Vulnerable C/C++ code usage in IoT software systems

Alnaeli, Saleh M.; Sarnowski, Melissa; Aman, Sayedul; Abdelgawad, Ahmed; Yelamarthi, Kumar

doi:10.1109/wf-iot.2016.7845497

Cited by 15 publications

(13 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For the systems whose history was analyzed, the last version of the system for each year was used. Then, we used the srcML (www.srcML.org) toolkit [1,11] to parse and analyze each file. The srcML format wraps the statements and structures of the source code syntax with XML elements, allowing tools, such as UnsafeFunsDetector, to use XML APIs to locate pieces of code, such as unsafe functions, and to analyze expressions in a quick and efficient manner.…”

Section: Methodsology For Detecting Unsafe Functionsmentioning

confidence: 99%

“…Figure. 1. shows the change in number of unsafe functions used for the original study [1]. Figure. 2. shows the change in number of unsafe functions for the 4 additional systems studied.…”

Section: Historical Change Of Unsafe Function Frequencymentioning

confidence: 99%

“…This paper was originally presented in 2016 IEEE 3rd World Forum on Internet of Things (WF-IoT) [1]. Additional research has been done to extend the research to examine the security of a much larger group of IoT software systems.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Source Code Vulnerabilities in IoT Software Systems

Alnaeli

Sarnowski

Aman

et al. 2017

Adv. sci. technol. eng. syst. j.

Self Cite

View full text Add to dashboard Cite

show abstract

Section: Methodsology For Detecting Unsafe Functionsmentioning

confidence: 99%

“…Figure. 1. shows the change in number of unsafe functions used for the original study [1]. Figure. 2. shows the change in number of unsafe functions for the 4 additional systems studied.…”

Section: Historical Change Of Unsafe Function Frequencymentioning

confidence: 99%

See 1 more Smart Citation

Source Code Vulnerabilities in IoT Software Systems

Alnaeli

Sarnowski

Aman

et al. 2017

Adv. sci. technol. eng. syst. j.

Self Cite

View full text Add to dashboard Cite

show abstract

“…Table 2 shows a brief overview of the related work, and the following paragraphs explain the work in details. Alnaeli et al [ 42 ] conducted an empirical study using static analysis methods on three C/C++ open-source IoT software packages to identify known vulnerable statements. They created a tool called UnsafeFunsDetector to find unsafe functions that are known to the research community or banned by some compiler producers.…”

Section: Related Workmentioning

confidence: 99%

“…Alnaeli et al [ 43 ] extended their previous work [ 42 ] to empirically examine the vulnerabilities of eighteen open-source IoT software systems, all of which were specifically written in C/C++ for IoT architectures. They found that usage of unsafe functions was still common among the selected systems, and developers were not working to improve the problems that were still present in the selected systems.…”

Section: Related Workmentioning

confidence: 99%

The Presence, Trends, and Causes of Security Vulnerabilities in Operating Systems of IoT’s Low-End Devices

Al-Boghdady

Wassif

El-Ramly

2021

Sensors

View full text Add to dashboard Cite

Internet of Things Operating Systems (IoT OSs) run, manage and control IoT devices. Therefore, it is important to secure the source code for IoT OSs, especially if they are deployed on devices used for human care and safety. In this paper, we report the results of our investigations of the security status and the presence of security vulnerabilities in the source code of the most popular open source IoT OSs. Through this research, three Static Analysis Tools (Cppcheck, Flawfinder and RATS) were used to examine the code of sixteen different releases of four different C/C++ IoT OSs, with 48 examinations, regarding the presence of vulnerabilities from the Common Weakness Enumeration (CWE). The examination reveals that IoT OS code still suffers from errors that lead to security vulnerabilities and increase the opportunity of security breaches. The total number of errors in IoT OSs is increasing from version to the next, while error density, i.e., errors per 1K of physical Source Lines of Code (SLOC) is decreasing chronologically for all IoT Oss, with few exceptions. The most prevalent vulnerabilities in IoT OS source code were CWE-561, CWE-398 and CWE-563 according to Cppcheck, (CWE-119!/CWE-120), CWE-120 and CWE-126 according to Flawfinder, and CWE-119, CWE-120 and CWE-134 according to RATS. Additionally, the CodeScene tool was used to investigate the development of the evolutionary properties of IoT OSs and the relationship between them and the presence of IoT OS vulnerabilities. CodeScene reveals strong positive correlation between the total number of security errors within IoT OSs and SLOC, as well as strong negative correlation between the total number of security errors and Code Health. CodeScene also indicates strong positive correlation between security error density (errors per 1K SLOC) and the presence of hotspots (frequency of code changes and code complexity), as well as strong negative correlation between security error density and the Qualitative Team Experience, which is a measure of the experience of the IoT OS developers.

show abstract

Engagements2 as ‘HCI Material’: Propagating Community Agency, Through Embedded Technologies

Phillips

Gant²,

Jordan³

et al. 2022

Human-Computer Interaction. Theoretical Approaches and Design Methods

View full text Add to dashboard Cite

HCI has material attributes. As a sociotechnical assemblage, HCI mediates and/or translates technologies to public(s) and vice versa. It is malleable, 'made' and crafted and as a material media technology changes our relationships to 'things', each other and our surrounding world. Thinking through HCI as material allows us to unite disciplines with technologies, ensuring that how we conceptualise work is tangible and applicable. Working from this understanding of HCI, allows the authors to contextualise Engagements 2 as an emerging 'material' space uniting art, design and other practices often fractured through disciplinary conventions. Traditionally, public engagement encompasses ways organisations engage with external parties. HCI contemporaries, Public Interest Technologies (PITs) empower public stakeholders and municipalities. PITs unravel intractable problems, through design, data, and delivery, thus providing user agency and yields wider societal benefit(s).We question how digital technologies can transition 'public(s)', to sustainable approaches. In time, Engagements 2 will be commonplace as technologies (PITs, augmented reality, IoT sensing and more) are embedded into public environment(s) if engagement can be defined as a 'craft-able', material concern. The article unites contemporaries in the public realm, social design, and public engagement methods to identify the: pitfalls, benefits, and opportunities. There is a need for creating a 'best practice' roadmap to creative, active engagement. These values go well beyond designing for inclusion and seek for more sustainable and integral interactions, impacts and culture creation.

show abstract

Vulnerable C/C++ code usage in IoT software systems

Cited by 15 publications

References 7 publications

Source Code Vulnerabilities in IoT Software Systems

Source Code Vulnerabilities in IoT Software Systems

The Presence, Trends, and Causes of Security Vulnerabilities in Operating Systems of IoT’s Low-End Devices

Engagements2 as ‘HCI Material’: Propagating Community Agency, Through Embedded Technologies

Contact Info

Product

Resources

About