Security

This page contains links to various computer-security-related material that I found interesting.

Documents on secure programming

Smashing The Stack For Fun And Profit (lokalna kopia)
- Description: What is a buffer overflow
- Author: Aleph One
- Source: Phrack 49/16
Understanding Malicious Content Mitigation for Web Developers
- Description: What is cross-site scripting
- Source: CERT Advisory CA-2000-02
Secure programming
- Description: Things you need to remember while programming. This document is a summary of the results from the SECPROG mailing list.
- Author: Oliver Friedrichs
- Source: SecurityFocus
- Local copy
Secure Programming for Linux and Unix HOWTO
- Description: A large document describing many problems.
- Author: David A. Wheeler
Secure UNIX Programming FAQ
- Description: A document on secure programming written as an FAQ.
- Author: Thamer Al-Herbish
The Protection of Information in Computer Systems
- Description: Some theory on information protection and a description of modern protection architectures.
- Author: Jerome H. Saltzer, Michael D. Schroeder
Format String Attacks
- Description: Why you should not omit format strings when calling printf-type functions.
- Author: Tim Newsham
- Source: Guardent
- Local copy

Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications
- Description: A very interesting paper about the possibility of automatically generating exploits based only on a copy of a vulnerable and a fixed program.
- Author: David Brumley, Pongsin Poosankam, Dawn Song, Jiang Zheng
- Local copy

Browser Security Handbook
- Description: A one-stop reference to key security properties of contemporary web browsers.
- Author: Michal Zalewski