IoT Penetration Testing Cookbook

How to do it...

Using programmatic examples, we will show how data is stored insecurely and how to remediate storage vulnerabilities.

1. In the following example, sensitive information is insecurely stored in the dynamically allocated memory referenced by key, which is copied to the dynamically allocated buffer, new_key, then processed and eventually deallocated by a call to free(). Because the memory is not cleared, it may be reallocated to another section of the program where the information stored in new_key may be inadvertently leaked:

char *key; /* Initialize secret */ char *new_key; size_t size = strlen(key); if (size == SIZE_MAX) { /* Handle error */ } new_key = (char *)malloc(size+1); if (!new_key) { /* Handle error */ } strcpy(new_key, ...