Better Do What They Told Ya

Presented by:

Software Development:You Better Do What They Told Ya

Ulisses Albuquerqueualbuquerque@trustwave.com

$ whois urma

• Ulisses Albuquerque– App Security Consultant for Trustwave

SpiderLabs• Penetration testing• Code reviews• Secure development training

– Passionate and opinionated developer• Ruby and C FTW

– Long time F/LOSS advocate• It’s all about the community

Who is SpiderLabs?SpiderLabs is the elite security team at Trustwave, offering clients the most advanced information security expertise and intelligence available today.

The SpiderLabs team has performed more than 1,500 computer incident response and forensic investigations globally, as well as over 15,000 penetration and application security tests for Trustwave’s clients.

The global team actively provides threat intelligence to both Trustwave and growing numbers of organizations from Fortune 50 to enterprises and start-ups.

Companies and organizations in more than 50 countries rely on the SpiderLabs team’s technical expertise to identify and anticipate cyber security attacks before they happen.

Featured Speakers at:

Featured Media:

Agenda

• Motivation• Non-Functional Requirements• Who You Gonna Call?• Official Documentation• What Can We Do About It?• Conclusion

Motivation

Really, b*tch?

http://seclists.org/fulldisclosure/2013/Apr/173

Meanwhile, on [full-disclosure]…

Motivation

http://memegenerator.net/instance/37406597

Motivation

• Are developers really at fault?• Do we (ahem, them) really suck this much?• Do we have an attitude problem between

developers and security people in the software industry?• Obviously not, developers SUCK, right?

Non-Functional Requirements

• Implicit expectations about the software• It should be fast• It should not crash• It should be user-friendly• It should be secure

…and that’s assuming you know what you should be

doing!

Who You Gonna Call?

Software

Concepts

Business Needs Constraints

Craftmanship

Who You Gonna Call?

• How to fill the concept-to-code knowledge gap?

• Google can help• Stack Overflow can help a lot

• But… There’s more than one way to do it™

http://www.spidereyeballs.com/os5/perl/small_os5_r23_1542.html

Who You Gonna Call?

• Official documentation should be the most trustworthy source of information

• We don’t want to know just any “how to do it”• We want to know “how to do it in a secure way”

http://www.themahoganyblog.com/2012/04/attention-music-imposter/laptop-thief/

<3 Stack Overflow!

How are vendors providing information on the security aspects

of their tools, APIs and frameworks?

Official Documentation

Official Documentation - Java

http://docs.oracle.com/javase/7/docs/api/java/io/File.html#toURL()

Official Documentation - Java

• Pros• Use of annotations to indicate deprecated APIs

• Compiler warnings

• Clear indication of reason for deprecation• Security aspects mixed with functional description

• Cons• Deprecation is not a security-oriented feature

Official Documentation - .NET

http://msdn.microsoft.com/en-us/library/system.collections.caseinsensitivehashcodeprovider.aspx

Official Documentation - .NET

• Pros• Use of annotations to indicate deprecated APIs

• Compiler warnings

• Cons• No indication of reason for deprecation• Deprecation is not a security-oriented feature

• What about code samples?

http://msdn.microsoft.com/en-us/library/system.io.file.aspx

Race conditionin sample code?

• It’s not only about documentation in web pages

• manpages are very inconsistent in their presentation of security-relevant information

• Shame on us, F/LOSS developers

Sometimes it’s not just incompetence or laziness, but

intentionally harmful documentation

http://docs.oracle.com/cd/E13222_01/wls/docs81b/secintro/archtect.html#1033713

Are you f*ckingkidding me,Oracle?

What Can We Do About It?

• We = security professionals– Ignorance != incompetence– Assume developers are unaware of their

mistakes– Avoid confrontation

• Do proper secure SDLC and be involved in ALL stages of development– Help developers make the right choices instead

of just vetoing them– Easier said than done, unfortunately

• We = developers– Developers write tools for developers– Add consistent and comprehensive security

information to documentation– Help fellow developers make the right choices

• Deprecate what needs deprecation• Remove what is too dangerous

Conclusion

• Developers need training– Obviously

• Vendor documentation MUST improve– Even trained developers need context to guide

their choices

• Developers are easy targets after a breach– Their work takes months or years, breaches

happen in the blink of an eye

Conclusion

• MOAR ACCOUNTABILITY! MOAR RESOURCES!– Train your teams– Assess your results and ACT on them

• Security people need to position themselves as facilitators rather than opponents– Who enjoys having their work vetoed after

months working on it?

Questions?

Trustwave SpiderLabsSpiderLabs is an elite team of ethical hackers at Trustwave advancing the security capabilities of leading businesses and organizations throughout the world.

More Information:

Web: https://www.trustwave.com/spiderlabs

Blog: http://blog.spiderlabs.com

Twitter: @SpiderLabs

Better Do What They Told Ya

Technology

Transcript of Better Do What They Told Ya

PARTENTI - puntosnaimarche.it · dorun beam ya 5 douce gergauderie ya 3 douchka d'ormoy ya 3 douxor de guez ya 5 downing street ya 3 duc d'occagnes ya 5 duchesse danica ya 3 dynamite

Much Ado About Nothing William Shakespeare, likely written 1598 Told through Caught Ya sentences.

ELEPHANT CHAIN HOIST COUNTRY OF ORIGIN : JAPAN · 'Dimensions 1. 91 91 99 104 104 Model YA-80 YA-100 YA-160 YA-320 YA-630 YA-900 53 53 63 82.5 82.5 82.5 122 122 136 180 235 300 36

SHERIA YA USIMAMIZI WA MAZINGIRA YA MWAKA 2004 (NA.20 … · SHERIA YA USIMAMIZI WA MAZINGIRA YA MWAKA 2004 YALIYOMO Fungu Jina SEHEMU YA I MASHARTI YA UTANGULIZI 1. Jina. 2. ...

Mtakuja Development Project - FT KilimanjaroFT Kilimanjaro · Rasimu ya katiba - Rasimu ya katiba ya chama ilitolewa. VICOBA – Vikundi saba vya benki ya vijiji ya jamii viliundwa

TOLD OS · TOLD OS ... told os

CASIO Interactive Whiteboard YA-W72M/YA-W82Msupport.casio.com/.../pdf/...UsersGuide_English_EN.pdf · CASIO Interactive Whiteboard YA-W72M/YA-W82M ... To connect a Bluetooth adapter

09UZIMA YA MARTIN LUTHER NA FUNDISHO YA UONGO YAKE

ARTICULATED ROBOTS YA - Yamaha Motor CompanyYA SERIES MANIPULATOR SPECIFICATIONS 6-axis 7-axis Applications Handling (general) Assembly / Placement YA-RJ YA-R3F YA-R5F YA-R5LF YA-R6F

Hali ya Kutatanisha ya Kiswahili hivi Leo Afrika Mashariki

- What's Going On - Marvin Gaye - pwop.coms... · go - in' on What's go - in' on Yeah,what's go - in' on Ah, what's C 24 go - in' on Ah, na ha ha ha D 27 Ay ya ya ya ya ya ya ya ya

Hummus. Ya Ya Wong of Nelssie Flores

TM Strategic Growth Forum Africa 2015 TM - Ernst & … Growth Forum Africa 2015 Accelerating progress A better story, told better TM About the Strategic Growth Forum The EY Strategic

YA-2 YA-3 YA-5 YA-6 YA-9 YA-13 YA-19 YA-26 YA-30 AXZUBAW ...

Architecture A4383 . Gumbo Ya-Ya . Spring 2018

Sheria Ya Marekebisho Ya Katiba

Jutchy Ya Ya #43

Jutchy Ya Ya 47

Jutchy Ya Ya 38

Mahafali ya Kwanza ya Chuo Kikuu cha Ushirika Moshi