Training SCADEMY

Training goals

code: CL-CTS | version: 1.0

To put it bluntly, writing C/C++ code can be a minefield for reasons ranging from memory management or dealing with legacy code to sharp deadlines and code maintainability. Yet, beyond all that, what if we told you that attackers were trying to break into your applications right now? How likely would they be to succeed?

After getting familiar with the common weaknesses and their consequences that can allow hackers to attack your system, participants learn about the general approach and the methodology for security testing, and the techniques that can be applied to reveal specific vulnerabilities. Security testing should start with information gathering about the system (ToC, i.e. Target of Evaluation), then a thorough threat modeling should reveal and rate all threats, arriving to the most appropriate risk analysis-driven test plan.

Security evaluations can happen at various steps of the SDLC, and so we discuss design review, code review, reconnaissance and information gathering about the system, testing the implementation and the testing and hardening the environment for secure deployment. Many different security testing techniques are introduced in details, like taint analysis and heuristics-based code review, static code analysis or fuzzing. Various types of tools are introduced that can be applied in order to automate security evaluation of software products, which is also supported by a number of exercises, where we execute these tools to analyze the already discussed vulnerable code.

This course prepares testers and QA staff to adequately plan and precisely execute security tests for applications written in C or C++, select and use the most appropriate tools and techniques to find even hidden security flaws, and thus gives essential practical skills that can be applied on the next day working day.

Having secure applications will give you a distinct edge over your competitors. It is your choice to be ahead of the pack – take a step and be a game-changer in the fight against cybercrime.

 Participants attending this course will:

  • Understand basic concepts of security, IT security and secure coding
  • Realize the severe consequences of unsecure buffer handling
  • Understand the architectural protection techniques and their weaknesses
  • Learn about typical coding mistakes and how to avoid them
  • Be informed about recent vulnerabilities in various platforms, frameworks and libraries
  • Learn about denial of service attacks and protections
  • Understand security testing approaches and methodologies
  • Get practical knowledge in using security testing techniques and tools
  • Learn how to set up and operate the deployment environment securely
  • Get sources and further readings on secure coding practices

Audience:

C and C++ developers testers

Conspect Show list

  1. IT security and secure coding
    • Nature of security
    • What is risk?
    • IT security vs. secure coding
    • From vulnerabilities to botnets and cybercrime
      • Nature of security flaws
      • Reasons of difficulty
      • From an infected computer to targeted attacks
  2. x86 machine code, memory layout and stack operations
    • Intel 80x86 Processors – main registers
    • Intel 80x86 Processors – most important instructions
    • Intel 80x86 Processors – flags
    • Intel 80x86 Processors – control instructions
    • Intel 80x86 Processors – stack handling and flow control
    • The memory address layout
    • The function calling mechanism in C/C++ on x86
    • Calling conventions
    • The local variables and the stack frame
    • Function calls – prologue and epilogue of a function
    • Stack frame of nested calls
    • Stack frame of recursive functions
  3. Buffer overflow
    • Stack overflow
      • Buffer overflow on the stack
      • Overwriting the return address
      • Exercises – introduction
      • Exercise BOFIntro
      • Exercise BOFShellcode
    • Protection against stack overflow
      • Specific protection methods
      • Protection methods at different layers
      • The protection matrix of software security
      • Stack overflow – Prevention (during development)
  4. Common coding errors and vulnerabilities
    • Time and state problems
      • Time and state related problems
      • Serialization errors
      • Exercise TOCTTOU
      • Best practices against TOCTTOU
  5. Code quality problems
    • Dangers arising from poor code quality
    • Poor code quality – spot the bug!
    • Unreleased resources
    • Type mismatch – Spot the bug!
    • Exercise TypeMismatch
    • Memory allocation problems
      • Smart pointers
      • Zero length allocation
      • Double free
      • Mixing delete and delete[]
  6. Common coding errors and vulnerabilities
    • Input validation
      • Input validation concepts
      • Integer problems
        • Representation of negative integers
        • Integer ranges
        • Integer overflow
        • Integer problems in C/C++
        • The integer promotion rule in C/C++
        • Arithmetic overflow – spot the bug!
        • Exercise IntOverflow
        • What is the value of abs(INT_MIN)?
        • Signedness bug – spot the bug!
        • Integer truncation – spot the bug!
        • Integer problem – best practices
        • Case study – Android Stagefright
      • Printf format string bug
        • Printf format strings
        • Printf format string bug – exploitation
        • Exercise Printf
        • Printf format string exploit – overwriting the return address
      • Printf format string problem – best practices
      • Some other input validation problems
        • Array indexing – spot the bug!
        • Off-by-one and other null termination errors
        • The Unicode bug
      • Log forging
        • Some other typical problems with log files
    • Improper use of security features
      • Typical problems related to the use of security features
      • Password management
        • Exercise – Weakness of hashed passwords
        • Password management and storage
        • Special purpose hash algorithms for password storage
        • Argon2 and PBKDF2 implementations in C/C++
        • bcrypt and scrypt implementations in C/C++
        • Password audit
        • Exercise – using John the Ripper
        • Case study – the Ashley Madison data breach
        • Typical mistakes in password management
        • Exercise – Hard coded passwords
      • Sensitive information in memory
        • Protecting secrets in memory
        • Sensitive info in memory - minimize the attack surface
        • Your secrets vs. dynamic memory
        • Zeroisation
        • Zeroisation vs. optimization – Spot the bug!
        • Copies of sensitive data on disk
        • Core dumps
        • Disabling core dumps
        • Swapping
        • Memory locking - preventing swapping
        • Problems with page locking
        • Best practices
  7. Denial of service
    • DoS introduction
    • Asymmetric DoS
    • Regular expression DoS (ReDoS)
      • Exercise ReDoS
      • ReDoS mitigation
      • Case study – ReDos in Stack Exchange
    • Hashtable collision attack
      • Using hashtables to store data
      • Hashtable collision
      • Hashtable collision in Java
  8. Security testing
    • Functional testing vs. security testing
    • Security vulnerabilities
    • Prioritization – risk analysis
    • Security assessments in various SDLC phases
    • Security testing methodology
      • Steps of test planning (risk analysis)
      • Scoping and information gathering
        • Stakeholders
        • Assets
        • Security objectives for testing
      • Threat modeling
        • Attacker profiles
        • Threat modeling
        • Threat modeling based on attack trees
        • Threat modeling based on misuse/abuse cases
        • Misuse/abuse cases – a simple example
        • SDL threat modeling
        • The STRIDE threat categories
        • Diagramming – elements of a DFD
        • Data flow diagram – example
        • Threat enumeration – mapping STRIDE to DFD elements
        • Risk analysis – classification of threats
        • The DREAD risk assessment model
      • Testing steps
        • Deriving test cases
        • Accomplishing the tests
        • Processing test results
        • Mitigation concepts
        • Standard mitigation techniques of MS SDL
        • Review phase
  9. Security testing techniques and tools
    • General testing approaches
    • Source code review
      • Code review for software security
      • Taint analysis
      • Heuristic-based
      • Static code analysis
        • Static code analysis
        • Exercise – Static code analysis using FlawFinder
    • Testing the implementation
      • Manual vs. automated security testing
      • Penetration testing
      • Stress tests
      • Binary and memory analysis
        • Exercise – Binary analysis with strings
      • Instrumentation libraries and frameworks
        • Exercise – Using Valgrind
      • Fuzzing
        • Automated security testing - fuzzing
        • Challenges of fuzzing
        • Exercise – Fuzzing with AFL (American Fuzzy Lop)
  10. Deployment environment
    • Assessing the environment
    • Configuration management
      • Configuration management
  11. Hardening
    • Hardening
    • Network-level hardening
    • Hardening the deployment – server administration
    • Hardening the deployment – access control
  12. Patch and vulnerability management
    • Patch management
    • Vulnerability repositories
    • Vulnerability attributes
    • Common Vulnerability Scoring System – CVSS
    • Vulnerability management software
  13. Principles of security and secure coding
    • Matt Bishop’s principles of robust programming
    • The security principles of Saltzer and Schroeder
  14. Knowledge sources
    • Secure coding sources – a starter kit
    • Vulnerability databases
    • Recommended books – C/C++
Download conspect training as PDF

Additional information

Requirements

General C/C++ development, QA and testing

Difficulty level
Duration 3 days
Certificate

The participants will obtain certificates signed by SCADEMY (course completion).

Trainer

Authorized SCADEMY Trainer

Additional informations

Training come with a number of easy-to-understand exercises providing live hacking fun. By accomplishing these exercises with the lead of the trainer, participants can analyze vulnerable code snippets and commit attacks against them in order to fully understand the root causes of certain security problems. All exercises are prepared in a plug-and-play manner by using a pre-set desktop virtual machine, which provides a uniform development environment.

SCADEMY together with online application security educational platform AVATAO (more about AVATAO www.avatao.com) for each of participant SCADEMYs authorized training adds the 30 days business AVATAO trial holds the following package:

  • 30-day customized free trial

Other training SCADEMY | C/C++

Training thematically related

Programming

IT Security

Contact form

Please fill form below to obtain more info about this training.







* Fields marked with (*) are required !!!

Information on data processing by Compendium - Centrum Edukacyjne Spółka z o.o.

1500 EUR

close

Discount codes

Discount code may refer to (training, producer, deadline). If you have a discount code, enter it in the appropriate field.
(green means entering the correct code | red means the code is incorrect)

FORM OF TRAINING ?

close

Traditional training

Sessions organised at Compendium CE are usually held in our locations in Kraków and Warsaw, but also in venues designated by the client. The group participating in training meets at a specific place and specific time with a coach and actively participates in laboratory sessions.

TRAINING MATERIALS ?

close

Paper materials

Traditional Materials: The price includes standard materials issued in the form of paper books, printed or other, depending on the arrangements with the manufacturer.

Electronic materials

Electronic Materials: These are electronic training materials that are available to you based on your specific application: Skillpipe, eVantage, etc., or as PDF documents.

Ctab materials

Ctab materials: the price includes ctab tablet and electronic training materials or traditional training materials and supplies provided electronically according to manufacturer's specifications (in PDF or EPUB form). The materials provided are adapted for display on ctab tablets. For more information, check out the ctab website.

 

SELECT TERM TRAINING

No deadlines for this training.

Suggest your own appointment

Upcoming SCADEMY training

Training schedule SCADEMY