C and C++: A Security Perspective Security Beyond Memory Safety Using Modern C++ to Avoid Vulnerabilities by DesignMax Hoffmann Security Beyond Memory Safety CppCon 2024 2 Security Beyond Memory Safety Hoffmann Security Beyond Memory Safety CppCon 2024 3 FIFTY SHADES OF SHOOTING YOURSELF IN THE FOOT WITH A RAILGUNMax Hoffmann Security Beyond Memory Safety CppCon 2024 4Max Hoffmann Security Beyond yearsMax Hoffmann Security Beyond Memory Safety CppCon 2024 6Max Hoffmann Security Beyond Memory Safety CppCon 2024 7Max Hoffmann Security Beyond Memory Safety CppCon 2024 8Max Hoffmann Security Beyond Memory

Embracing an Adversarial Mindset for C++ Security Amanda Rousseau 9/18/2024 This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY1 Strategies for Secure C++ DevelopmentWHOAMI 0x401006 Microsoft 0x40100C Offensive 0x40100F Research & Security 0x401018 Engineering 0x40101A (MORSE) CURRENT 0x401000 MALWARE UNICORN AMANDA ROUSSEAU 0x402001 perspectiveFactors Influencing Trends Increased Security Awareness and Practices Adoption of Modern Technologies •secure coding, regular patching, comprehensive security testing •Improved Discovery Methods -

it.An ABI hash calculation with binary caching in vcpkg ABI Hash Source files Target configuration Compilers Library features Dependency hashes Build system version Environment variables Licensing issues; need to minimize legal risk (covered later in this talk) • Fears of potential security vulnerabilities (covered later in this talk)Problem 4: Building open-source dependencies is hard environmentsCataclysm: Dark Days Ahead Asset cachingProblem 6: Security vulnerabilities in open-source code •Introduction of security vulnerabilities is a risk of consuming open-source • OpenSSL Heartbleed

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 3.5 Initial configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 3.6 . . . . . . . . . . . . . . . . . . . . . . . . . . 157 11.7 Sharing the settings and other configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 11.8 Conan local cache: concurrency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295 15 Configuration 301 15.1 Download cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 4.5 Initial configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 4.6 . . . . . . . . . . . . . . . . . . . . . . . . . . 193 12.7 Sharing the settings and other configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 12.8 Conan local cache: concurrency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334 16 Configuration 339 16.1 Download cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 4.5 Initial configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 4.6 . . . . . . . . . . . . . . . . . . . . . . . . . . 193 12.7 Sharing the settings and other configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 12.8 Conan local cache: concurrency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334 16 Configuration 339 16.1 Download cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .