RE: automated vulnerability testing

["Bill Royds" <full-disclosure () royds net>]

You must be god since you can code perfectly without ever making a mistake.
Once you have a substantial application to write, C makes it very hard to
ensure that it is secure (C++ is even worse). A vulnerability testing
application for C must look at the whole system to check because interface
declarations are textual (#include) rather than part of the language (as in
Delphi or Eiffel). There is no enforcement of types between caller and
callee in functions, no enforcement of string length etc.  So all of these
must be done by the programmer rather than the compiler which means that
your programmer must be perfect to guarantee security. C is best used for
low level programming where one needs to be close to the hardware
(programming in the small). It is not good for large applications where
modularity and flexibility are more important ( programming in the large).

Sure, it is possible to write secure Application in C, but the language, by
its very power, makes it much harder than using others (like Cyclone, a
secure dialect of C). 
You said:
> > It is security unfriendly by design.
> C is designed to allow the programmer a high level of functionality and
> freedom.  If he/she is laisez-faire in his/her coding practices, that is
an
> issue with the programmer, not the language.

  Good C coding practices can still allow security flaws. The OpenBSD
project tries to use as secure coding practise as possible with C. Yet there
still are some security problems found in OpenBSD, OpenSSH etc. The C
philosophy is to allow the programmer freedom to implement code to optimize
machine cycles. But that very freedom means that each programmer can
implement code in ways that are not compatible with the code others produce
in subtle ways that often lead to security flaws. C is very limited in its
constructs. It does not have true arrays (the C array notation is only an
alias for pointers). It does not have strong typing (typedef is only a
syntax alias for struct). It does not have good memory management (C only
has malloc/free which are not inherent parts of language so compiler can't
check pointer referencing). It does allow you to get close to the machine.
   But getting close to the machine is not what one wants when writing a
cross platform user application. 


-----Original Message-----
From: full-disclosure-admin () lists netsys com
[mailto:full-disclosure-admin () lists netsys com] On Behalf Of Choe.Sung Cont.
PACAF CSS/SCHP
Sent: November 29, 2003 5:48 AM
To: 'full-disclosure () lists netsys com'
Subject: [Full-disclosure] automated vulnerability testing 

Bill Royds wrote:
> If you are truly interested in security, you won't use C as the
programming
> language. 
You must be shitting me..  C does have its inherent flaws but that doesn't
mean that there cannot be a secure application written in C.  This statement
represents FUD at its highest level.

> It is security unfriendly by design.
C is designed to allow the programmer a high level of functionality and
freedom.  If he/she is laize-faire in his/her coding practices, that is an
issue with the programmer, not the language.

V/r,
Sung J. Choe
PACAF CSS/SCHP, PACAF NOSC
Information Assurance Analyst
DSN: 315-449-4317, Comm: 808-449-4317
 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html