A source code perspective C overflow vulnerabilities exploit taxonomy based on well-defined criteria / Nurul Haszeli Ahmad

Despite various works for more than three decades , C overflow vulnerabilities is still a major security issue, as it has contributed to more than 30% of all recorded vulnerabilities and has been the root cause of many successful exploits. One of the main causes lies in the C software developers the...

Full description

Bibliographic Details
Main Author:	Ahmad, Nurul Haszeli
Format:	Thesis
Language:	English
Published:	2015
Subjects:	Computer software
Online Access:	http://ir.uitm.edu.my/id/eprint/27288/ http://ir.uitm.edu.my/id/eprint/27288/1/TM_NURUL%20HASZELI%20AHMAD%20CS%2015_5.pdf

id	uitm-27288
recordtype	eprints
spelling	uitm-272882020-01-15T08:22:30Z http://ir.uitm.edu.my/id/eprint/27288/ A source code perspective C overflow vulnerabilities exploit taxonomy based on well-defined criteria / Nurul Haszeli Ahmad Ahmad, Nurul Haszeli Computer software Despite various works for more than three decades , C overflow vulnerabilities is still a major security issue, as it has contributed to more than 30% of all recorded vulnerabilities and has been the root cause of many successful exploits. One of the main causes lies in the C software developers themselves, who inadvertently introduced these vulnerabilities due to their lack of understanding of vulnerabilities being the security loophole. To educate them, researchers have constructed C overflow vulnerabilities taxonomies. However, most of these taxonomies are memory based, focuses on symptoms upon vulnerability triggered and did not describe the appearance of vulnerabilities in coding, which subsequently, prevented software developers from understanding the vulnerabilities and writing safe codes. There were also works done previously on source code-based taxonomies but they were too broad with ambiguous classes and failed to describe clearly from software developers point of view. Currently, there is no source code-based taxonomy constructed with criteria of well-defined taxonomy resulting in difficulty to apply taxonomy as foundation and references in writing secure codes. Therefore, the objective of this research is to construct a well-defined C overflow vulnerabilities exploit taxonomy from source code perspective. To achieve that, reviews on numerous reports, advisories and publications related to C overflow vulnerabilities, analysis methods and tools, and relevant classifications and taxonomies were meticulously performed. It was followed by reclassification of well-defined criteria, which was used to construct C overflow vulnerabilities exploit taxonomy from source code perspective. The taxonomy was then evaluated for both relevancy against well-defined criteria and as well as the effectiveness of static analysis tools. The results suggested that the taxonomy facilitates the understanding of software developers in classifying and detecting C overflow vulnerabilities and the selected five static analysis tools require further improvement to enable the tools to detect from three to four classes to all available C overflow vulnerabilities classes. The significances of this study are the constructed well-defined taxonomy of C overflow vulnerabilities exploits consisting of 10 classes with three new classified classes; i.e. Memory Functions, Variable Type Conversion and Pointer Scaling/Mixing, and methods to evaluate taxonomy in accordance to well-defined criteria. 2015 Thesis NonPeerReviewed text en http://ir.uitm.edu.my/id/eprint/27288/1/TM_NURUL%20HASZELI%20AHMAD%20CS%2015_5.pdf Ahmad, Nurul Haszeli (2015) A source code perspective C overflow vulnerabilities exploit taxonomy based on well-defined criteria / Nurul Haszeli Ahmad. Masters thesis, Universiti Teknologi MARA.
repository_type	Digital Repository
institution_category	Local University
institution	Universiti Teknologi MARA
building	UiTM Institutional Repository
collection	Online Access
language	English
topic	Computer software
spellingShingle	Computer software Ahmad, Nurul Haszeli A source code perspective C overflow vulnerabilities exploit taxonomy based on well-defined criteria / Nurul Haszeli Ahmad
description	Despite various works for more than three decades , C overflow vulnerabilities is still a major security issue, as it has contributed to more than 30% of all recorded vulnerabilities and has been the root cause of many successful exploits. One of the main causes lies in the C software developers themselves, who inadvertently introduced these vulnerabilities due to their lack of understanding of vulnerabilities being the security loophole. To educate them, researchers have constructed C overflow vulnerabilities taxonomies. However, most of these taxonomies are memory based, focuses on symptoms upon vulnerability triggered and did not describe the appearance of vulnerabilities in coding, which subsequently, prevented software developers from understanding the vulnerabilities and writing safe codes. There were also works done previously on source code-based taxonomies but they were too broad with ambiguous classes and failed to describe clearly from software developers point of view. Currently, there is no source code-based taxonomy constructed with criteria of well-defined taxonomy resulting in difficulty to apply taxonomy as foundation and references in writing secure codes. Therefore, the objective of this research is to construct a well-defined C overflow vulnerabilities exploit taxonomy from source code perspective. To achieve that, reviews on numerous reports, advisories and publications related to C overflow vulnerabilities, analysis methods and tools, and relevant classifications and taxonomies were meticulously performed. It was followed by reclassification of well-defined criteria, which was used to construct C overflow vulnerabilities exploit taxonomy from source code perspective. The taxonomy was then evaluated for both relevancy against well-defined criteria and as well as the effectiveness of static analysis tools. The results suggested that the taxonomy facilitates the understanding of software developers in classifying and detecting C overflow vulnerabilities and the selected five static analysis tools require further improvement to enable the tools to detect from three to four classes to all available C overflow vulnerabilities classes. The significances of this study are the constructed well-defined taxonomy of C overflow vulnerabilities exploits consisting of 10 classes with three new classified classes; i.e. Memory Functions, Variable Type Conversion and Pointer Scaling/Mixing, and methods to evaluate taxonomy in accordance to well-defined criteria.
format	Thesis
author	Ahmad, Nurul Haszeli
author_facet	Ahmad, Nurul Haszeli
author_sort	Ahmad, Nurul Haszeli
title	A source code perspective C overflow vulnerabilities exploit taxonomy based on well-defined criteria / Nurul Haszeli Ahmad
title_short	A source code perspective C overflow vulnerabilities exploit taxonomy based on well-defined criteria / Nurul Haszeli Ahmad
title_full	A source code perspective C overflow vulnerabilities exploit taxonomy based on well-defined criteria / Nurul Haszeli Ahmad
title_fullStr	A source code perspective C overflow vulnerabilities exploit taxonomy based on well-defined criteria / Nurul Haszeli Ahmad
title_full_unstemmed	A source code perspective C overflow vulnerabilities exploit taxonomy based on well-defined criteria / Nurul Haszeli Ahmad
title_sort	source code perspective c overflow vulnerabilities exploit taxonomy based on well-defined criteria / nurul haszeli ahmad
publishDate	2015
url	http://ir.uitm.edu.my/id/eprint/27288/ http://ir.uitm.edu.my/id/eprint/27288/1/TM_NURUL%20HASZELI%20AHMAD%20CS%2015_5.pdf
first_indexed	2023-09-18T23:18:11Z
last_indexed	2023-09-18T23:18:11Z
_version_	1777419253653176320

A source code perspective C overflow vulnerabilities exploit taxonomy based on well-defined criteria / Nurul Haszeli Ahmad

Similar Items