From owner-freebsd-hackers@FreeBSD.ORG Thu Nov 8 07:06:11 2012 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 42B7B2B9 for ; Thu, 8 Nov 2012 07:06:11 +0000 (UTC) (envelope-from sse.auburn.study@gmail.com) Received: from mail-ia0-f182.google.com (mail-ia0-f182.google.com [209.85.210.182]) by mx1.freebsd.org (Postfix) with ESMTP id 0860D8FC15 for ; Thu, 8 Nov 2012 07:06:10 +0000 (UTC) Received: by mail-ia0-f182.google.com with SMTP id k10so2242891iag.13 for ; Wed, 07 Nov 2012 23:06:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=Y+bivWLN7aufpwpW8iaL1NOboEdmrTUIXggZeP7gKFg=; b=zPZCuH/LwjaV9T4GiQx6RqHr6pvavXhXN7yZX46iHS+YcBoClLzcv47Ut55zTWMc1M WlY9dKedgmY8CpAwVDAeDOYiXKIzaF4dJ9v/B+rAlgfkoJtCgxEa7IwvxfSPPpRqya0z Zdi/mua549WYlfN8Eu8aFlTyg3wFhnOzODZr5ekCXDH/ih6phCoqQWZbF0cYRRQ2kAOP /hINlUcx0BQ0OB5USJne9E8Ut+IcTAPYSwO8/ZV4OB3EvAJ4rblGt/97bqKpSPdNx31Q lQ2Qd5YJ9ilqYcM2R0L14PH3DpJOCcNq/Ejug3mCzeWqVqpSN8GgYhnLwFK3WXTXITD0 mzyQ== MIME-Version: 1.0 Received: by 10.50.140.106 with SMTP id rf10mr18976644igb.48.1352358370215; Wed, 07 Nov 2012 23:06:10 -0800 (PST) Received: by 10.64.6.168 with HTTP; Wed, 7 Nov 2012 23:06:10 -0800 (PST) Date: Thu, 8 Nov 2012 01:06:10 -0600 Message-ID: Subject: Buffer Overflow Study at Auburn University - FreeBSD developers I would really appreciate your help! From: Auburn Study To: freebsd-hackers@freebsd.org Content-Type: text/plain; charset=ISO-8859-1 X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Nov 2012 07:06:11 -0000 Hi All, I am a graduate student at Auburn University, working with Dr. Munawar Hafiz. We are working on an empirical study project to understand the software engineering practices used in companies that produce secure software. In particular, we are concentrating on how developers write code to prevent buffer overflow and integer overflow vulnerabilities. We are interested in the software development process: how you develop software, how you test and analyze programs to detect vulnerabilities, and what processes you follow to remove bugs. We are looking into automated tools that software developers use, and are expecting that there is a common insight in the security engineering process that can be reusable. We request your assistance by participating in this research study. We would greatly appreciate it if you would share your experience with us by answering the questions at the end of this email. We may send some follow up questions based on your response in future. Your response(s) will be kept confidential, and will only be aggregated with those of other responders. Please let us know if you have any questions or concerns regarding the study. Thanks in advance for your support. Yasmeen Rawajfih Software Analysis, Transformations and Security Group Auburn University Working under the supervision of: Dr. Munawar Hafiz Assistant Professor Dept. of Computer Science and Software Engineering Auburn University Auburn, AL http://munawarhafiz.com/ Questions: (There are ten questions.) 1. How long have you been a software developer? 2. How long have you been affiliated with FreeBSD? Were you part of the original development team for this software? 3. What is the size of the current code base? 4. Did you follow a coding standard when developing this software? Is it a standard determined by your group? 5. What did you use to manage bug reports in your software? Does it satisfy your requirements? Are there other software options that you would consider switching to? 6. Did you use any compiler options to detect integer overflow vulnerabilities? Do you think that they are useful? 7. Did you use any automated (static or dynamic analysis) tools to detect buffer overflows, integer overflows, or any other bugs? Which tools did you use? Why these tools? 8. Did you use fuzzing? Which tools did you use and why? If you wrote your own fuzzer, why did you write it yourself? Was it written from scratch or by extending some other fuzzing tools? 9. Did you have specific phases during development where you concentrated on fixing security issues? Did you have a test suite, unit tests, or regression tests? 10. Buffer overflows often result from the use of unsafe functions, such as strcpy. Does your software use those? If you use a different string library, why is it used? Is it an in-house library or an off-the-shelf library? Did you migrate your code to use the string library?