Secure Coding in C and C++

Chapter 1 Running with Scissors

To live without evil belongs only to the gods.

—Sophocles, Fragments, l. 683.

Computer systems are not vulnerable to attack. We are vulnerable to attack through our computer systems.

The W32.Blaster.Worm, discovered “in the wild” on August 11, 2003, is a good example of how security flaws in software make us vulnerable. Blaster can infect any unpatched system connected to the Internet without user involvement. Data from Microsoft suggests that at least eight million Windows systems have been infected by this worm [Lemos 04]. Blaster caused a major disruption as some users were unable to use their machines, local networks were saturated, and infected users had to remove the worm and update their machines.

The chronology ...