Abstract
Creating secure software is challenging, but necessary due to the prevalence of large data breaches that have occurred for organizations such as Equifax, Uber, and U.S. Securities and Exchange Commission. Many static analysis tools are available that can identify vulnerable code, however many are proprietary, do not disclose their rule set or do not integrate with development environments. One open source tool that integrates well with the Eclipse development environment is the Secure Coding Assistant that was developed at California State University, Sacramento (CSUS), which is featured by early error detection. The tool provides support for secure coding rules for the Java programming language that were developed at the CERT division of the Software Engineering Institute at Carnegie Mellon University. The tool also provides error correction and contract programming support. To provide secure coding assistance in C programming, we further extend the tool to support the C programming language by semi-automating a subset of the CERT secure coding rules for C. The tool detects rule violations for the C programming language in the Eclipse development environment and provides feedback to aid and educate developers in secure coding practices. The tool is open source to the community and maintained at GitHub (http://benw408701.github.io/SecureCodingAssistant/).
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
2017 Annual Data Breach Year-End Review (2018). https://www.idtheftcenter.org/images/breach/2017Breaches/2017AnnualDataBreachYearEndReview.pdf. Accessed 27 Feb 2019
Bearak, S.: Uber Data Breach Affects 57 Million: It is Time to Own Our Identities (2017). https://www.identityforce.com/business-blog/ubers-data-breach-affects-57-million-its-time-to-own-our-identities. Accessed 27 Feb 2019
Cimpanu, C.: SEC Says Hackers Breached its System, Might Have Stolen Data for Insider Trading (2017). https://www.bleepingcomputer.com/news/security/sec-says-hackers-breached-its-system-might-have-used-stolen-data-for-insider-trading/. Accessed 27 Feb 2019
Eclipse: Extensions and Extension Points (2018). http://help.eclipse.org/luna/index.jsp?topic=%2Forg.eclipse.pde.doc.user%2Fconcepts%2Fextension.htm. Accessed 27 Feb 2019
Hicken, A.: ERR34-C. Detect errors when converting a string to a number (2018). https://wiki.sei.cmu.edu. Accessed 27 Feb 2019
Hicken, A., Seacord, R.: STR34-C. Cast characters to unsigned char before converting to larger integer sizes (2018). https://wiki.sei.cmu.edu. Accessed 27 Feb 2019
Leary, J.: Equifax Breach Impacts 147.9 Million: Steps to Keep Your Identity Protected (2018). https://www.identityforce.com/business-blog/equifax-breach-impacts-143-million-steps-to-keep-your-identity-protected. Accessed 27 Feb 2019
Li, C., White, B., Dai, J., Zhang, C.: Enhancing secure coding assistant with error correction and contract programming. In: Proceeding of National Cyber Summit 2017, Huntsville, AL, 6–8 June 2017 (2017)
Long, F., Hicken, A.: MSC30-C. Do not use the rand() function for generating pseudorandom numbers (2018). https://wiki.sei.cmu.edu. Accessed 27 Feb 2019
MITRE: CWE-843: Access of Resource Using Incompatible Type (‘Type Confusion’). Common Weakness Enumeration (2018)
NIST: Test Suites, 4.9 (2017). NIST Samate: https://samate.nist.gov/SARD/testsuite.php. Accessed 27 Feb 2019
Ozkan, S.: Browse Vulnerabilities by Date (2018). https://www.cvedetails.com/browse-by-date.php. Accessed 27 Feb 2019
Pretz, K.: 10 Recommendation for Avoiding Software Security Design Flaws (2014). http://theinstitute.ieee.org/special-reports/special-reports/10-recommendations-for-avoiding-software-security-design-flaws. Accessed 27 Feb 2019
Razmyslov, S.: INT33-C. Ensure that division and remainder operations do not result in divide-by-zero errors (2018). https://wiki.sei.cmu.edu. Accessed 27 Feb 2019
Seacord, R., Flynn, L.: FIO32-C. Do not perform operations on devices that are only appropriate for files (2018). https://wiki.sei.cmu.edu. Accessed 27 Feb 2019
Seacord, R., Hicken, A.: MEM31-C. Free dynamically allocated memory when no longer needed (2018). https://wiki.sei.cmu.edu. Accessed 27 Feb 2019
Svoboda, D., Snavely, W.: FIO45-C. Avoid TOCTOU race conditions while accessing files (2017). https://wiki.sei.cmu.edu. Accessed 27 Feb 2019
White, B., Dai, J., Zhang, C.: Secure coding assistant: enforcing secure coding practices using the eclipse development environment. In: Proceeding of National Cyber Summit 2016, Huntsville, AL, 8–9 June 2016 (2016)
White, B., Dai, J., Zhang, C.: An early detection tool in eclipse to enforce secure coding practices. Int. J. Inf. Priv. Secur. Integr. (IJIPSI) 3, 284–309 (2018)
Melnik, V.V.: Enhancing secure coding assistant: enforcing secure coding rules for C programming language. Master report at California State University, Sacramento (2018)
Acknowledgements
Acknowledgements and attributions are given to Carnegie Mellon University and its Software Engineering Institute, as this publication incorporates portions of the “SEI CERT C Coding Standard” (c) 2017 Carnegie Mellon University, with special permission from its Software Engineering Institute. Any material of Carnegie Mellon University and/or its software engineering institute contained herein is furnished on an “as-is” basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied, as to any matter including, but not limited to, warranty of fitness for purpose or merchantability, exclusivity, or results obtained from use of the material, Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement. This publication has not been reviewed nor is it endorsed by Carnegie Mellon University or its Software Engineering Institute. CERT and CERT Coordination Center are registered trademarks of Carnegie Mellon University.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Melnik, V., Dai, J., Zhang, C., White, B. (2020). Enforcing Secure Coding Rules for the C Programming Language Using the Eclipse Development Environment. In: Choo, KK., Morris, T., Peterson, G. (eds) National Cyber Summit (NCS) Research Track. NCS 2019. Advances in Intelligent Systems and Computing, vol 1055. Springer, Cham. https://doi.org/10.1007/978-3-030-31239-8_12
Download citation
DOI: https://doi.org/10.1007/978-3-030-31239-8_12
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-31238-1
Online ISBN: 978-3-030-31239-8
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)