Daily using/supporting

Get Firefox browser!
Get Thunderbird!
Get Opera browser!
Get The Gimp!
Get Inkscape!
Get LibreOffice!
Get Videolan!
Get Linux!
Get Mandriva!
Get Joomla!
Hacker Emblem

Archives

Which topics would you like us to cover more?

Latest comments

Latest tweets

about 2 days ago Using REDIPS.drag to add drag and drop to your .Net webapplication #li #dib0 http://t.co/n8zY3s7d
about 8 days ago http://t.co/cknQcDbo #Kindle
about 16 days ago Freedom isn't the ability to choose what to do or say, but the ability to choose what not to do or say #freedom
12 Apr 2012 Force the use of a networking adapter using C# #li #dib0 http://t.co/ZTJOPzOz
9 Apr 2012 Mandriva 2010.2 and USB devices in Virtualbox http://t.co/fwq9gbHB
9 Apr 2012 Execute a http request to you own site with PHP http://t.co/DIvWPrpd
Home Architecture, security and coding Easter eggs and security
Easter eggs and security
Written by Division by Zero   
Sunday, 21 March 2010 11:36

Almost Easter. A good time to write something about Easter eggs and security. And no, I'm not talking about those painted eggs, but those funny pieces of functionality in software. You, if you are a developer, probably wrote some. I know I have.

These Easter eggs are not done from a security perspective. I know, they are fun, but they aren't trustworthy. If an attacker tries to find holes in your software, she or he first just looks what the software does. The second step is to try to misuse working and good functionality. By entering and tampering data it is possible to let the software behave in an unintended way. This behavior is what you have build, but not have intended to happen (as most bugs). Luckily we have testers who test the functionality that we build.

There  Easter eggs come in. We add functionality in moments we are slacking off and goofing around. This functionality isn't listed in the software design. Therefore this functionality isn't tested. Therefore this functionality contains, very likely, bugs. Therefore this functionality is a possible security leak.

Yes... slacking off and goofing around with code is fun and helps productivity. But just never put this code in a production application.

 

Add comment


Security code
Refresh

I'm feeling so happy today. I think I'll call in sick. - Loesje


© 2009 - 2012, Division by Zero

Template based on the empire template by joomlashack 

Valid XHTML 1.0 Strict  Valid CSS!  Creative Commons License
This work by Division by Zero is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Netherlands License.