1. Secure Programming with Static Analysis Brian Chess, Ph.D.

2. Chapter 2 Static Analysis Static analysis is the process of analyzing code without executing There are many static analysis tools for detecting security problems They work for a programmer as spelling checker for writers: Detect certain kinds of problems but not all Running them won't guarantee perfect code

3. Static Analysis Capabilities and Limitations. Unbiased Checking Examining the code, not the program Early checking – knowledge transfter Examine newly discovered types of defects False positives v.s. false negatives Design defects may not be visible in code  Architectural risk analysis

4. Solving problems with Static Analysis Type Checking Style Checking Program Understanding Program Verification Property Checking Bug Finding Security Review

5. Type Checking Done mostly at compilation May produce false possitives and false negatives. Examples: Next 2 slides

6. Type Checking – False Possitive example

7. Type Checking – False Negative example

8. Style Checking These are more superficial than type checks They enforce rules related to naming, white space, deprecated functions, commenting, program structure …etc Such defects affect readability and maintainability of a program but does not cause an error PMD (pmd.sourceforge.net) and Parasoft (www.parasoft.com) style checker for Java,C.

9. Style Checking Example

10. Program Understanding Tools to help dealing with large code Simple Examples:Find, Replace, Rename variables, Splitting code..etc More advanced tools: Insight into how a program works Example: Reverse Engineer the design from implementation. Fujaba (http://www.uni.paderborn.de/cs/fujaba)http://www.uni.paderborn.de/cs/fujaba Fujaba allows moving back and forth between Java nad UML.

11. Fujaba

12. Program Verification and Property Checking 'Program verification' is checking code adherance to a set of specifications It is not practical to write complete specifications of all of a program 'Property checking' is checking a partial set of specifications 'Sound tools' are tools that claim to produce no false negatives. However, striving for soundness may result in producing false positives Example:

13. Property Checking Example

14. Property Checking False Possitive

15. Bug Finding It is finding behaviour not intended by the programmer "Bug Idioms" are rules in bug finding tools that come with the tool. FindBugs (www.findbugs.org) is a bug finder for Javawww.findbugs.org Example: Double Checking Lock

16. Bug Finding Example

17. Security Review These have techniques similar to the earlier techniques but focus on security issues They can be thought of as hybrid of property checkers and bug finders Property Checker: Secure Specifications to check Bug Finder: common insecure idioms However, security checking should be seen as part of security review. i.e. The tool would suggest review of security suspected fragments of code The good tools would minimize both false positives and negatives

18. Security Review Example

19. Assignment Chose one of the static analysis tools mentioned in this chapter and: Download it and install it Learn what it does and how to use it Present us a demo on it Demos are to be presented on Wednesday July 30, 2008