David LeBlanc's Web Log
Implementation vs. Design Defects
I got a comment to my last post that's worth following up on: Can you comment on what percentage of...
Author: david_leblanc Date: 12/18/2007
Securing Existing Code
Just read Michael Howard's post about differentiating secure features, security features and...
Author: david_leblanc Date: 12/17/2007
How to cause a regression
This one isn't really security related, except that we security people often want to get rid of old...
Author: david_leblanc Date: 12/13/2007
More on Sandboxing – Network Implications
Larry Osterman's post (er, rant) (found here -...
Author: david_leblanc Date: 11/02/2007
Writing Secure Code 3
It seems like every time I've gone out in public recently, I've been asked when we were going to...
Author: david_leblanc Date: 10/17/2007
Checking Password Complexity
Michael put some sample code into WSC2 that showed people how to check passwords using the...
Author: david_leblanc Date: 10/11/2007
Safebool
My last post triggered a couple of responses and a URL I thought would be good to not get lost in...
Author: david_leblanc Date: 10/03/2007
C++ operator overloading trivia
Learned something interesting this week that I'll be working into SafeInt 3. It all started out...
Author: david_leblanc Date: 10/02/2007
On the Other Hand…
In my previous post on threat models, I pointed out situations where TM's are either a complete...
Author: david_leblanc Date: 10/01/2007
Blog Comment Spam is Really, Really, Really Annoying
I keep getting spam from some bunch of (expletives deleted) as comments to the blog. It's all: Nice....
Author: david_leblanc Date: 09/19/2007
Threat Modeling the Bold Button is Boring
I've been reading Larry Osterman's blog lately – he's a smart guy, and one of the very first people...
Author: david_leblanc Date: 09/19/2007
Office 2003 SP3
We've just released SP3 for Office 2003, and it's been a lot of work. We're releasing a bit more in...
Author: david_leblanc Date: 09/18/2007
DREAD and the PHB
Sometimes when I present about secure programming practices, I emphasize education for PM's,...
Author: david_leblanc Date: 08/14/2007
DREADful
Both the STRIDE and DREAD systems Michael and I documented in Writing Secure Code have been...
Author: david_leblanc Date: 08/14/2007
More on C++ code auditing
Just now had a chance to take a look at the presentation I referenced last post. It's fairly long...
Author: david_leblanc Date: 08/10/2007
Avoiding C++ vulnerabilities
Just returned from Blackhat – it always seems that the presentations I most want to see happen at...
Author: david_leblanc Date: 08/03/2007
Practical Windows Sandboxing – Part 3
The third tool we need in order to create a sandboxed app is a desktop. We've said in many places...
Author: david_leblanc Date: 07/31/2007
Practical Windows Sandboxing, Part 2
Once you have a process in a restricted token, the next tool you can use to limit what it can do is...
Author: david_leblanc Date: 07/30/2007
Logon ID SIDs
I've mentioned logon ID SIDs a couple of times, but they're fairly arcane. I first ran into them...
Author: david_leblanc Date: 07/29/2007
Practical Windows Sandboxing – Part 1
I've written more than once about how interesting restricted tokens are – the earliest article was...
Author: david_leblanc Date: 07/27/2007
Security Dependencies Follow-up
Someone asked how dependencies should be handled if you're depending on another team at the same...
Author: david_leblanc Date: 07/26/2007
Process Tokens and Default DACLs
I ran up on something the other day that isn't very well documented in one place. When you're...
Author: david_leblanc Date: 07/26/2007
Misc Ramblings
Sorry about not posting recently – been distracted by a bunch of stuff. One of the more fun...
Author: david_leblanc Date: 06/12/2007
More on Exception Handlers
Sitting here at "Blue Hat" watching David Maynor present – pretty cool working for a company that...
Author: david_leblanc Date: 05/10/2007
Is it a Read, Write or Execute AV?
I didn't find this documented in the Visual Studio documentation, but it is in the latest Windows...
Author: david_leblanc Date: 05/01/2007
Fun with Template Specialization
Hannes Reuscher of the PowerPoint team turned me on to this cool C++ trick, and I used it...
Author: david_leblanc Date: 04/27/2007
Why Threads Are A Bad Idea
My friend Tim Dodd found this presentation back when we worked together at ISS somewhere around...
Author: david_leblanc Date: 04/20/2007
Some Failures Are Better Than Others
I was presenting at the Software Security Summit yesterday – good little conference. It's a shame...
Author: david_leblanc Date: 04/17/2007
Crashes Are Bad, OK?
It's interesting to see what happens when you get slashdotted… Let's go back and see what I said in...
Author: david_leblanc Date: 04/16/2007
It Might Not Be A Vulnerability If…
There's some things that just aren't vulnerabilities. If the exploit starts with "First become...
Author: david_leblanc Date: 04/10/2007
Exception Handlers Are Baaad
I've said a lot of times that incorrect use of exception handlers will get you hacked. I go into...
Author: david_leblanc Date: 04/04/2007
Even More Cool Integer Tricks
OK, so this is just utterly geeky, and would really only come in handy if you're writing something...
Author: david_leblanc Date: 04/01/2007
Being Part of the Solution
One of the comments to my last post asked how someone could be part of the solution, as opposed to...
Author: david_leblanc Date: 04/01/2007
Word 2007 Blog Feature’s Password Handling
I knew about the blog feature – hard not to notice when every time you go to make a new document, it...
Author: david_leblanc Date: 03/29/2007
What's still exploitable?
OK, just throwing this out, hoping for some interesting comments - if you have NX, ASLR, and...
Author: david_leblanc Date: 03/27/2007
Impersonation isn't dangerous
I was called to task because in Writing Secure Code for Windows Vista, I asserted that from the...
Author: david_leblanc Date: 03/25/2007
Economics of the Vulnerability Finding Game
A friend of mine loaned me a book - "Hidden Order: The Economics of Everyday Life", by David...
Author: david_leblanc Date: 03/22/2007
More Fun with Integers
Just a quick note this morning to share something I found while finishing up SafeInt 3.0. This is...
Author: david_leblanc Date: 03/21/2007
Finally starting a blog
I have been putting this off for a while. Not out of concern with sharing myself in public - I've...
Author: david_leblanc Date: 03/20/2007