We published our last newsletter more than six months ago, which is longer than usual and longer than we generally like. We've been busy in these last six months growing our team. You can read about our new team members below. We are still looking for more team members, so if you have the interest and skills, apply using the information we provide in the Open Positions in the SEI CERT Secure Coding Team section of this newsletter.
This past month, we released our Source Code Analysis Lab (SCALe) tool to GitHub. This is SCALe's first open source release to the public. We're very excited to provide this tool to the community, and we hope to hear how you're using it.
As usual, we provide references to events and publications that may interest you, and we refer to the upcoming events where we'll be making presentations. We also provide a list of updates to our Secure Coding Standards.
As the summer draws to a close, we are reinvigorated by our mission to guide and support the community and help improve the security of software through secure coding practices. We are interested, as always, in collaborating with others on research and developing new techniques to improve coding practices. Please reach out to us if you are interested in collaboration projects, and let us know how our contributions are helping you.
SCALe provides a GUI front end that auditors can use to examine alerts from one or more static analysis tools and the associated code to make audit determinations (e.g., identify true violations and false positives) and export the project audit information to a database or CSV file(s). This open source version of SCALe provides categories of alerts for tools based on two code flaw taxonomies: SEI CERT Coding Standards and MITRE’s Common Weakness Enumeration (CWE). The SEI CERT Coding Standards and SCALe provide analysts with detailed guidance for secure development in C, C++, Java, and Perl.
For the last three years, most of the development of the SCALe tool has been for classification and prioritization research projects, led by Lori Flynn, to add features and functionality needed by the projects. This initial GitHub release is based on a version of the research project’s code from around February 2018. This version also includes some bug fixes and performance improvements made by the wider Secure Coding team to prepare the code for this release. Please contact us if you are interested in collaborating with us or using more recent (non-public) versions of SCALe and related software.
We have been developing SCALe since 2010. In 2015, we first shared SCALe with some non-SEI organizations. Some of the new features developed in the last three years that are part of the GitHub SCALe release include the following:
Alerts with the same filepath, line, and condition are now fused for auditor efficiency.
Hyperlinked fused-alert IDs now provide checks for related audit determinations and notes.
Code metrics are now allowed to be used.
A new 'Notes' field was added.
We hope you will try this version of SCALe, and we welcome your feedback and code contributions!
New Team Members
We are happy to introduce our newest Secure Coding team members: Ebonie McNeil, Ryan Steele, and Derek Leung. Jiyeon Lee and Theodor Johansson, student interns who worked through the summer, will also continue working with us in the fall.
Open Positions in the SEI CERT Secure Coding Team
Join our Secure Coding team. If you have the right qualifications and are interested in researching and developing improvements to the state of the art and practice in secure coding, secure development, and software assurance, please consider applying for any of the following positions:
CERT researchers worked with MITRE to test a new method we developed to do more precise mappings between taxonomies. We modified fields of our CERT coding standard to record precise mapping information. In December 2017 and January 2018, we updated rules in the CERT C standard to enable more precise mapping. We added new fields to the Related Guidelines table, and we added a new Mapping Notes field for rules that have a precise mapping or mapping notes.
Mapping Refresh: CERT Guidelines to MITRE CWEs
We are collaborating with MITRE to refresh the mappings between CERT guidelines and MITRE CWEs. Both MITRE and the CERT Division will publish the revised mappings once they are complete.
In August, Will Klieber presented at the International Workshop on Security of Mobile Applications (IWSMA 2018). The title of the paper he presented is “Practical and Precise Taint Flow Static Analysis for Android App Sets,” which he co-authored with Lori Flynn, Will Snavely, and Michael Zheng.
In February, David Svoboda presented an SEI Cyber Minute about SCALe.
Upcoming Events
The presentation titled "Flight Software Programming Language Selection: A Security Perspective," written by Will Snavely and Craig Meyers, was accepted and will be presented at the 2018 AIAA Space conference.
The paper titled "Detecting leaks of sensitive data due to stale reads," written by Will Snavely, Will Klieber, Ryan Steele, and David Svoboda, was accepted and will be presented at the IEEE SecDev 2018 conference in September.
The second noncompliant code example elaborates more clearly why the example can still leak sensitive information.
The first compliant solution zeroes out any uninitialized chars in the array before copying them, as copying uninitialized data could be sensitive, as well as a violation of EXP33-C. Do not read uninitialized memory.
The first compliant solution has a new check to prevent a null pointer being passed to memcpy(), even if the call was trivial, because the behavior might still be undefined.
The final compliant solution now asserts that a pointer must not be null before it gets dereferenced.
All code examples assume that errno is set if fopen() or malloc() fail, but this is not guaranteed by C11; it is only guaranteed by POSIX. Consequently, all code examples are now limited in scope to POSIX.
The guideline has a new compliant solution that showcases using nested if clauses to handle errors and cleanup; it also discusses the pros and cons of using nested ifs versus goto chains.
TSM03-J. Do not publish partially initialized objects. In the Final Field compliant solution, the introductory text now indicates that a final field's initialized value is available after (rather than before) construction has completed.
Editor: Lori Flynn, CERT Division of the Software Engineering Institute
No Android rules were added, changed, or removed.
CERT Perl Secure Coding Standard
Editor: David Svoboda, CERT Division of the Software Engineering Institute
No Perl rules were added, changed, or removed.
Our People
In our newsletters, we highlight various staff members behind our Secure Coding research. In this issue, we feature Ryan Steele.
In January 2018, Ryan Steele joined the Secure Coding team as an Associate Software Security Analyst. His background is in C/C++ software development for FPGA-based embedded systems for aerospace, robotics, military, and industrial applications. His latest work focuses on programming language compilers and automated code repair.
