Software Security - Static Analysis Tools
-
Upload
emanuela-boro -
Category
Technology
-
view
771 -
download
3
description
Transcript of Software Security - Static Analysis Tools
Software Security
Presented byEmanuela Boroș
“Al. I. Cuza” University, Faculty of Computer ScienceMaster of Software Engineering, II
Static analysis tools
1. What is Static Analysis?
2. Static Analysis Advantages
3. Static Analysis Tools for C/C++, Java
4. Samples
What is Static Analysis?
What is Static Analysis?
● performed without actually executing or running that software
● performed by an automated tool
Static Analysis Advantages
Static Analysis Advantages
● improve the quality and reliability of embedded systems software
● significant reductions in development testing and field failures
● careful when large amount of code is used in the development projects
Static Analysis Advantages
● can detect
● buffer overflows, ● security vulnerabilities, ● memory leaks, ● timing anomalies (such as race conditions, deadlocks, and livelocks),
● dead or unused source code segments, ● and other common programming mistakes
Static Analysis Tools
Software Tool Domain Responsible Party Languages Platforms
CodeSonar Commercial Grammatech C, C++ Windows
Coverity Commercial Coverty, Inc. C, C++ Windows
CodeSurfer Commercial Grammatech C, C++ Windows
FlawFinder GPL David A. Wheeler C, C++ UNIX
ITS4 Commercial Cigital C, C++ Linux, Solaris, Windows
Java PathFinder Academic NASA Ames Java Any JVM compatible platform
JLint Academic Konstantin KnizhnikCyrille Arthro
Java Any JVM compatible platform
PREfix and PREfast
Commercial Microsoft C, C++, C# Windows
RATS Academic Secure Software C, C++ Windows, Unix
Splint Academic University of Virginia,Department of Computer Science
C Windows, Unix,Linux
C/C++
rats-2.3
● Rough Auditing Tool for Security
● open source tool
● C, C++, Perl, PHP and Python source code
● rough analysis of source code
● manual inspection of the code is still necessary, but greatly aided with this tool
rats-2.3
● error messages controlled by XML reporting filters(requires the XML tool expat to also be installed)
● configure the level of output
● alternative vulnerability databases
● buffer overflows and TOCTOU (Time Of Check, Time Of Use) race conditions
rats-2.3
● extremely simple
● scans through a file (lexically) looking for syntactic matches based on several simple rules that might indicate possible security vulnerabilities
● “use of strcpy() should be avoided”
rats-2.3
● the use of greedy pattern matchings
● "printf" will match not only "print()" calls but also "vsnprintf()"
● authors of RATS and Flawfinder, by the way, plan to coordinate their development efforts to produce a high quality, open-source development tool
Usage
rats [-d ] [-h] [-r] [-w ] [-x] [file1 file2 ... filen]
Options explained:
-d Specifies a vulnerability database to be loaded. You may have multiple -d options and each database specified will be loaded.
-h Displays a brief usage summary
-i Causes a list of function calls that were used which accept external input to be produced at the end of the vulnerability report.
-l Force the specified language to be used regardless of filename extension. Currently valid language names are "c", "perl", "php" and "python".
-r Causes references to vulnerable function calls that are not being used as calls themselves to be reported.
-w Sets the warning level. Valid levels are 1, 2 or 3. Warning level 1 includes only default and high severity Level 2 includes medium severity. Level 2 is the default warning level 3 includes low severity vulnerabilities.
-x Causes the default vulnerability databases to not be loaded.
Samples
Issue: fixed size global buffer Severity: High
Extra care should be taken to ensure that character arrays that are allocated on the stack are used safely. They are prime targets for buffer overflow attacks.
int main(int argc, char *argv[]){ char dir[1024]; char cmd[1200]; char buff[1024];...
Issue: sprintf Severity: High
Check to be sure that the format string passed as argument 2 to this function call does not come from an untrusted source that could have added formatting characters that the code is not prepared to handle. Additionally, the format string could contain `%s' without precision that could result in a buffer overflow.
if (getenv("HOME") != NULL) {sprintf(dir, "%s", getenv("HOME"));
}...
Samples
Issue: strcpy Severity: High
Check to be sure that argument 2 passed to this function call will not copy more data than can be handled, resulting in a buffer overflow.
if (argc == 2){
strcpy(dir, argv[1]);}
Caveats
● the lack of any preprocessing, so no macros or definitions are expanded
#define p(x) printf ## x char *string1, *string2; /* stuff happens ... */ p((string1)); /* insecure! */ p((string2)); /* insecure! */ p(("%s", string1)); /* correct! */
● produces only one error in the definition but not in the use of the macro
● insecure calls can be made multiple times, which will go unnoticed by the code scanner
Conclusions
● source code scanners can help improve the state of your code in development or afterwards
● these are tools help assist you in the auditing process, not automate it