CB3591 – ENGINEERING SECURE SOFTWARE SYSTEMS
UNIT I – NEED OF SOFTWARE SECURITY AND LOW-LEVEL
ATTACKS
1. Software Assurance and Software Security
Software Assurance refers to the level of confidence that software is
free from vulnerabilities, whether intentionally designed in or
accidentally inserted at any time during its life cycle. It involves
processes and methods to ensure that software behaves predictably
and securely.
Software Security focuses on designing, developing, and deploying
software in a way that continues to function correctly even when it is
under malicious attack. It emphasizes proactive measures rather than
reactive fixes.
Key Differences: - Software assurance is broader, covering both quality and
security, while software security is focused on resisting malicious threats. -
Software assurance includes reliability and safety; software security focuses
on protecting assets from attackers.
2. Threats to Software Security
Software can be threatened by:
- External attacks such as malware, phishing, and network intrusion.
- Internal threats like insider misuse or poor development practices.
- Common vulnerabilities exploited by attackers:
- Buffer Overflow: Writing beyond buffer boundaries to manipulate adjacent
memory. - SQL Injection: Injecting malicious SQL code to access database
information.
- Cross-site Scripting (XSS): Inserting malicious scripts into trusted
websites. - Command Injection: Executing arbitrary commands on the host
OS.
- Denial of Service (DoS): Overloading system resources to make services
unavailable.
- Privilege Escalation: Exploiting flaws to gain higher access.
Threat Classifications (STRIDE):
- Spoofing, Tampering, Repudiation, Information Disclosure, Denial of
Service, Elevation of Privilege
3. Sources of Software Insecurity
Software insecurity originates from multiple stages of the software
development lifecycle:
- Design flaws: Inadequate architectural security planning.
- Coding errors: Insecure use of programming constructs (e.g., unsafe
functions).
- Poor configuration: Default settings, unnecessary services enabled.
- Unvalidated inputs: Missing input sanitization.
- Inadequate testing: Security not considered during testing.
- Human factors: Lack of training or awareness among developers.
- Third-party components: Use of unverified open-source or commercial
libraries.
4. Benefits of Detecting Software Security Early
Cost-Effectiveness: Fixing security issues in the requirements/design
phase is significantly cheaper than post-deployment.
Reduced Exposure: Early detection prevents potential data leaks or
business disruptions.
Regulatory Compliance: Ensures adherence to legal and industry-
specific standards (e.g., GDPR, HIPAA).
Improved Reputation: Secure software builds user confidence and
brand trust.
Fewer Patch Cycles: Minimizes emergency updates and downtime.
5. Properties of Secure Software
To ensure comprehensive protection, secure software must satisfy the
following security properties:
- Confidentiality: Only authorized users can access data.
- Integrity: Data is protected from unauthorized modifications.
- Availability: Systems remain operational and accessible.
- Authentication: Users and systems can prove their identity.
- Authorization: Authenticated users get access only to permitted
functions.
- Accountability: Actions can be traced to individuals for auditing.
6. Memory-Based Attacks: Low-Level Attacks Against Heap and
Stack
These attacks exploit the way memory is allocated and managed:
a. Stack-Based Attacks:
- Stack Buffer Overflow: Occurs when more data is written to a buffer
located on the stack than it can hold. - Exploits: Overwriting return
addresses, function pointers. - Tools: gdb, objdump, pwndbg
b. Heap-Based Attacks:
- Heap Overflow: Overwriting memory in the heap area which stores
dynamically allocated variables.
- Use-after-free: Accessing memory after it has been deallocated.
- Double-free: Freeing the same memory block twice can corrupt the heap
and lead to execution of malicious code.
c. Format String Vulnerabilities: - Caused by unvalidated user input
passed into functions like printf() without format specifiers, allowing
attackers to read or write arbitrary memory.
d. Integer Overflow/Underflow: - Miscalculations in buffer size allocations
leading to bypassing bounds checks.
7. Defense Against Memory-Based Attacks
To mitigate these attacks, both hardware and software countermeasures are
deployed:
a. Compiler-Based Defenses:
- Stack Canaries: Guard values placed before return addresses to detect
stack corruption.
- Fortify Source: Adds bounds checks to vulnerable functions like strcpy,
sprintf.
b. OS-Level Defenses:
- ASLR (Address Space Layout Randomization): Randomizes memory
layout to make it harder for attackers to predict target addresses.
- DEP/NX (Data Execution Prevention): Prevents execution of code in
memory regions intended for data.
c. Language-Based Solutions:
- Use of memory-safe languages such as Rust, Java.
- Garbage collection and bounds checking help prevent pointer misuse.
d. Code-Level Practices:
- Input validation and sanitation
- Use of secure libraries (e.g., strncpy, strncat) - Avoiding unsafe functions
(gets, scanf)
- Static analysis and fuzz testing
e. Hardware-Based Protections:
- Intel CET (Control-flow Enforcement Technology)
- ARM Memory Tagging Extension (MTE)
By implementing these layers of protection, modern systems can resist low-
level attacks more effectively, though ongoing vigilance and testing are
always essential.
UNIT II – SECURE SOFTWARE DESIGN
1. Requirements Engineering for Secure Software
…
