Something else to look out for when reviewing code

From: The Learning from Mistakes Dept.   A few months back eEye found an exploitable buffer overrun in Symantec’s Remote Management software what caught my eye was the nature of the bug, and I think this is coding construct we should all learn from.   You’re no doubt familiar with issues with strncpy and strncat,…


MSDN Yearly Security Edition

It’s that time of the year again, when MSDN magazine issues their yearly Security Issue. This year a number of folks from our team wrote content, including myself, Shawn Hernan, Scott Lambert, Tomasz Ostwald, Adam Shostack and Mark Pustilnik. But probably the best article is “New SQL Truncation Attacks And How To Avoid Them” written by…


Alleged Bugs in Windows Vista’s ASLR Implementation

I’ve had some people ask me about a paper that was recently published detailing alleged bugs in Address Space Layout Randomization in Windows Vista. It’s great to see people looking at and scrutinizing Windows Vista before we ship. With that said, it turns out this analysis is incomplete and leads the author to an incorrect…


Developing More-Secure Microsoft® ASP.NET 2.0 Applications Now Available

A new book in the Secure Software Development Series, this time from Dominick Baier is now available from Microsoft Press. I reviewed a good number of the draft chapters, and got an early copy last week. What I love about this book is it’s complete. It covers ASP.NET 2.0 security features as well as security…


The Sardonic Mr. Jones

If you have not read Jeff Jones’ blog recently, you really should. He has a few thought-provoking opinions. I’ll just leave it at that!