Top-ranked programming Web tutorials introduce vulnerabilities into software

posted 4 months ago

Researchers from several German universities have checked the PHP codebases of over 64,000 projects on GitHub, and found 117 vulnerabilities that they believe have been introduced through the use of code from popular but insufficiently reviewed tutorials.

programming tutorials vulnerabilities

The process

The researchers identified popular tutorials by inputing search terms such as “mysql tutorial”, “php search form”, “javascript echo user input”, etc. into Google Search.

The first five results for each query were then manually reviewed and evaluated for SQLi and XSS vulnerabilities by following OWASP’s guidelines (Reviewing Code for SQL Injection, Cross Site Scripting Prevention Cheat Sheat). This resulted in the discovery of 9 tutorials containing vulnerable code (6 with SQLi, 3 with XSS).

Based on these, they created two types of queries that they used against the aforementioned data set obtained from GitHub. “We use strict queries to identify known vulnerable patterns in web applications, and normal queries to identify code analogues of tutorial code,” they explained.

The results were, finally, manually reviewed by the researchers.

“Thanks to our framework, we have uncovered over 100 vulnerabilities in web application code that bear a strong resemblance to vulnerable code patterns found in popular tutorials. More alarmingly, we have confirmed that 8 instances of a SQLi vulnerability present in different web applications are an outcome of code copied from a single vulnerable tutorial,” they noted. “Our results indicate that there is a substantial, if not causal, link between insecure tutorials and web application vulnerabilities.”

Conclusions

“[Our findings] suggest that there is a pressing need for code audit of widely consumed tutorials, perhaps with as much rigor as for production code,” they pointed out.

In their research, they evaluated only PHP application code, but their approach can be easily used to evaluate codebases in other programming languages, especially because they have made available their crawler (GithubSpider) and code analogue detector (CADetector) tools.

Unfortunately, such a search can be easily replicated – “even with limited resources such as a standard PC and a broadband DSL connection” – by individuals or groups intent of discovering vulnerabilities in software for future exploitation.

Sources: HelpnetSecurity

Top-ranked programming Web tutorials introduce vulnerabilities into software

STAY UP TO DATE WITH THE LATEST TECH NEWS

We like to read the latest tech news, so we post it here for you to read!

LATEST NEWS

Your battery status is being used to track you online

posted 4 months ago

Battery status indicators are being used to track devices, say researchers from Princeton University – meaning warnings of privacy exposure have come to pass A little-known web standard that lets site owners tell how much battery life a mobile device has left has been found to enable tracking online, a year after privacy researchers warned that it had the potential to do just that. The ba Read More

Top-ranked programming Web tutorials introduce vulnerabilities into software

posted 4 months ago

Researchers from several German universities have checked the PHP codebases of over 64,000 projects on GitHub, and found 117 vulnerabilities that they believe have been introduced through the use of code from popular but insufficiently reviewed tutorials. The process The researchers identified popular tutorials by inputing search terms such as “mysql tutorial”, “php search fo Read More

Google reportedly planning built-in ad-blocking feature for Chrome

posted 4 months ago

On both its mobile and desktop browsers Google plans to introduce an ad-blocking setting in both the mobile and desktop versions of its Chrome browser, according to The Wall Street Journal. The option would be opt-in, and it would remove any and all “unacceptable” ads as defined by Coalition for Better Ads industry group. Those types of ads include pop-up ads, autoplay videos, and wha Read More

10 Reasons Why Your Domains and WordPress Should Be Kept Separate

posted 4 months ago

There are several popular providers that offer both domains and hosting for WordPress. For over a decade, the standard advice has suggested you should forgo convenience and keep your domains and hosting separate. It makes sense to house your site in the same place where you got your domain, especially since many providers offer seamless user interfaces for managing them both and some also offer Read More

OLDER NEWS

Children as young as 13 attending 'smartphone rehab' as concerns grow over screen time

posted 4 months ago

Children refusing to put down their phones is a common flashpoint in many homes, with a third of British children aged 12 to 15 admitting they do not have a good balance between screen time and other activities. But in the US, the problem has become so severe for some families that children as young as 13 are being treated for digital technology addiction. One ‘smartphone rehab’ cen Read More

AI wins $290,000 in Chinese poker competition

posted 4 months ago

An artificial intelligence program has beaten a team of six poker players at a series of exhibition matches in China. The AI system, called Lengpudashi, won a landslide victory and $290,000 (£230,000) in the five-day competition. It is the second time this year that an AI program has beaten competitive poker players. An earlier version of the program, known as Libratus, beat four of the w Read More

Ten Ways Evolving Technology Affects Cybersecurity

posted 4 months ago

The ever-evolving digital age affects cybersecurity more than most people realize. The rate of cybercrimes has grown exponentially and is consistent with the growth of technology. As technology expands and develops, so do the cybercrimes that are committed. Fortunately, as technology has advanced, so has the ability to seek out cybercrimes before they happen and protect people when they Read More

Investigation finds inmates built computers and hid them in prison ceiling

posted 4 months ago

COLUMBUS, Ohio. The discovery of two working computers hidden in a ceiling at the Marion Correctional Institution prompted an investigation by the state into how inmates got access. In late July, 2015 staff at the prison discovered the computers hidden on a plywood board in the ceiling above a training room closet. The computers were also connected to the Ohio Department of Rehabilitation and Co Read More

Two Lines Of Code Are About To Upend A $20 Billion Industry

posted 4 months ago

Imagine you’re on a business trip and killing time at the airport before your next flight. You’re excited to get home because you just put in a bid on the perfect house. The market is competitive and your biggest fear is losing out because of a paperwork glitch. Suddenly, the phone rings. On the other end is the escrow agent. Sure enough, the paperwork is incomplete. For the next 25 m Read More

JOIN US ON FACEBOOK