Verify your software for security bugs
summary
A practical verification tool is available: BinSecSweeper is open source, Python based, cross‑platform and scans PE & ELF x86-64 binaries to report presence of mitigations and risky patterns. It performs about 30–50 checks (counts functions with stack cookies, detects ASLR DEP SafeSEH Stack Guard PIE, fingerprints compilers and packers), can scan hundreds of files (example run: 285 binaries), outputs HTML/XML/CSV and supports plugins so teams can extend and run it successfully.
AI-written summary · about
chapters (29)
- 0:00Intro
- 1:38TALK OBJECTIVES
- 2:01AGENDA
- 2:38SECURE DEVELOPMENT: VERIFICATION
- 3:32OPENSAMM
- 4:21MICROSOFT SDL
- 5:08IT'S ABOUT SAVING MONEY!
- 7:36OTHER VERIFICATION TOOLS
- 9:051. BINSCOPE
- 10:431. CURRENT VERIFICATION TOOLS
- 14:301. BINARY INTELLIGENCE
- 16:20WHY BINSECSWEEPER?
- 18:49FEATURES
- 21:25BINSECSWEEPER IN ACTION (I)
- 26:39CURRENT WINDOWS CHECKS
- 29:41CURRENT LINUX CHECKS
- 31:412. PLUGIN EXAMPLE: TEST PLUGIN
- 33:062. PLUGIN EXAMPLE: WINDOWS ASLR
- 34:322. PLUGIN EXAMPLE: LINUX FORTIFY_SOURCE
- 35:252. REPORTING
- 36:252. BINSECSWEEPER: WHAT'S NEXT
- 39:022. BINSECSWEEPER: WHERE?
- 40:16TIME FOR SOME ACTION
- 40:56CASE STUDY I: VERIFY YOUR OWN SOFTWARE
- 43:23POSTURE, AMCE INC
- 46:06CASE STUDY III: BROWSER SECURITY COMPARISON
- 48:05VERIFYING SOFTWARE SECURITY POSTURE MATTERSI
- 48:54BINSECSWEEPER: CALL TO ARMS
- 49:49REFERENCES
related talks
18mPreview: Verification (Correctness & Debugging)
35mFriendly Fire: How Security Software Messes Up
24mUsing Python to Detect Vulnerabilities in Binaries
24mHow to Find Secure Software in Open Source Repositories
21mDeveloping secure applications
40mIs Your Code Secure?: Automatic Security Analysis Tools and Systems
16mTooling Design and Lessons Learned from Systematic Evaluations of the Preservation of(…)
45mFinding Vulnerabilities through Static Analysis and Scripting