Common Exploitable Software Source Code Errors
Common exploitable source code errors often arise from poor input validation, insecure coding practices, and inadequate error handling during development.
3 slides · 1 min read · Domain 8
Many factors, whether singly or in combination, can allow common exploitable errors to be built into source code, whether by its creators or by maintenance programmers later on.
Inexperienced programmers often have not developed the skills of writing clean, errorfree code, or, more importantly, reading source code created by others. Experience with writing and reading source code develops a programmer's ability to verify that a code snippet, module, or whole procedure or object from a library (or downloaded from elsewhere):
These errors can be triggered by accident or by means of deliberate action. Even in the case of deliberate action, the error behavior is only an attack if it was done maliciously, and not during security assessment or software testing.
- Will correctly perform what they need to get done.
- Does not replicate or contain known patterns of errors.
- Does not contain code that performs other functions, which might include a "trapdoor" or other means of providing an exploitable transfer of control opportunity.
- Will run efficiently, and thus not deny system or data resources to other user tasks.
- Meets or exceeds other organizational security requirements.