Lecture

Software Security Vulnerabilities: Case Studies

Graph Chat

Chat with Graph Search

Ask any question about EPFL courses, lectures, exercises, research, news, etc. or try the example questions below.

DISCLAIMER: The Graph Chatbot is not programmed to provide explicit or categorical answers to your questions. Rather, it transforms your questions into API requests that are distributed across the various IT services officially administered by EPFL. Its purpose is solely to collect and recommend relevant references to content that you can explore to help you answer your questions.

Description

This lecture presents case studies of software security vulnerabilities, including an Android SMS bug, Flashback Trojan attack on Apple systems, and a Gmail bug erasing accounts. It also discusses the risks posed by Samsung Cell Path iOS app, Skype crash, Hotmail bug, and Internet Explorer bug. The instructor explains the challenges of testing large codebases and the importance of proving correctness in software development using examples like seL4, a program with 24 lines of code and a machine-checkable proof.

Official source

Related concepts (18)

Vulnerability (computing)

Vulnerabilities are flaws in a computer system that weaken the overall security of the device/system. Vulnerabilities can be weaknesses in either the hardware itself, or the software that runs on the hardware. Vulnerabilities can be exploited by a threat actor, such as an attacker, to cross privilege boundaries (i.e. perform unauthorized actions) within a computer system. To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness.

Acceptance testing

In engineering and its various subdisciplines, acceptance testing is a test conducted to determine if the requirements of a specification or contract are met. It may involve chemical tests, physical tests, or performance tests. In systems engineering, it may involve black-box testing performed on a system (for example: a piece of software, lots of manufactured mechanical parts, or batches of chemical products) prior to its delivery.

Software testing

Software testing is the act of examining the artifacts and the behavior of the software under test by validation and verification. Software testing can also provide an objective, independent view of the software to allow the business to appreciate and understand the risks of software implementation. Test techniques include, but are not necessarily limited to: analyzing the product requirements for completeness and correctness in various contexts like industry perspective, business perspective, feasibility and viability of implementation, usability, performance, security, infrastructure considerations, etc.

Unit testing

In computer programming, unit testing is a software testing method by which individual units of source code—sets of one or more computer program modules together with associated control data, usage procedures, and operating procedures—are tested to determine whether they are fit for use. It is a standard step in development and implementation approaches such as Agile. Before unit testing, capture and replay testing tools were the norm. In 1997, Kent Beck and Erich Gamma developed and released JUnit, a unit test framework that became popular with Java developers.

Integration testing

Integration testing (sometimes called integration and testing, abbreviated I&T) is the phase in software testing in which the whole software module is tested or if it consists of multiple software modules they are combined and then tested as a group. Integration testing is conducted to evaluate the compliance of a system or component with specified functional requirements. It occurs after unit testing and before system testing.

Related lectures (63)

Software Engineering Fundamentals

Introduces the fundamentals of software engineering, covering instruction processing, algorithms, programming languages, abstractions, testing, security, and open source.

GoogleTest, Pytest, Git Submodule/Subtree, Python os.path

Covers Google Test, Pytest, Git submodule/subtree, and Python file manipulation.

Software Quality: Managing Defects and Testing Strategies

Explores managing defects, testing strategies, and challenges in software quality, with real-world examples and case studies.

Testing Actor Systems

Explores testing actor systems, covering principles, Akka's Test Kit, dependencies, interaction with the parent, and actor hierarchies.

Software Testing: Avoiding and Fixing Bugs