Blog - About

About David LeBlanc's Web Log

This blog is about whatever security topics come to mind, and may occasionally wander off into other areas, like arcane C++ tricks. I'll primarily cover techniques to achieve more secure code, how to use some of the more interesting facets of the Windows operating system, and sometimes my thoughts about the general state of Internet security.

  • David LeBlanc's Web Log

    Office Crypto Follies

    • 7 Comments
    What I've been working on lately that has kept me from doing nearly anything else can be found at: http://msdn.microsoft.com/en-us/library/cc313071.aspx MS-OFFCRYPTO is very detailed documentation of exactly how we do cryptography for binary and...
  • David LeBlanc's Web Log

    Lies, Damn Lies, Information Leaks, and Statistics

    • 3 Comments
    Robert Hensing posted some criticism of a study that purported to analyze how many users are at risk due to using out of date or unpatched browsers. Rob rightfully points out that you can actually be running a very old version of IE (depending on OS)...
  • David LeBlanc's Web Log

    Yikes! Vista Security to be Obliterated!

    • 3 Comments
    Just picked up this link from Robert Hensing's blog - http://www.builderau.com.au/news/soa/Vista-security-to-be-obliterated-at-Black-Hat/0,339028227,339290040,00.htm . Seems Mark Dowd is going to be doing a presentation on how to bypass some of the defenses...
  • David LeBlanc's Web Log

    Don’t Feed or Tease the Bears…

    • 2 Comments
    I've learned over the years to avoid bragging about how much more secure something is than something else. We used to have lots of these debates back at ISS. It was inevitable – whoever was going on about how their OS was more secure than your OS had...
  • David LeBlanc's Web Log

    More on Checking Allocations

    • 2 Comments
    Seems my last post met with some objections – somewhat rightfully so, as I mischaracterized one of Tom's points – he never advocated just not checking for allocations, but instead to use an allocator that has a non-returning error handler – though it...
  • David LeBlanc's Web Log

    Checking Allocations & Potential for Int Mayhem

    • 1 Comments
    Must be synchronicity. I started out the day with a really interesting mail from Chris Wysopal talking about how allocations can go wrong, fun with signed int math, and the new[] operator. Once I got done responding to Chris, I then notice Robert Hensing...
  • David LeBlanc's Web Log

    More Checking for Pointer Math

    • 0 Comments
    Someone pointed out that it isn't sufficient to check for whether the pointer math wrapped, but that we also need to check that the resulting pointer is in our buffer. They then came to the possibly erroneous conclusion that really all you had to do was...
  • David LeBlanc's Web Log

    Evil Compiler Tricks, and Checking for Pointer Math

    • 4 Comments
    My favorite programming geek hobby being integer overflows, this caught my eye – "gcc silently discards some wraparound checks" http://www.kb.cert.org/vuls/id/162289 Basically, what it says is that code which looks like this: ============ snip...
  • David LeBlanc's Web Log

    Visual C++ Defenses and 64-bit

    • 1 Comments
    Michael Howard just published a good article here on how Visual C++ features can help protect your app. I go into a fair bit more detail on these in our most recent book, "Writing Secure Code for Windows Vista" (WSCV) if you're curious. Something Michael...
  • David LeBlanc's Web Log

    Use of ASLR, NX, etc

    • 1 Comments
    Found a really great post by David Maynor here . He points out that various counter-measures aren't always used by apps other than Windows. I would have commented directly to his blog, but didn't feel like signing up, so I'll make some comments here ...
  • David LeBlanc's Web Log

    DLL Preloading Attacks

    • 2 Comments
    A DLL preloading attack is something that can get you on a lot of different platforms. One of the first variants I heard about was in an ancient telnet daemon on certain versions of UNIX where you could specify environment variables, and one of the things...
  • David LeBlanc's Web Log

    Terminating your app on heap corruption

    • 3 Comments
    Michael Howard has a FAQ on this here – there's also more information on this and related defenses in one of my chapters in Writing Secure Code for Windows Vista. One of the things I'd like to point out about enabling this, and several other defenses...
  • David LeBlanc's Web Log

    HD vs. Blu-ray (2)

    • 6 Comments
    I promise I'll get back to security stuff shortly, but over the weekend I ran into a couple of articles that explain the issues a lot better. So HD-DVD is quite likely going the way of the 8-track – no need to fight the tide (and no, I have no internal...
  • David LeBlanc's Web Log

    HD vs. Blu-Ray

    • 2 Comments
    OK, so this isn't security related at all, just felt like grumbling about the latest development. If you're not interested in my thoughts on this, skip it now. A few years ago, I remodeled my basement, and took an odd room with only one window and wired...
  • David LeBlanc's Web Log

    15 Most Influential Security People

    • 2 Comments
    This isn't exactly the list I would have drawn up, and I must be having a bad year, since I'm not on it <g>, but my friend Michael Howard is on the list. You can check it out here: http://www.eweek.com/c/a/Security/The-15-Most-Influential-People...
  • David LeBlanc's Web Log

    MulDiv Mayhem

    • 5 Comments
    Here's another episode in my ongoing quest to stamp out integer overflows. MulDiv is a Windows API that was around before we had 64-bit integers as native types. MulDiv is defined like so: int MulDiv(int a, int b, int c) Ironically, the problem...
  • David LeBlanc's Web Log

    Unsafe String Handling with strncpy

    • 0 Comments
    I recently ran into a piece of code that looked like this: int len = cchIn; strncpy(dest, src, len - 1); This is bad, because strncpy is defined as so: char *strncpy( char * strDest , const char * strSource , size_t count ); The original...
  • David LeBlanc's Web Log

    Templatized Min/Max Solved!

    • 1 Comments
    I had some time to think about the overall problem, and had originally thought of a functional approach, like so: template <typename R, typename T, typename U> R Max(T t, U u); This has all the information we need to check for truncation on...
  • David LeBlanc's Web Log

    Couple of good posts

    • 0 Comments
    The SDL blog has some good comments - http://blogs.msdn.com/sdl/archive/2008/01/29/sexy-development-lifecycle.aspx For the last several years, there was the Software Security Summit conference where developers could come to learn about security. The...
  • David LeBlanc's Web Log

    Templatized Min/Max is a bad idea!

    • 3 Comments
    Ah, back to nice geeky C++ programming topics, which is much more fun than angry customer topics… Some well-meaning soul wrote this: template<typename T, typename U> T TMax(T t, U u){ return t > u ? t : u; } Let me count the bugs – first...
  • David LeBlanc's Web Log

    A good reason to install SP3

    • 2 Comments
    If you haven't already seen this , take a look. A brief quote: Microsoft Security Advisory (947563) Vulnerability in Microsoft Excel Could Allow Remote Code Execution Published: January 15, 2008 Microsoft is investigating new public reports of...
  • David LeBlanc's Web Log

    How we know which file formats are used

    • 1 Comments
    A reader wrote to ask me how it is that we know what file formats are being opened by users. I can assure you that neither the Bavarian Illuminati, UFOs nor 3-letter agencies flying black helicopters have anything at all to do with this. We're also not...
  • David LeBlanc's Web Log

    Office SP3 and File formats

    • 14 Comments
    In Office 2007, we changed the default to disable a number of older file formats where we saw very low usage and a high security risk in our code that loads these formats. From the security standpoint, this is the right thing to do. From the data we have...
  • David LeBlanc's Web Log

    USB Virtual PC’s

    • 3 Comments
    I was browsing the news this morning, and ran across an article - Virtual PCs add new layer of security . They claim: MojoPac virtual PCs are not just designed for mobile use. They can protect users who share the same computer. A virus introduced by...
  • David LeBlanc's Web Log

    Implementation vs. Design Defects

    • 1 Comments
    I got a comment to my last post that's worth following up on: Can you comment on what percentage of defects you all are finding are implementation vs. design defects? Its pretty clear that older code that doesn't have buffer overflows isn't going...
Page 2 of 4 (94 items) 1234