Introduction Secure code reviews are an indispensable practice if you’re serious about building secure software. Software development processes that incorporate secure code reviews are much more effective at producing secure code than those that don’t. Code reviews are necessary because they can detect a wide range of issues that other security measures may not catch; … [Read more…]
Directory traversal 101 If you develop or maintain any software that allows a user to request files from a server (e.g. a web server), you need to watch out for directory traversal attacks. They work like this: Imagine your server is configured to serve files from the directory /var/srv/my-site (henceforth known as the “document root”). … [Read more…]
You may not know this, but creating and using files in /tmp is dangerous.“ Why?” you ask. Well, /tmp is world readable and world writable, meaning that any user on the system may read or write to it. Therefore, when an application creates files in /tmp, it must take special care to create those files … [Read more…]