“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (1 of 2)”
summary
Walks through concrete C/C++ mistakes (unsafe strncpy use, unchecked std::string lengths, std::copy heap overflow, dangerous cast to enums) and shows a live buffer-overflow exploit that uses a NOP-sled to overwrite a return address and achieves privilege escalation to root on a system with ASLR disabled. Covers mitigations (ASLR, stack canaries, back_inserter, length checks), testing gaps (static analysis misses, fuzzing and sanitizers recommended) and operational fixes like internal bug bounties; the exploit demonstration works and produces a core dump when it fails.
AI-written summary · about
chapters (24)
- 0:00Introduction and personal story
- 1:04The state of secure coding today
- 2:07Why perimeter security fails
- 3:32Evolution of cyber threats
- 6:03The three lies we tell ourselves
- 7:06Who are the attackers
- 9:20Insiders and unpatched systems
- 10:01What is a critical system
- 11:24Attack vectors and surfaces
- 13:11Your first line is the last line
- 13:55Buffer overflow vulnerabilities
- 17:29Enumeration pitfalls
- 19:16Heap overflow and standard copy
- 21:02Eliminating compiler warnings
- 21:23Infinite loops and complexity
- 23:11Capturing by value
- 24:12Bug bounty programs
- 27:23What hackers look for
- 29:33Buffer overflow exploit demo
- 39:12Countermeasures ASLR and stack canaries
- 46:58Failure analysis and core dumps
- 49:28Tools and testing strategies
- 51:03The arms race of exploits
- 55:24Compiler and language security
related talks
01h 26mEmbracing an Adversarial Mindset for C++ Security
01h 06mHacking and Securing C++
22mDemostrating Binary Exploitation
01h 16mClassic Vulnerabilities
01h 00mHacking and Securing C++
51mThe Anatomy of an Exploit
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
47mBinary Exploitation 101: Offensive C Security