software security - static analysis tools

Software Security

Presented byEmanuela Boroș

“Al. I. Cuza” University, Faculty of Computer ScienceMaster of Software Engineering, II

Static analysis tools

1. What is Static Analysis?

2. Static Analysis Advantages

3. Static Analysis Tools for C/C++, Java

4. Samples

What is Static Analysis?

What is Static Analysis?

● performed without actually executing or running that software

● performed by an automated tool

Static Analysis Advantages

Static Analysis Advantages

● improve the quality and reliability of embedded systems software

● significant reductions in development testing and field failures

● careful when large amount of code is used in the development projects

Static Analysis Advantages

● can detect

● buffer overflows, ● security vulnerabilities, ● memory leaks, ● timing anomalies (such as race conditions, deadlocks, and livelocks),

● dead or unused source code segments, ● and other common programming mistakes

Static Analysis Tools

Software Tool Domain Responsible Party Languages Platforms

CodeSonar Commercial Grammatech C, C++ Windows

Coverity Commercial Coverty, Inc. C, C++ Windows

CodeSurfer Commercial Grammatech C, C++ Windows

FlawFinder GPL David A. Wheeler C, C++ UNIX

ITS4 Commercial Cigital C, C++ Linux, Solaris, Windows

Java PathFinder Academic NASA Ames Java Any JVM compatible platform

JLint Academic Konstantin KnizhnikCyrille Arthro

Java Any JVM compatible platform

PREfix and PREfast

Commercial Microsoft C, C++, C# Windows

RATS Academic Secure Software C, C++ Windows, Unix

Splint Academic University of Virginia,Department of Computer Science

C Windows, Unix,Linux

C/C++

rats-2.3

● Rough Auditing Tool for Security

● open source tool

● C, C++, Perl, PHP and Python source code

● rough analysis of source code

● manual inspection of the code is still necessary, but greatly aided with this tool

rats-2.3

● error messages controlled by XML reporting filters(requires the XML tool expat to also be installed)

● configure the level of output

● alternative vulnerability databases

● buffer overflows and TOCTOU (Time Of Check, Time Of Use) race conditions

rats-2.3

● extremely simple

● scans through a file (lexically) looking for syntactic matches based on several simple rules that might indicate possible security vulnerabilities

● “use of strcpy() should be avoided”

rats-2.3

● the use of greedy pattern matchings

● "printf" will match not only "print()" calls but also "vsnprintf()"

● authors of RATS and Flawfinder, by the way, plan to coordinate their development efforts to produce a high quality, open-source development tool

Usage

rats [-d ] [-h] [-r] [-w ] [-x] [file1 file2 ... filen]

Options explained:

-d Specifies a vulnerability database to be loaded. You may have multiple -d options and each database specified will be loaded.

-h Displays a brief usage summary

-i Causes a list of function calls that were used which accept external input to be produced at the end of the vulnerability report.

-l Force the specified language to be used regardless of filename extension. Currently valid language names are "c", "perl", "php" and "python".

-r Causes references to vulnerable function calls that are not being used as calls themselves to be reported.

-w Sets the warning level. Valid levels are 1, 2 or 3. Warning level 1 includes only default and high severity Level 2 includes medium severity. Level 2 is the default warning level 3 includes low severity vulnerabilities.

-x Causes the default vulnerability databases to not be loaded.

Samples

Issue: fixed size global buffer Severity: High

Extra care should be taken to ensure that character arrays that are allocated on the stack are used safely. They are prime targets for buffer overflow attacks.

int main(int argc, char *argv[]){ char dir[1024]; char cmd[1200]; char buff[1024];...

Issue: sprintf Severity: High

Check to be sure that the format string passed as argument 2 to this function call does not come from an untrusted source that could have added formatting characters that the code is not prepared to handle. Additionally, the format string could contain `%s' without precision that could result in a buffer overflow.

if (getenv("HOME") != NULL) {sprintf(dir, "%s", getenv("HOME"));

}...

Samples

Issue: strcpy Severity: High

Check to be sure that argument 2 passed to this function call will not copy more data than can be handled, resulting in a buffer overflow.

if (argc == 2){

strcpy(dir, argv[1]);}

Caveats

● the lack of any preprocessing, so no macros or definitions are expanded

#define p(x) printf ## x char *string1, *string2; /* stuff happens ... */ p((string1)); /* insecure! */ p((string2)); /* insecure! */ p(("%s", string1)); /* correct! */

● produces only one error in the definition but not in the use of the macro

● insecure calls can be made multiple times, which will go unnoticed by the code scanner

Conclusions

● source code scanners can help improve the state of your code in development or afterwards

● these are tools help assist you in the auditing process, not automate it