C and C++: A Security Perspective Security Beyond Memory Safety Using Modern C++ to Avoid Vulnerabilities by DesignMax Hoffmann Security Beyond Memory Safety CppCon 2024 2 Security Beyond Memory Safety Hoffmann Security Beyond Memory Safety CppCon 2024 3 FIFTY SHADES OF SHOOTING YOURSELF IN THE FOOT WITH A RAILGUNMax Hoffmann Security Beyond Memory Safety CppCon 2024 4Max Hoffmann Security Beyond yearsMax Hoffmann Security Beyond Memory Safety CppCon 2024 6Max Hoffmann Security Beyond Memory Safety CppCon 2024 7Max Hoffmann Security Beyond Memory Safety CppCon 2024 8Max Hoffmann Security Beyond Memory

Embracing an Adversarial Mindset for C++ Security Amanda Rousseau 9/18/2024 This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY1 Strategies for Secure C++ DevelopmentWHOAMI 0x401006 Microsoft 0x40100C Offensive 0x40100F Research & Security 0x401018 Engineering 0x40101A (MORSE) CURRENT 0x401000 MALWARE UNICORN AMANDA ROUSSEAU 0x402001 •advanced adversaries •Game hackers How: •Looking at the trust between medium to high integrity levels •Configurations •Filesystem Lateral movement Who: •Financial criminals •advanced adversaries

standards with shipping implementations and developer tooling and familiarity A choice of abstraction levels to suit different markets and developer needs OpenVX SC Extension – 2017 Graph-based vision and Polls 29SAFETY & SECURITY ▪ What is safety? ▪ Limiting the (accidental) damage to a system caused by bugs ▪ Prefer prevention (compile-time) over detection (run-time) ▪ What is security? ▪ Mitigating identifying the problem ▪ Not much in the way of principles to apply ▪ Formation of SG23 - Safety and Security Kona 2022 Evening Session 38DIRECTION GROUP40 Basic Tenets ▪ Do not radically break backwards

runtime checks static analysis verification formal proofs optimisation safety diagnose bugs security correctness tooling support annotations debugging expressivity performance40 Copyright (c) undefined (assume semantic) • Constrain the possible evaluation semantics in code ("labels", "contract levels", "explicit semantics" → P2755) • pre / post on function pointers ("function usage types" → P3271) @timur_audio | https://timur.audio Are P2900 Contracts the solution to safety & security in C++?170 Copyright (c) Timur Doumler | @timur_audio | https://timur.audio • Contract

surrounding Devops. The Conan team has created the “Conan series” on JFrog Academy, which includes several levels of courses covering both beginner concepts and advanced scenarios. The courses are completely free Description: A toolkit for the Transport Layer Security (TLS) and Secure Sockets␣ ˓→Layer (SSL) protocols Topics: conan, openssl, ssl, tls, encryption, security Recipe: Cache Binary: Cache Binary remote: lock --json=build_order.json The resulting build_order.json file is a list of lists, structured by levels of possible parallel builds: [ # First level liba [["liba/0.1@user/testing", "5ab8...1ac9", "host"

surrounding Devops. The Conan team has created the “Conan series” on JFrog Academy, which includes several levels of courses covering both beginner concepts and advanced scenarios. The courses are completely free Description: A toolkit for the Transport Layer Security (TLS) and Secure Sockets␣ ˓→Layer (SSL) protocols Topics: conan, openssl, ssl, tls, encryption, security Recipe: Cache Binary: Cache Binary remote: lock --json=build_order.json The resulting build_order.json file is a list of lists, structured by levels of possible parallel builds: [ # First level liba [["liba/0.1@user/testing", "5ab8...1ac9", "host"

surrounding Devops. The Conan team has created the “Conan series” on JFrog Academy, which includes several levels of courses covering both beginner concepts and advanced scenarios. The courses are completely free Description: A toolkit for the Transport Layer Security (TLS) and Secure Sockets␣ ˓→Layer (SSL) protocols Topics: conan, openssl, ssl, tls, encryption, security Recipe: Cache Binary: Cache Binary remote: lock --json=build_order.json The resulting build_order.json file is a list of lists, structured by levels of possible parallel builds: [ # First level liba [["liba/0.1@user/testing", "5ab8...1ac9", "host"

surrounding Devops. The Conan team has created the “Conan series” on JFrog Academy, which includes several levels of courses covering both beginner concepts and advanced scenarios. The courses are completely free Description: A toolkit for the Transport Layer Security (TLS) and Secure Sockets␣ ˓→Layer (SSL) protocols Topics: conan, openssl, ssl, tls, encryption, security Recipe: Cache Binary: Cache Binary remote: lock --json=build_order.json The resulting build_order.json file is a list of lists, structured by levels of possible parallel builds: [ # First level liba [["liba/0.1@user/testing", "5ab8...1ac9", "host"

surrounding Devops. The Conan team has created the “Conan series” on JFrog Academy, which includes several levels of courses covering both beginner concepts and advanced scenarios. The courses are completely free Description: A toolkit for the Transport Layer Security (TLS) and Secure Sockets␣ ˓→Layer (SSL) protocols Topics: conan, openssl, ssl, tls, encryption, security Recipe: Cache Binary: Cache Binary remote: lock --json=build_order.json The resulting build_order.json file is a list of lists, structured by levels of possible parallel builds: [ # First level liba [["liba/0.1@user/testing", "5ab8...1ac9", "host"

surrounding Devops. The Conan team has created the “Conan series” on JFrog Academy, which includes several levels of courses covering both beginner concepts and advanced scenarios. The courses are completely free Description: A toolkit for the Transport Layer Security (TLS) and Secure Sockets␣ ˓→Layer (SSL) protocols Topics: conan, openssl, ssl, tls, encryption, security Recipe: Cache Binary: Cache Binary remote: lock --json=build_order.json The resulting build_order.json file is a list of lists, structured by levels of possible parallel builds: [ # First level liba [["liba/0.1@user/testing", "5ab8...1ac9", "host"