So what if you could not use typeset languages?
You could not use languages like Java or
others that do this checking to prevent all memory overflow kind of attacks.
What can we do in that case if you're stuck with let's say languages for
whatever reason, we talked about a few, where this is not done automatically,
what should we be doing?
So when we are using these so
called unsafe languages that automatically don't prevent buffer
overflows then it become the responsibility of the programmer.
If you're writing code it is your responsibility
that you deal with this problem of potential buffer overflows.
One way you can do that is by checking ALL input, okay?
So secure coding mantra is that trust no input.
All input is evil and you should be checking
that it can conforms to whatever your expectation was.
Don't rely on the underlying system to do those because we're talking about
using languages that do not do automatically.
So secure coding is an extremely as you write programs.
You write them to implement certain functionality.
You may even write them with some performance goals in mind, but
at the same time you need to keep in mind that you have to write them so
they cannot be exploited.
You have to code securely or use secure coding practices so your
program doesn't have the vulnerabilities like the ones we've been talking about.
And one way you do that is by checking ALL input.
The other thing that you can do is,
you can use functions that are safer that do bound checking.
So remember in the code we could have string compare or string copy.
You could also have certain side string,
though you shouldn't be dealing with a string that is longer than that.
So their functions that would place a limit on the length of the string this
function would manipulate.
So you can use there number of safer ways to use certain functions
that are unsafe and the patterns and ways of using those that
are safer where the likelihood of a vulnerability is a lot lower.
So these functions, all though the language doesn't do it, the functions
that you do will do the checking or the bounds checking that we're talking
about, and as a result using those leads to code that is safer more secure.
And the last thing you can do after written some code that's not in
a typeset language, is to use tools that exist that would actually
analyze code that you have written and flag potential vulnerability.
The way they able to do that is, they can look for certain code patterns.
They can look for certain unsafe functions, and
can warn you that the code fragment that you have where these things appear,
an unsafe function appears, could be potentially
vulnerable to some sort of exploit buffer overflow or something like that.
So these tools, you just run your code through these tools and
there's a lot of them that are out there.
Some commercial, some you can get for free.
And these tools they rely on sort of database
of certain kind of patterns that are known to be unsafe.
And if they run into your code that matches those kind of patterns,
they can flag those.
And they can do more sophisticated analysis to potentially discover
the kind of vulnerability that we're talking about.
So there's no excuse for writing code that is not secure.
You should be checking your input.
You should be using safer functions that do that checking automatically.
And then you should run through your coded through these tools
that can flag potential problem spots.
And you should go back and look at that and
see how you can actually make those potential vulnerabilities go away.
One problem with automatic tools is that they may have a lot of
false positives or if they miss out and they have false negatives.
So you can't have tools that will have zero false positives or false negatives,
but the tools can certainly help us get rid of many possible
vulnerabilities in the process producing code that is a lot more secure.
So even when you are stuck with programming in a language that's not
going to help you much with the kind of attacks, vulnerabilities that we've been
talking about, there's certainly things you can do as a programmer who likes to
do secure programming by checking input, using safer functions, and
then running, checking your code through these tools that we're talking about.
And we'll have a long list of these tools actually you can go and
learn about.