Date post: | 29-Nov-2014 |
Category: |
Engineering |
Upload: | globallogic-ukraine |
View: | 379 times |
Download: | 2 times |
Security vulnerabilities
Heartbleed & Buffer overflow
By Nazar Mota
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
AgendaØ Heartbleed
Ø Buffer overflow
Ø Q&A
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
Heartbleed
© 2014 GlobalLogic Inc.
Heartbleed● Is called one of the biggest security threats the Internet has ever seen. ● Described as catastrophic by experts: 'On the scale of 1 to 10, this is an 11'.● Since 1.03.2012(!) - 7.04.2014● Reveal up to 64k of memory to a connected client or server● Allows stealing the information protected, under normal conditions
© 2014 GlobalLogic Inc.
Impacts
● 1/3 of Internet (According to the Internet security company Netcraft, around 500,000 sites)● Dropbox, Google, Yahoo, Facebook, Istagram, Flickr, Youtube, Github● Online banking, VPN● IP phones, Routers, Medical devices, Smart TV sets, embedded devices and millions of other devices
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
Ø Heartbleed
Ø Buffer overflow
Ø Q&A
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
© 2014 GlobalLogic Inc.
C – Avoid (no bounds checks): strcpy(), strcat(), sprintf(), scanf()Use safer versions (with bounds checking): strncpy(), strncat(), fgets()Must pass the right buffer size to functions!C++: STL string class handles allocationUnlike compiled languages (C/C++), interpreted ones (Java/C#) enforce type safety, raise exceptions for buffer overflow
Safe String Libraries
Thank You
Q & A