SANS Releases List Of Top 25 Most Dangerous Programming Errors In Software

With the intent of raising the bar in software security, a who's who of global security organizations has collaborated in the creation of a list of the 25 most lethal programming errors found in software today, along with tips for fixing them.

The goal is to get developers to clean up their coding and ultimately create more secure software free of prevalent programming errors that most often lead to the vulnerabilities used by cybercriminals. Heavy-hitters, such as Apple, Microsoft, Symantec, RSA, CERT, Mitre, Oracle, the Department of Homeland Security, and the National Security Agency, all had a hand in coming up with the list, which was released today along with specifics on how to mitigate these coding errors.

The Top 25 drew from Mitre's massive Common Weakness Enumeration (CWE) project that documents all types of software weaknesses; to date, the CWE has more than 700 of these flaws listed in its database. "There are hundreds of different kinds of weaknesses that are covered throughout CWE, some of them very obscure. The Top 25 helps developers and customers to focus on the ones that are considered to be the most dangerous at this time. It defines a bar for determining whether software can meet minimum requirements for security," says Steve Christey, who heads up the CWE for Mitre. "[And] it gives nonexperts a tool to get started on addressing this thorny problem at the source."

Chris Wysopal, a member of the group of 41 experts who came up with the list -- which he says is about half Web application flaws and half non-Web app flaws -- says these flaws are rarely tested before software goes out. "In a lot of software, almost none of this stuff is tested for," says the co-founder and CTO of Veracode, which provides application testing services. "A lot of software companies are not doing any security testing at all."

The ultimate goal of the project is to provide developers guidelines for writing inherently more secure code by avoiding these common flaws, and allowing customers to use the list as a foundation for their software purchasing requirements. The Top 25 also will provide a base for colleges teaching secure coding, as well as for employers to ensure their programmers are writing more secure applications.

"No one has been able to point at a consensus until now of what was considered to be bad in software. This is a minimum set of what shouldn't be in software," says Wysopal, who expects organizations to begin using the list as the base for what software they will buy.

Veracode, as well as Fortify Software, says its testing tools to date root out most of the Top 25, and several state governments, including New York, plan to add the Top 25 to their software procurement language. According to SANS, the federal government's Common Criteria program also may add the Top 25 to its guidelines for secure software.

The flaws are organized into three categories -- insecure interaction between components, including errors in input validation, SQL injection, cross-site scripting, and cross-site request forgery; risky resource management, including buffer overflows, external control of critical state data, download of code without an integrity check, and improper initialization; and porous defenses, including improper access control, broken encryption algorithms, hard-coded passwords, and unnecessary privileges.

Two of the errors on the list -- improper input validation and failure to preserve SQL query structure (think SQL injection) -- accounted for more than 1.5 million Website attacks last year, according to SANS.

"Both organizations that develop software and those that procure software need to be concerned about the initial quality of software they develop and deploy, and not simply rely on a cycle of patch and install," says Robert Seacord, technical lead for the Secure Coding Initiative at the Carnegie Mellon Software Engineering Institute CERT Program.

While most of the errors that made the Top 25 are well-known, a couple of them weren't so obvious. Veracode's Wysopal says he was surprised that error-message information leaks made the list. "It sounds innocuous, but an error message can give details on how an application is structured internally and can help attackers find vulnerabilities in the application," he says. "That contributes to an application being compromised over time."

Other organizations that worked on the list included Purdue University, the University of California-Davis, KRvW Associates, Information-Technology Promotion Agency (IPA) in Japan, Cigital, Aspect Security, Secunia, iDefense Labs at VeriSign, Mandiant, Red Hat, Fortify, Hatha Systems, Northern Kentucky University, ThinkSec, Breach Security, New Access SA of Switzerland, Missing Link Security, Tata Consultancy Services (TCS), Secured Sciences Group, SAFECode, Core Security Technologies, Depository Trust & Clearing Corporation, and OWASP.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message