Tag Info

New answers tagged

1

Although this is generally a concern, I think the issue is non-existent due to the setup. The applicant sent you some source code. How or why did that happen? Well obviously there are only three possibilities: You gave the applicant an assignment to solve a particular (well-defined) problem to assess his skills. The applicant wants to show off something ...


0

Visual Studio actually warns you if you open a project from an untrusted location (e,g, downloaded or network share). One example how this could be exploited would be with a WPF project: You can reference .NET classes from XAML, and to provide IntelliSense, VS loads and executes the referenced classes at design time. That means an attacker can drop a ...


0

The bottom line is that there is risk. The risk is fairly small as other answers note, but there is a risk. That means you need to ask two questions: What can I do to mitigate the risk? Is the risk high enough that I should care? The second is what you've posited here in this question, but it's the wrong focus for this particular case. The answer to ...


3

Instead of speculating, I actually bothered to do some research on this topic before answering, going to the most authoritative resource I could think of (CVE Details). This comprehensive list of publicly disclosed security exploits is probably the best that one could do to assess the threat levels of various types of software. I didn't take time to read ...


-1

I think you're worried about one of two flavors: sophisticated, exploit-driven malware: unlikely, especially because these are targeted at very specific hardware and/or software and [based on your question] your attacker probably doesn't have that level of system knowledge. things that screw with your environment: malicious prank directives (e.g. deleting ...


0

If the possibility worries you, take an older machine (don't most of us have a few sitting around?), install current version of Linux and compiler &c, copy the source code to it, unplug the network cable (or turn off WiFi), and do the compiles. If anything nasty does happen, it won't* affect anything else. And for malware in the Makefile, run it with ...


11

We have to distinguish several cases: A bug in the compiler. Like every complex program, a compiler might have bugs, and one of those bugs might be exploitable. A Trojan Horse. The attacker may get you to execute some arbitrary code as part of the compilation process. A Makefile, a build.xml, a configure shell script etc. Technically, this is not due to ...


1

Are compilers typically validated to ensure they won't pwn the user machine when compiling some clever piece of code? In general they're too complex and often written using languages in which it's not practical to prove this property. Possibly not with this specific intent, but the notion of fuzz testing compilers is at least known (LLVM can now ...


31

It depends. This piece of makefile could delete your home directory : all: rm -rf ~ So, if you need to use a tool (like cmake or makefile system), then it is not safe. It just depends how malicious the coder is. On the other side, compilers are programmed by people, therefore they got bugs. So, maybe it could be possible that someone found a way to ...


23

I am pretty sure somewhere in the business there are some clever guys who have already created such a hack for a specific language and compiler version. My favorite place to look for something like this would probably be the International Obfuscated C contest - (do not know if there is something comparable for Java). However, in reality, how high do you ...


0

Reading source code: totally safe. Compiling source code: totally safe. Executing compiled binaries: well... that depends. Compiling is just the computer reading the source code and writing its equivalent in binary form. After compilation, you just have 2 documents: one human-readable, and another computer-readable. Unless you get the computer to read (ie ...


2

There shouldn't be any risk just compiling the code. In theory there could be a bug in the compiler that a clever hacker could take advantage of but is sounds extremely unlikely. Be aware that building may be unsafe. For example in C# 'build event' allows you to specify arbitrary command lines to execute before and after building, which is obviously ...


2

Well, I would start with "reviewing their code". Why is there a need to actually run the code? Apart from that, there are a lot of online compilers where you can just put in the code and compile and/or run it. You can make that a requirement: it compiles in this and that online compiler. Here's an example of a page with online compilers: Online compilers ...



Top 50 recent answers are included