Tasty » Adam Sampson's security bookmarks

research!rsc: Running the “Reflections on Trusting Trust” Compiler

With analysis of the surprisingly short source code.

to backdoor bell-labs compiler history retrocomputing security unix ... on 26 October 2023

Double-Free RCE in VLC. A honggfuzz how-to | Pen Test Partners

to fuzzing mod-ers security vlc ... on 29 June 2020

Destroying x86_64 instruction decoders with differential fuzzing | Trail of Bits Blog

A neat use of fuzzing.

to cpu fuzzing security testing x86 ... on 29 June 2020

Chrome: 70% of all security bugs are memory safety issues | ZDNet

to ers memory-safety security ... on 29 June 2020

Formal validation of the Arm v8-M specification – Alastair Reid – Researcher at ARM Ltd

Alastair gave a presentation about this at a workshop I attended; very interesting stuff (and his blog generally is well worth reading).

to arm ers formal-methods security validation ... on 05 May 2018

SEI CERT C++ Coding Standard: Rules for Developing Safe, Reliable, and Secure Systems (2016 Edition)

There's also a wiki.

to security software-engineering ... on 05 May 2018

MCS 494, UNIX Security Holes, Fall 2004

Dan Bernstein's Unix security module. This is a bit dated now, but the material is interesting, and the assessment materials have some nice ideas.

to security teaching unix ... on 10 November 2017

Secure Software Design and Programming: Class Materials by David A. Wheeler

to security software-engineering teaching ... on 10 November 2017

Willy Tarreau's stuff: Look back to an end-of-life LTS kernel : 3.10

"The end of the 3.10 branch is a good opportunity to have a look back at how that worked, and to remind some important rules regarding how to choose a kernel for your products, or the risks associated with buying products running unmaintained kernels."

to kernel linux lts security software-engineering support ... on 05 November 2017

Twice the bits, twice the trouble: vulnerabilities induced by migrating to 64-bit platforms | the morning paper

"In this study, Wressnegger et al. reveal how a codebase originally written for 32-bit, and which is perfectly secure on 32-bit platforms, can have new vulnerabilities simply by compiling it for 64-bit systems." No surprises for anyone who follows oss-security etc., but the paper's a good overview.

to architecture porting security vulnerabilities ... on 06 April 2017