Spotting the Sin During Code Review

Heres how we suggest you look for this problem in code:

  1. Identify network communication points where basic network protection is a requirement (any sort of authentication and ongoing integrity as well as confidentiality, if its important to your system).

  2. If theres no protection, thats clearly bad.

  3. For each of those points, determine whether session connections use a protocol for authentication at all. If not, thats not so good.

  4. Check to see if the authentication protocol results in a key by looking at the protocol outputs. If it doesnt, then check to ensure that the protocol is authenticating the data from the key exchange, and that it checks the actual unique identities of the participants in a nonforgeable way. Unfortunately, this can be really difficult for the average developer to do, and is best left to a cryptographer.

  5. If there is an exchanged key, look to see whether it is used as the foundation for ongoing link protection. If the exchanged key isnt used, there is the threat of a local hijacking attack.

  6. Ensure that the authentication messages cannot be spoofed. Particularly, if public key digital signatures are being used to authenticate, make sure that the public identity of the other side is actually trustworthy. Usually this involves having a static list of known identities, or using a Public Key Infrastructure (PKI) plus validating all relevant data in a certificate. See Sin 10 for far more detail on this one.

  7. If authentication can be attacked, look to see if its only the first successful login, or whether its true for future logins. If an initial authentication can be attacked , but subsequent authentications cannot be, then the auditor should deem the system far less worrisome than if a man-in-the-middle can be performed for any connection. This generally involves remembering the credential for a given host, and then subsequently ensuring the credential is there when connecting to that host.



19 Deadly Sins of Software Security. Programming Flaws and How to Fix Them
Writing Secure Code
ISBN: 71626751
EAN: 2147483647
Year: 2003
Pages: 239

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net