thoughts On Learning A New Programming LanguagePatricia Aas
How should we teach a new language to folks that already know how to program?
How do we use what we already know to leapfrog the learning process?
Based on my personal experience and snippets of natural language theory, we will try to explore the cheats and pitfalls when learning a new programming language, but also dig into how we can make it easier.
Learning a new language is often colored by the language you come from.
As a programmer coming from C++ and Java, with some functional programming background, how did I navigate trying to get a grasp of C#? Should be fun for C# developers, but also educational: How do we teach a new language to folks that already know how to program?
Isolating GPU Access in its Own ProcessPatricia Aas
Chromium's process architecture has graphics access restricted to a separate GPU-process. There are several reasons why this could make sense, three common ones are: Security, Robustness and Dependency Separation.
GPU access restricted to a single process requires an efficient framework for communication over IPC from the other processes, and most likely a framework for composition of surfaces. This talk describes both the possible motivations for this kind of architecture and Chromium's solution for the IPC framework. We will demonstrate how a multi-process program can compose into a single window on Linux.
The Anatomy of an Exploit (NDC TechTown 2019)Patricia Aas
Security vulnerabilities and secure coding is often talked about in the abstract by programmers, but rarely understood. In this talk we will walk through simple exploit attempts, and finally a simple stack buffer overflow exploit, how it’s developed and how it’s used.
The goal is to try to get a feeling for the point of view of an "attacker", and to slowly start looking at exploitation as just another programming practice. We will mainly be looking at C and x86_64 assembly, so bring snacks.
Security vulnerabilities and secure coding is often talked about in the abstract by programmers, but rarely understood. In this talk we will walk through a simple exploit, how it’s developed and how it’s used. The goal is to try to get a feeling for the point of view of an "attacker", and to slowly start looking at exploitation as another programming tool. We will mainly be looking at C and x86_64 assembly, so bring snacks.
Reading Other Peoples Code (NDC Copenhagen 2019)Patricia Aas
Someone else's code. Even worse, thousands of lines, maybe hundreds of files of other peoples code. Is there a way to methodically read and understand other peoples work, build their mental models?
In this talk I will go through techniques I have developed throughout 18 years of programming. Hopefully, you will walk away with a plan on how to approach a new code base. But even more, I hope you walk away with a feeling of curiosity, wanting to get to know your fellow programmers through their code.
Chromium Sandbox on Linux (NDC Security 2019)Patricia Aas
The Linux Security and Isolation APIs have become the basis of some of the most useful features server-side, providing the isolation required for efficient containers.
However, these APIs also form the basis of the Chromium Sandbox on Linux, and we will study them in that context in this talk.
C++ for Java Developers (JavaZone Academy 2018)Patricia Aas
Introduction to Modern C++ for programmers with a Java background. Maps key C++ concepts to Java concepts and dives into how C++ programmers deal with and think about memory. This intersection is interesting whether you are learning or teaching C++.
Security vulnerabilities and secure coding is often talked about in the abstract by programmers, but rarely understood. In this talk we will walk through simple exploit attempts, and finally a simple stack buffer overflow exploit, how it’s developed and how it’s used. The goal is to try to get a feeling for the point of view of an "attacker", and to slowly start looking at exploitation as just another programming practice. We will mainly be looking at C and x86_64 assembly, so bring snacks.
The Anatomy of an Exploit (NDC TechTown 2019))Patricia Aas
Security vulnerabilities and secure coding is often talked about in the abstract by programmers, but rarely understood. In this talk we will walk through simple exploit attempts, and finally a simple stack buffer overflow exploit, how it’s developed and how it’s used.
The goal is to try to get a feeling for the point of view of an "attacker", and to slowly start looking at exploitation as just another programming practice. We will mainly be looking at C and x86_64 assembly, so bring snacks.
PVS-Studio is ready to improve the code of Tizen operating systemAndrey Karpov
Objective. Contract agreement with PVS-Studio team concerning the error fixing and regular code audit.
Currently, PVS-Studio detects more than 10% of errors that are present in the code of the Tizen project.
In the case of regular use of PVS-Studio on the new code, about 20% of errors can be prevented.
I predict that PVS-Studio team can detect and fix about 27 000 errors in the Tizen project.
This presentation, first delivered at Heisenbug St. Petersburg 2017, covers the challenges of doing large scale testing in security from the perspective of test engineering. It's targeted to non-security test experts, with a handful of examples of what we've seen working and what failed.
Cisco network equipment has always been an attractive attack target due to its prevalence and the key role that it plays in network structure and security.
This equipment is based on a wide variety of OS (firmware) architectures, types, and versions, so it is much harder to develop a universal shellcode. Publicly available Cisco IOS shellcodes are tailored to specific equipment, have narrow functionality, and are not exactly useful for penetration testing.
This talk is the presentation of a research initiated by our research center to create a shellcode which is as easily portable between different IOS firmwares as possible and which provides a lot of pentesting features because it can dynamically change the shellcode destination at the stage of post-exploitation.
We will also consider the possibility of creating a worm which could spread across the infrastructure, from firewall to router, from router to switch, etc.
C++ for Java Developers (SwedenCpp Meetup 2017)Patricia Aas
Introduction to Modern C++ for programmers with a Java background. Maps key concepts to Java concepts and dives into how C++ programmers deal with and think about memory. This intersection is interesting whether you are learning or teaching C++.
GitGot: The Swiss Army Chainsaw of Git Repo ManagementJohn Anderson
GitGot is a Perl-based tool for batch management of collections of git repos. It has a number of interesting features and acts as a force multiplier when dealing with a large varied collection of repositories. My talk will cover why you would want to use GitGot as well as how to use it effectively.
Exploit Research and Development Megaprimer: Win32 EgghunterAjin Abraham
Exploit Research and Development Megaprimer
http://opensecurity.in/exploit-research-and-development-megaprimer/
http://www.youtube.com/playlist?list=PLX3EwmWe0cS_5oy86fnqFRfHpxJHjtuyf
Review unknown code with static analysis - bredaphpDamien Seguy
Code quality is not just for christmas, it is a daily part of the job. So, what do you do when you're handed with a five feet long pole a million lines of code that must be vetted ? You call static analysis to the rescue. During one hour, we'll be reviewing totally unknown code code : no name, no usage, not a clue. We'll apply a wide range of tools, reaching for anything that helps us understand the code and form an opinion on it. Can we break this mystery and learn how everyone else is looking at our code ?
In May 2016, German game-development company Crytek made a decision to upload the source code of their game engine CryEngine V to Github. The engine is written in C++ and has immediately attracted attention of both the open-source developer community and the team of developers of PVS-Studio static analyzer who regularly scan the code of open-source projects to estimate its quality. A lot of great games were created by a number of video-game development studios using various versions of CryEngine, and now the engine has become available to even more developers. This article gives an overview of errors found in the project by PVS-Studio static analyzer.
Fernando Arnaboldi - Exposing Hidden Exploitable Behaviors Using Extended Dif...Codemotion
I created the first differential fuzzing framework to detect dangerous and unusual behaviors in similar software implementations. To prove its effectivity, I found vulnerabilities in multiple implementations of programming language parsers: Java, JavaScript, Perl, PHP, Powershell, Python, and Ruby. This form of fuzzing can work as a practical form of testing to find exploitable vulnerabilities. More undisclosed vulnerabilities will be shown throughout this talk to exemplify how to find issues in general pieces of software. This talk will also include a new special release for Codemotion.
Security vulnerabilities and secure coding is often talked about in the abstract by programmers, but rarely understood. In this talk we will walk through a simple exploit, how it’s developed and how it’s used. The goal is to try to get a feeling for the point of view of an "attacker", and to slowly start looking at exploitation as another programming tool. We will mainly be looking at C and x86_64 assembly, so bring snacks.
Reading Other Peoples Code (NDC Copenhagen 2019)Patricia Aas
Someone else's code. Even worse, thousands of lines, maybe hundreds of files of other peoples code. Is there a way to methodically read and understand other peoples work, build their mental models?
In this talk I will go through techniques I have developed throughout 18 years of programming. Hopefully, you will walk away with a plan on how to approach a new code base. But even more, I hope you walk away with a feeling of curiosity, wanting to get to know your fellow programmers through their code.
Chromium Sandbox on Linux (NDC Security 2019)Patricia Aas
The Linux Security and Isolation APIs have become the basis of some of the most useful features server-side, providing the isolation required for efficient containers.
However, these APIs also form the basis of the Chromium Sandbox on Linux, and we will study them in that context in this talk.
C++ for Java Developers (JavaZone Academy 2018)Patricia Aas
Introduction to Modern C++ for programmers with a Java background. Maps key C++ concepts to Java concepts and dives into how C++ programmers deal with and think about memory. This intersection is interesting whether you are learning or teaching C++.
Security vulnerabilities and secure coding is often talked about in the abstract by programmers, but rarely understood. In this talk we will walk through simple exploit attempts, and finally a simple stack buffer overflow exploit, how it’s developed and how it’s used. The goal is to try to get a feeling for the point of view of an "attacker", and to slowly start looking at exploitation as just another programming practice. We will mainly be looking at C and x86_64 assembly, so bring snacks.
The Anatomy of an Exploit (NDC TechTown 2019))Patricia Aas
Security vulnerabilities and secure coding is often talked about in the abstract by programmers, but rarely understood. In this talk we will walk through simple exploit attempts, and finally a simple stack buffer overflow exploit, how it’s developed and how it’s used.
The goal is to try to get a feeling for the point of view of an "attacker", and to slowly start looking at exploitation as just another programming practice. We will mainly be looking at C and x86_64 assembly, so bring snacks.
PVS-Studio is ready to improve the code of Tizen operating systemAndrey Karpov
Objective. Contract agreement with PVS-Studio team concerning the error fixing and regular code audit.
Currently, PVS-Studio detects more than 10% of errors that are present in the code of the Tizen project.
In the case of regular use of PVS-Studio on the new code, about 20% of errors can be prevented.
I predict that PVS-Studio team can detect and fix about 27 000 errors in the Tizen project.
This presentation, first delivered at Heisenbug St. Petersburg 2017, covers the challenges of doing large scale testing in security from the perspective of test engineering. It's targeted to non-security test experts, with a handful of examples of what we've seen working and what failed.
Cisco network equipment has always been an attractive attack target due to its prevalence and the key role that it plays in network structure and security.
This equipment is based on a wide variety of OS (firmware) architectures, types, and versions, so it is much harder to develop a universal shellcode. Publicly available Cisco IOS shellcodes are tailored to specific equipment, have narrow functionality, and are not exactly useful for penetration testing.
This talk is the presentation of a research initiated by our research center to create a shellcode which is as easily portable between different IOS firmwares as possible and which provides a lot of pentesting features because it can dynamically change the shellcode destination at the stage of post-exploitation.
We will also consider the possibility of creating a worm which could spread across the infrastructure, from firewall to router, from router to switch, etc.
C++ for Java Developers (SwedenCpp Meetup 2017)Patricia Aas
Introduction to Modern C++ for programmers with a Java background. Maps key concepts to Java concepts and dives into how C++ programmers deal with and think about memory. This intersection is interesting whether you are learning or teaching C++.
GitGot: The Swiss Army Chainsaw of Git Repo ManagementJohn Anderson
GitGot is a Perl-based tool for batch management of collections of git repos. It has a number of interesting features and acts as a force multiplier when dealing with a large varied collection of repositories. My talk will cover why you would want to use GitGot as well as how to use it effectively.
Exploit Research and Development Megaprimer: Win32 EgghunterAjin Abraham
Exploit Research and Development Megaprimer
http://opensecurity.in/exploit-research-and-development-megaprimer/
http://www.youtube.com/playlist?list=PLX3EwmWe0cS_5oy86fnqFRfHpxJHjtuyf
Review unknown code with static analysis - bredaphpDamien Seguy
Code quality is not just for christmas, it is a daily part of the job. So, what do you do when you're handed with a five feet long pole a million lines of code that must be vetted ? You call static analysis to the rescue. During one hour, we'll be reviewing totally unknown code code : no name, no usage, not a clue. We'll apply a wide range of tools, reaching for anything that helps us understand the code and form an opinion on it. Can we break this mystery and learn how everyone else is looking at our code ?
In May 2016, German game-development company Crytek made a decision to upload the source code of their game engine CryEngine V to Github. The engine is written in C++ and has immediately attracted attention of both the open-source developer community and the team of developers of PVS-Studio static analyzer who regularly scan the code of open-source projects to estimate its quality. A lot of great games were created by a number of video-game development studios using various versions of CryEngine, and now the engine has become available to even more developers. This article gives an overview of errors found in the project by PVS-Studio static analyzer.
Fernando Arnaboldi - Exposing Hidden Exploitable Behaviors Using Extended Dif...Codemotion
I created the first differential fuzzing framework to detect dangerous and unusual behaviors in similar software implementations. To prove its effectivity, I found vulnerabilities in multiple implementations of programming language parsers: Java, JavaScript, Perl, PHP, Powershell, Python, and Ruby. This form of fuzzing can work as a practical form of testing to find exploitable vulnerabilities. More undisclosed vulnerabilities will be shown throughout this talk to exemplify how to find issues in general pieces of software. This talk will also include a new special release for Codemotion.
100 bugs in Open Source C/C++ projects Andrey Karpov
This article demonstrates capabilities of the static code analysis methodology. The readers are offered to study the samples of one hundred errors found in open-source projects in C/C++.
A Check of the Open-Source Project WinSCP Developed in Embarcadero C++ BuilderAndrey Karpov
We regularly check open-source C/C++ projects, but what we check are mostly projects developed in the Visual Studio IDE. For some reason, we haven't paid much attention to the Embarcadero C++ Builder IDE. In order to improve this situation, we are going to discuss the WinSCP project I have checked recently.
P.S. C++ Builder support in PVS-Studio had been dropped after version 5.20. If you have any questions, feel free to contact our support.
It is quite often that software developers have absolutely no clue about the cost of an error. It is very important that the error be found at the earliest possible stage.
This article demonstrates capabilities of the static code analysis methodology. The readers are offered to study the samples of one hundred errors found in open-source projects in C/C++. All the errors have been found with the PVS-Studio static code analyzer.
The Hitchhiker's Guide to Faster Builds. Viktor Kirilov. CoreHard Spring 2019corehard_by
C++ is known for things such as performance, expressiveness, the lack of a standard build system and package management, complexity and long compile times. The inability to iterate quickly is one of the biggest killers of productivity. This talk is aimed at anyone interested in improving the last of these points - it will provide insights into why compilation (and linking) take so long for C++ and will then provide an exhaustive list of techniques and tools to mitigate the problem, such as: - tooling and infrastructure - hardware, build systems, caching, distributed builds, diagnostics of bottlenecks, code hygiene - techniques - unity builds, precompiled headers, linking (static vs shared libraries) - source code modification - the PIMPL idiom, better template use, annotations - modules - what they are, when they are coming to C++ and what becomes obsolete because of them
Build 2016 - B880 - Top 6 Reasons to Move Your C++ Code to Visual Studio 2015Windows Developer
Visual Studio 2015 provides the best in class C++ development experience whether you are targeting Android, iOS, Linux, Windows, or IoT. With a good mix of demos and showcase for new C++ experiences, this talk goes over six great reasons why you should migrate to Visual Studio 2015 today.
The PVS-Studio team is now actively developing a static analyzer for C# code. The first version is expected by the end of 2015. And for now my task is to write a few articles to attract C# programmers' attention to our tool in advance. I've got an updated installer today, so we can now install PVS-Studio with C#-support enabled and even analyze some source code. Without further hesitation, I decided to scan whichever program I had at hand. This happened to be the Umbraco project. Of course we can't expect too much of the current version of the analyzer, but its functionality has been enough to allow me to write this small article.
Similar to Secure Programming Practices in C++ (NDC Oslo 2018) (20)
NDC TechTown 2023_ Return Oriented Programming an introduction.pdfPatricia Aas
Return Oriented Programming (ROP) is an exploitation technique that folks have often heard of, but don't know the mechanics of. In this talk you will learn how it works, and we will go through some examples to show how it can be used to execute code in contexts where the stack is not executable.
Return Oriented Programming, an introductionPatricia Aas
Return Oriented Programming (ROP) is an exploitation technique that folks have often heard of, but don't know the mechanics of.
In this talk you will learn how it works, and we will go through how it can be used to execute code in contexts where the stack is not executable.
I can't work like this (KDE Academy Keynote 2021)Patricia Aas
Making software products can be fraught with conflicts, where people in different roles may feel sabotaged by others. In this talk I present a model for thinking about the problems we solve and how we solve them, and using that I hope to convince you that team excellence comes from our differences, rather than in spite of them. Hopefully you'll walk away with a deeper understanding of that colleague that never writes tests, or the one that constantly complains that all you do is "make bugs".
Dependency Management in C++ (NDC TechTown 2021)Patricia Aas
C++ has been slow to settle on standardized tools for building and dependency management. In recent years CMake has emerged as the de facto standard for builds, but dependency management still has no clear winner. In this talk I will look into what dependency management might look like in modern C++ projects and how that relates to security.
Introduction to Memory Exploitation (Meeting C++ 2021)Patricia Aas
Stack based exploitation has gotten all the fame, but many platform and compiler mitigations have made it very hard to exploit stack vulnerabilities. Heap based exploits are still very relevant, and since this is black magic for most developers I will here give an introduction to the field.
We keep on thinking we are living in the future, but native exploitation has a rich history, and many times the vulnerabilities and exploitation techniques are decades old. We'll look at some of these, how they have surfaced in recent years and how prepared we are today, armed with modern tooling, to find and fix "classic" vulnerabilities.
We keep on thinking we are living in the future, but native exploitation has a rich history, and many times the vulnerabilities and exploitation techniques are decades old.
We'll look at some of these, how they have surfaced in recent years and how prepared we are today, armed with modern tooling, to find and fix "classic" vulnerabilities.
Introduction to Memory Exploitation (CppEurope 2021)Patricia Aas
Stack based exploitation has gotten all the fame, but many platform and compiler mitigations have made it very hard to exploit stack vulnerabilities. Heap based exploits are still very relevant, and since this is black magic for most developers I will here give an introduction to the field.
Trying to build an Open Source browser in 2020Patricia Aas
A lot of things have been developed over the last 15 years that should make the process of making a browser easier. In this talk we will explore a bunch of different tools, platforms and libraries that could go into making a browser in 2020.
We will also see a live demo of a simple browser built with these OSS projects. We will also discuss the limitations and future work needed to make this work in practice.
Trying to build an Open Source browser in 2020Patricia Aas
A lot of things have been developed over the last 15 years that should make the process of making a browser easier. In this talk we will explore a bunch of different tools, platforms and libraries that could go into making a browser in 2020.
We will also see a live demo of a simple browser built with these OSS projects. We will also discuss the limitations and future work needed to make this work in practice.
DevSecOps for Developers, How To Start (ETC 2020)Patricia Aas
How can you squeeze Security into DevOps? Security is often an understaffed function, so how can you leverage what you have in DevOps to improve your security posture?
Often the culture clash between Security and Development is even more prominent than between Development and Operations. Understanding the differences in how these functions work, and leveraging their similarities, will reveal processes already in place that can be used to improve security. This fine tuning of tools and processes can give you DevSecOps on a shoestring.
Elections: Trust and Critical Infrastructure (NDC TechTown 2019)Patricia Aas
Free and correct elections are the linchpin of democracy. For a government to be formed based the will of the people, the will of the people must be heard. Across the world election systems are being classified as critical infrastructure, and they face the same concerns as all other fundamental systems in society.
We are building our critical infrastructure from hardware and software built by nations and companies we can’t expect to trust. How can this be dealt with in Election Security, and can those lessons be applied to other critical systems society depends on today?
Elections, Trust and Critical Infrastructure (NDC TechTown)Patricia Aas
Free and correct elections are the linchpin of democracy. For a government to be formed based the will of the people, the will of the people must be heard. Across the world election systems are being classified as critical infrastructure, and they face the same concerns as all other fundamental systems in society.
We are building our critical infrastructure from hardware and software built by nations and companies we can’t expect to trust. How can this be dealt with in Election Security, and can those lessons be applied to other critical systems society depends on today?
Survival Tips for Women in Tech (JavaZone 2019) Patricia Aas
Being the only woman on your team can be hard. Many times it’s difficult to know what is only your experience and what is common. In this talk we’ll go through 24 tips (and a few bonus tips) based on well over a decade of experience being the only woman in several teams. If you’re a woman hopefully you’ll walk out with some ideas you can put to work right away, if you’re a man hopefully you’ll walk out with a new perspective and start noticing things in your day-to-day that you didn’t notice before.
https://patricia.no/2018/09/06/survival_tips_for_women_in_tech.html
More and more we see technology, both hardware and software, intersect with fundamental issues like privacy, democracy and human rights. The opaqueness of tech makes it a handy instrument of oppression and manipulation. We have taught the population to trust us. We have constructed a world in which they have to exist, with little to no oversight or transparency. We build critical infrastructure on hardware and software that even we cannot audit. How can we wield that responsibility? How do we protect those that speak up? How do we protect the population?
Keynote: Deconstructing Privilege (C++ on Sea 2019)Patricia Aas
Can you describe a situation that caused you to realize you were privileged?
I have asked many people that question now, and what I have learned is that privilege is an Unconscious Incompetence. Being privileged is a non-event. When we become conscious of it we realize that our privileged experience is not applicable to less privileged people. What happens to them does not happen to us. Only when we become Consciously Incompetent do we realize the need to listen. We need to learn.
In this talk I hope to make you realize that we all have privilege and to start a journey through self reflection to becoming Consciously Incompetent. I hope also to give some indicators and patterns that you can look for in your daily lives to recognize and maybe even to correct imbalances you see.
Trying to prepare your project or organisation to be able to receive vulnerability reports is a daunting task. And often far more complex and cross disciplinary than one first expects.
This talk describes some of the most common challenges and how to counteract them.
Why Is Election Security So Hard? (Paranoia 2019) Patricia Aas
What makes the domain and requirements of elections so difficult to solve with computers? In this talk we will go through a lot of the requirements of an election and what motivates them, and show how computers surprisingly often introduce more vulnerabilities than they solve when applied to elections.
How can you squeeze Security into DevOps? Security is often an understaffed function, so how can you leverage what you have in DevOps to improve your security posture? We will reveal processes already in place that can be used to improve security. This fine tuning of tools and processes can give you DevSecOps on a shoestring.
Gamify Your Mind; The Secret Sauce to Delivering Success, Continuously Improv...Shahin Sheidaei
Games are powerful teaching tools, fostering hands-on engagement and fun. But they require careful consideration to succeed. Join me to explore factors in running and selecting games, ensuring they serve as effective teaching tools. Learn to maintain focus on learning objectives while playing, and how to measure the ROI of gaming in education. Discover strategies for pitching gaming to leadership. This session offers insights, tips, and examples for coaches, team leads, and enterprise leaders seeking to teach from simple to complex concepts.
Unleash Unlimited Potential with One-Time Purchase
BoxLang is more than just a language; it's a community. By choosing a Visionary License, you're not just investing in your success, you're actively contributing to the ongoing development and support of BoxLang.
Developing Distributed High-performance Computing Capabilities of an Open Sci...Globus
COVID-19 had an unprecedented impact on scientific collaboration. The pandemic and its broad response from the scientific community has forged new relationships among public health practitioners, mathematical modelers, and scientific computing specialists, while revealing critical gaps in exploiting advanced computing systems to support urgent decision making. Informed by our team’s work in applying high-performance computing in support of public health decision makers during the COVID-19 pandemic, we present how Globus technologies are enabling the development of an open science platform for robust epidemic analysis, with the goal of collaborative, secure, distributed, on-demand, and fast time-to-solution analyses to support public health.
Code reviews are vital for ensuring good code quality. They serve as one of our last lines of defense against bugs and subpar code reaching production.
Yet, they often turn into annoying tasks riddled with frustration, hostility, unclear feedback and lack of standards. How can we improve this crucial process?
In this session we will cover:
- The Art of Effective Code Reviews
- Streamlining the Review Process
- Elevating Reviews with Automated Tools
By the end of this presentation, you'll have the knowledge on how to organize and improve your code review proces
In the ever-evolving landscape of technology, enterprise software development is undergoing a significant transformation. Traditional coding methods are being challenged by innovative no-code solutions, which promise to streamline and democratize the software development process.
This shift is particularly impactful for enterprises, which require robust, scalable, and efficient software to manage their operations. In this article, we will explore the various facets of enterprise software development with no-code solutions, examining their benefits, challenges, and the future potential they hold.
Top 7 Unique WhatsApp API Benefits | Saudi ArabiaYara Milbes
Discover the transformative power of the WhatsApp API in our latest SlideShare presentation, "Top 7 Unique WhatsApp API Benefits." In today's fast-paced digital era, effective communication is crucial for both personal and professional success. Whether you're a small business looking to enhance customer interactions or an individual seeking seamless communication with loved ones, the WhatsApp API offers robust capabilities that can significantly elevate your experience.
In this presentation, we delve into the top 7 distinctive benefits of the WhatsApp API, provided by the leading WhatsApp API service provider in Saudi Arabia. Learn how to streamline customer support, automate notifications, leverage rich media messaging, run scalable marketing campaigns, integrate secure payments, synchronize with CRM systems, and ensure enhanced security and privacy.
Enterprise Resource Planning System includes various modules that reduce any business's workload. Additionally, it organizes the workflows, which drives towards enhancing productivity. Here are a detailed explanation of the ERP modules. Going through the points will help you understand how the software is changing the work dynamics.
To know more details here: https://blogs.nyggs.com/nyggs/enterprise-resource-planning-erp-system-modules/
How to Position Your Globus Data Portal for Success Ten Good PracticesGlobus
Science gateways allow science and engineering communities to access shared data, software, computing services, and instruments. Science gateways have gained a lot of traction in the last twenty years, as evidenced by projects such as the Science Gateways Community Institute (SGCI) and the Center of Excellence on Science Gateways (SGX3) in the US, The Australian Research Data Commons (ARDC) and its platforms in Australia, and the projects around Virtual Research Environments in Europe. A few mature frameworks have evolved with their different strengths and foci and have been taken up by a larger community such as the Globus Data Portal, Hubzero, Tapis, and Galaxy. However, even when gateways are built on successful frameworks, they continue to face the challenges of ongoing maintenance costs and how to meet the ever-expanding needs of the community they serve with enhanced features. It is not uncommon that gateways with compelling use cases are nonetheless unable to get past the prototype phase and become a full production service, or if they do, they don't survive more than a couple of years. While there is no guaranteed pathway to success, it seems likely that for any gateway there is a need for a strong community and/or solid funding streams to create and sustain its success. With over twenty years of examples to draw from, this presentation goes into detail for ten factors common to successful and enduring gateways that effectively serve as best practices for any new or developing gateway.
GraphSummit Paris - The art of the possible with Graph TechnologyNeo4j
Sudhir Hasbe, Chief Product Officer, Neo4j
Join us as we explore breakthrough innovations enabled by interconnected data and AI. Discover firsthand how organizations use relationships in data to uncover contextual insights and solve our most pressing challenges – from optimizing supply chains, detecting fraud, and improving customer experiences to accelerating drug discoveries.
First Steps with Globus Compute Multi-User EndpointsGlobus
In this presentation we will share our experiences around getting started with the Globus Compute multi-user endpoint. Working with the Pharmacology group at the University of Auckland, we have previously written an application using Globus Compute that can offload computationally expensive steps in the researcher's workflows, which they wish to manage from their familiar Windows environments, onto the NeSI (New Zealand eScience Infrastructure) cluster. Some of the challenges we have encountered were that each researcher had to set up and manage their own single-user globus compute endpoint and that the workloads had varying resource requirements (CPUs, memory and wall time) between different runs. We hope that the multi-user endpoint will help to address these challenges and share an update on our progress here.
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I ...Juraj Vysvader
In 2015, I used to write extensions for Joomla, WordPress, phpBB3, etc and I didn't get rich from it but it did have 63K downloads (powered possible tens of thousands of websites).
Large Language Models and the End of ProgrammingMatt Welsh
Talk by Matt Welsh at Craft Conference 2024 on the impact that Large Language Models will have on the future of software development. In this talk, I discuss the ways in which LLMs will impact the software industry, from replacing human software developers with AI, to replacing conventional software with models that perform reasoning, computation, and problem-solving.
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptxrickgrimesss22
Discover the essential features to incorporate in your Winzo clone app to boost business growth, enhance user engagement, and drive revenue. Learn how to create a compelling gaming experience that stands out in the competitive market.
Understanding Globus Data Transfers with NetSageGlobus
NetSage is an open privacy-aware network measurement, analysis, and visualization service designed to help end-users visualize and reason about large data transfers. NetSage traditionally has used a combination of passive measurements, including SNMP and flow data, as well as active measurements, mainly perfSONAR, to provide longitudinal network performance data visualization. It has been deployed by dozens of networks world wide, and is supported domestically by the Engagement and Performance Operations Center (EPOC), NSF #2328479. We have recently expanded the NetSage data sources to include logs for Globus data transfers, following the same privacy-preserving approach as for Flow data. Using the logs for the Texas Advanced Computing Center (TACC) as an example, this talk will walk through several different example use cases that NetSage can answer, including: Who is using Globus to share data with my institution, and what kind of performance are they able to achieve? How many transfers has Globus supported for us? Which sites are we sharing the most data with, and how is that changing over time? How is my site using Globus to move data internally, and what kind of performance do we see for those transfers? What percentage of data transfers at my institution used Globus, and how did the overall data transfer performance compare to the Globus users?
Software Engineering, Software Consulting, Tech Lead, Spring Boot, Spring Cloud, Spring Core, Spring JDBC, Spring Transaction, Spring MVC, OpenShift Cloud Platform, Kafka, REST, SOAP, LLD & HLD.
6. What specs exist?
Undefined Behavior
Compiler Optimizations
Exploitability
Take your vitamins
The Eight I'd Really Rather You Didn'ts
@pati_gallardo
8. CG: C++ Core Guidelines (328 pages!)
@pati_gallardo
9. C++ Core Guidelines
“The C++ Core Guidelines are a collaborative effort led by
Bjarne Stroustrup, much like the C++ language itself.”
https://github.com/isocpp/CppCoreGuidelines/blob/master/README.md
@pati_gallardo
11. SEI CERT C Coding Standard
“The SEI CERT C [and C++] Coding Standard is a software coding
standard for the C [and C++] programming language, developed
by the CERT Coordination Center to improve the safety,
reliability, and security of software systems.”
https://en.wikipedia.org/wiki/CERT_C_Coding_Standard
@pati_gallardo
12. CWE : Common Weakness Enumeration (1572 pages!)
@pati_gallardo
13. Common Weakness Enumeration (CWE)
“The Common Weakness Enumeration (CWE) is a category system
for software weaknesses and vulnerabilities. It is sustained
by a community project with the goals of understanding flaws
in software and creating automated tools that can be used to
identify, fix, and prevent those flaws.”
https://en.wikipedia.org/wiki/Common_Weakness_Enumeration
@pati_gallardo
14. What specs exist?
Undefined Behavior
Compiler Optimizations
Exploitability
Take your vitamins
The Eight I'd Really Rather You Didn'ts
@pati_gallardo
16. undefined behavior
“Examples of undefined behavior are memory accesses outside of array bounds, signed
integer overflow, null pointer dereference, modification of the same scalar more than
once in an expression without sequence points, access to an object through a pointer of a
different type, etc. Compilers are not required to diagnose undefined behavior (although
many simple situations are diagnosed), and the compiled program is not required to do
anything meaningful.”
http://en.cppreference.com/w/cpp/language/ub
@pati_gallardo
17. - Don’t reason about undefined
behaviour
- Assume that it crashes or is
never executed
- Changing compiler, compiler
version or optimization level
can break your application
Undefined Behaviour
18. Infinite Loop (Undefined Behavior)
#include <iostream>
#include <complex>
using namespace std;
int main(void) {
complex<int> delta;
complex<int> mc[4] = {0};
for(int di = 0; di < 4; di++, delta = mc[di]) {
cout << di << endl;
}
}
@pati_gallardo
(Thanks to @shafikyaghmour) https://stackoverflow.com/questions/32506643/c-compilation-bug
Undefined
Behavior!
19. Infinite Loop (Undefined Behavior)
Should we Godbolt this?
https://godbolt.org/g/TDjM8h
@pati_gallardo
(Thanks to @shafikyaghmour) https://stackoverflow.com/questions/32506643/c-compilation-bug
20. What specs exist?
Undefined Behavior
Compiler Optimizations
Exploitability
Take your vitamins
The Eight I'd Really Rather You Didn'ts
@pati_gallardo
23. 0) CWE-14: Compiler Removal of Code to Clear Buffers
void GetData(char *MFAddr) {
char pwd[64];
if (GetPasswordFromUser(pwd, sizeof(pwd))) {
if (ConnectToMainframe(MFAddr, pwd)) {
// Interaction with mainframe
}
}
memset(pwd, 0, sizeof(pwd)); // <- Removed by the optimizer
}
@pati_gallardo
SEI: MSC06-C. Beware of compiler optimizations
SEI: MEM03-C. Clear sensitive information stored in reusable resources
24. 0) CWE-14: Compiler Removal of Code to Clear Buffers
Should we Godbolt this?
https://godbolt.org/g/FpEsht
@pati_gallardo
SEI: MSC06-C. Beware of compiler optimizations
SEI: MEM03-C. Clear sensitive information stored in reusable resources
25. Memset_s : Zeroing Memory
// Compliant Solution (C11)
memset_s(pwd, 0, sizeof(pwd));
// Windows Solution
SecureZeroMemory(pwd, sizeof(pwd));
@pati_gallardo
SEI: MSC06-C. Beware of compiler optimizations
SEI: MEM03-C. Clear sensitive information stored in reusable resources
26. What specs exist?
Undefined Behavior
Compiler Optimizations
Exploitability
Take your vitamins
The Eight I'd Really Rather You Didn'ts
@pati_gallardo
28. 1. Unsigned Integer Wraparound
2. Signed Integer Overflow
3. Numeric Truncation
4. Stack Buffer Overflow
5. Heap Buffer Overflow
6. Buffer Underflow
7. Use After Free
8. Double Free
9. Incorrect Type Conversion
10. Uncontrolled Format String
@pati_gallardo
29. Code is on GitHub:
https://github.com/patricia-gallardo/insecure-coding-examples
Disclaimer:
The concat buffer examples aren’t really fair because if you
did concatenation of strings in this way you would have to
take into consideration 0 termination of strings and that
doesn’t fit on a slide, so... sigh
@pati_gallardo
31. 1) CWE-190: Unsigned Integer Wraparound
int main(void) {
unsigned int first_len = UINT_MAX;
unsigned int second_len = 256;
unsigned int buf_len = 256;
char first[first_len], second[second_len], buf[buf_len];
if((first_len + second_len) <= 256) { // <- sum == 255
memcpy(buf, first, first_len);
memcpy(buf + first_len, second, second_len);
}
}
@pati_gallardo
SEI-INT30-C. Ensure that unsigned integer operations do not wrap
32. 2) CWE-190: Signed Integer Overflow
int main(void) {
int first_len = INT_MAX;
int second_len = 256;
int buf_len = 256;
char first[first_len], second[second_len], buf[buf_len];
if((first_len + second_len) <= 256) { // <- UB (negative)
memcpy(buf, first, first_len);
memcpy(buf + first_len, second, second_len);
}
}
@pati_gallardo
SEI-INT32-C. Ensure that operations on signed integers do not result in
33. 3) CWE-197: Numeric Truncation Error
int main(void) {
unsigned int first_len = UINT_MAX - 256;
unsigned int second_len = 256;
unsigned int buf_len = 256;
char first[first_len], second[second_len], buf[buf_len];
int new_len = (first_len+second_len); // <- IDB (negative)
if(new_len <= 256) {
memcpy(buf, first, first_len);
memcpy(buf + first_len, second, second_len);
}
}
@pati_gallardo
SEI-INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data
35. 4) CWE-121: Stack-based Buffer Overflow
@pati_gallardo
int main(void) {
char buffer[10];
// CWE-242 : Inherently Dangerous Function
gets(buffer); // <- Write outside
}
SEI-STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator
36. 5) CWE-122: Heap-based Buffer Overflow
int main(int argc, char * argv[]) {
char* buf = (char*) malloc(sizeof(char)*10);
strcpy(buf, argv[1]); // <- Write outside
free(buf);
}
@pati_gallardo
SEI-ARR38-C. Guarantee that library functions do not form invalid pointers
37. 6) CWE-124: Buffer Underwrite / Underflow
int main(void) {
char src[12];
strcpy(src, "Hello World");
size_t length = strlen(src);
int index = (length -1);
while (src[index] != ':') {
src[index] = '0';
index--;
}
}
@pati_gallardo
SEI-ARR30-C. Do not form or use out-of-bounds pointers or array subscripts
39. 7) CWE-416: Use After Free
@pati_gallardo
int main(void) {
char* buffer = (char*)malloc (256);
bool error = true;
if (error)
free(buffer);
// [...]
if (error)
printf("%lun", strlen(buffer)); //<- Use after free
}
SEI-MEM30-C. Do not access freed memory
42. 9) CWE-704: Incorrect Type Conversion/Cast
@pati_gallardo
struct A {};
struct B {};
int main(void) {
struct A * a = (struct A *) malloc (sizeof (struct A));
struct B * b = (struct B *) a; // cast to unrelated type
}
SEI-EXP05-CPP. Do not use C-style casts
43. 10) CWE-134: Use of External Format String
@pati_gallardo
int main(int argc, char * argv[]) {
char * format = argv[1];
char * str = argv[2];
printf(format, str);
}
$ ./format_string "%s %d" "Hello World"
Hello World 1745066888
SEI-FIO47-C. Use valid format strings
44. What specs exist?
Undefined Behavior
Compiler Optimizations
Exploitability
Take your vitamins
The Eight I'd Really Rather You Didn'ts
@pati_gallardo
47. What specs exist?
Undefined Behavior
Compiler Optimizations
Exploitability
Take your vitamins
The Eight I'd Really Rather You Didn'ts
@pati_gallardo
48. The Eight I'd Really Rather You Didn'ts*
*The Eight Condiments (Pastafarianism)
@pati_gallardo
49. Caution: Don’t take me too
seriously. But seriously, think
about it! *wink*
@pati_gallardo
50. The Eight I'd Really
Rather You Didn'ts
1. Use C
2. Allocate with new
3. Do math a lot
4. Trust your external input
5. Use pointers a lot
6. Write “clever” code
7. Use shared_ptr a lot
8. Use share state a lot
@pati_gallardo
51. 1. I'd Really Rather You Didn't:
Use C
@pati_gallardo
CG : CPL.1: Prefer C++ to C
52. Std::string - Concatenate Strings
int main() {
std::string first = "Hello ";
std::string second = "World";
std::string buffer = first + second;
std::cout << buffer << "n";
}
@pati_gallardo
53. Std::cout/cin : Using the Command Line
int main(int argc, char * argv[]) {
std::string second;
std::cin >> second;
std::string first = argv[1];
std::string buffer = first + second;
std::cout << buffer << "n";
}
$ ./command_line "Hello "
World
Hello World
@pati_gallardo
54. Algorithms : Strip after Colon
int main() {
string str = "Hello:World";
auto isColon = [](int ch) { return ch == ':'; };
auto first = find_if(rbegin(str), rend(str), isColon);
str.erase(first.base(), end(str));
}
@pati_gallardo
55. C++ Casts : Safe Downcasting
class Spiderman {};
class Ironman {};
int main() {
Spiderman * peter = new Spiderman;
Ironman * tony = static_cast<Ironman*>(peter);
}
inheritance.cpp:6:20: error: static_cast from 'Spiderman *'
to 'Ironman *', which are not related by inheritance, is not allowed
Ironman * tony = static_cast<Ironman*>(peter);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
@pati_gallardo
56. @pati_gallardo
CG : R: Resource management
CG : R.11: Avoid calling new
and delete explicitly
2. I'd Really Rather You Didn't:
Allocate With New
57. Allocating on the Stack
#include "Hero.h"
int main()
{
Hero h;
}
@pati_gallardo
58. Where is it?
Stack
Hero stackHero;
Heap
unique_ptr<Hero> heapHero =
make_unique<Hero>();
Hero * heapHero = new Hero();
@pati_gallardo
59. Loving the Stack
#include <iostream>
#include <string>
using namespace std;
int main()
{
{
string s("Hello World!");
cout << s;
} // <- GC happens here!
}
@pati_gallardo
60. Using the Stack To Manage Resource Lifetimes
Destroyed when exiting scope
Deterministic Garbage Collection
@pati_gallardo
61. Hold a Value on the Stack that
Controls The Lifetime of Your Heap
Allocated Object
using namespace std;
{
unique_ptr<Hero> myHero =
make_unique<Hero>();
shared_ptr<Hero> ourHero =
make_shared<Hero>();
}
Smart Pointers
@pati_gallardo
63. Primitive types have no semantics, only limits
Reduce the value space
Keep it within defined behavior
Enum class, string literals, user defined
literals, size_t
@pati_gallardo
64. Enum Class
@pati_gallardo
enum class Direction : char
{ NORTH = 'N', EAST = 'E', WEST = 'W', SOUTH = 'S' };
std::ostream& operator << (std::ostream& os, const Direction& obj) {
os << static_cast<std::underlying_type<Direction>::type>(obj);
return os;
}
int main() {
std::cout << "t" << Direction::NORTH << "n"
<< "t" << Direction::EAST << "n"
<< "t" << Direction::WEST << "n"
<< "t" << Direction::SOUTH << "n";
}
66. 1) User Defined Literals
@pati_gallardo
int main() {
auto h = 24_hours;
auto d = 7_days;
auto err = h + d;
}
user_defined_literals.cpp:25:21: error: invalid operands to
binary expression ('Hours' and 'Days')
auto err = hours + days;
~~~~~ ^ ~~~~
1 error generated.
67. 2) User Defined Literals
@pati_gallardo
struct Hours {
explicit Hours(unsigned long long n) : num(n) {}
unsigned long long num = 0;
};
struct Days {
explicit Days(unsigned long long n) : num(n) {}
unsigned long long num = 0;
};
68. 3) User Defined Literals
@pati_gallardo
Hours operator "" _hours(unsigned long long num) {
return Hours(num);
}
Days operator "" _days(unsigned long long num) {
return Days(num);
}
69. Use Size_t for Sizes
- Unsigned integer type
- Result of the sizeof
operator
- Use for object sizes
- Use for array indexing and
loop counting
@pati_gallardo