Businesses must use memory-safe languages or risk exposing themselves to vulnerabilities, tech experts and consumer advocates warn.
Consumer Reports, a product testing nonprofit, published a memory safety report earlier this month. The report supports the argument that companies move from languages like C and C++ to memory-safe programming languages like Rust.
Memory safety refers to programming languages that prevent certain types of memory-related errors, such as buffer overflows, null pointer dereferences, and use-after-free errors, which can lead to crashes, data corruption, and security vulnerabilities. means to prevent
For example, in a buffer overflow attack, the injection of malicious data allows an attacker to take control of a program and rewrite it on the fly to do malicious things, says Forrester Research analyst Andrew Cohn. Mr Wall said.
“Memory safety has always been the root of flaws in the software industry,” he said.
C/C++ programmers have traditionally believed that development was either memory-safe or fast, but not both, says Cornwall. Languages such as Java and Python run on a virtual machine that manages the programmer’s memory, but incurs runtime overhead.
“But recently we’ve seen some new techniques that make it easier to isolate unsafe code,” Cornwall said. “Rust has demonstrated that it can ensure static memory safety imposed by the compiler itself.”
Memory safety gains momentum
Panelists at the Usenix Enigma 2023 conference this week included representatives from Consumer Reports and the non-profit Internet Security Research Group (ISRG) to further discuss the topic of mitigating memory security vulnerabilities. . ISRG is perhaps best known for Let’s Encrypt, the project that sparked the widespread adoption of Transport Layer Security certificates.
In 2020, the ISRG launched a project to improve memory safety. According to Yael Grauer, his manager, the Consumer Reports Security Planner product, which offers advice on how to stay safe online, including the recent memory safety report, thoughts on memory safety are also shared in Consumer Reports. It had been simmering for some time.
“We have had internal discussions about memory safety since at least May 2021,” said Grauer.
The recent public focus on the topic is the culmination of years of effort by various organizations and individuals, she said.
Josh AssCo-Founder and Executive Director of Internet Security Research Group
For example, last month’s Congressional Appropriations bill included a provision requiring the director of the National Cyber Bureau to investigate the security of government memory. In the same month, Google released his Android 13. This is the first Android release in which the majority of new code is written in a memory-safe language. Additionally, his 6.1 LTS version of the Linux kernel, including initial support for Rust, is now generally available. Meanwhile, Grauer said in November, the National Security Agency advised developers to move away from his C and C++ strategically.
Josh Aas, co-founder and executive director of the ISRG, said a major driver of this momentum is that memory safety vulnerabilities can put systems at risk, which can lead to economic loss and It says it can lead to serious consequences such as identity theft.
“It’s a big problem,” he said. “When hospital systems and public services shut down and people have to wait to get treatment or services, whether it’s due to a malware attack or not, memory safety is often the reason. .”
Memory-safe language proponents prefer Rust
Much of the underlying software in the technology industry is written in C or C++. Until Rust was developed, there was no viable alternative to C/C++, Aas says.
“We are now at a point where we have at least one good option, Rust, that is safe without sacrificing performance,” he said.
“There is no other memory-safe language that gives the Linux kernel the performance and modern features you need,” said Aas.
Aas says the first step to memory safety is to write new modules and programs in a memory-safe language. A developer should start with the most security he critical modules.
“If you have data about where memory safety vulnerabilities have occurred in the past, you can start by looking at historical vulnerability data to see where they occurred,” Aas said. says.
Developers without access to such types of data can examine components within the network perimeter, such as those that send and receive data over the network. That’s where the most serious vulnerabilities tend to come in. But developers can also look at software that straddles or manages privilege boundaries with authentication, he said.
In conclusion, Aas said, C and C++ are not safe languages and developers should stay away from them.
“There’s no future where we’re going to get rid of all the cords anytime soon, so they’re going to be around for a long time,” he said. “But we need to start the process of getting rid of it.”
Stephanie Glen is a writer, software developer, and YouTuber based in Jacksonville, Florida. [email protected] Or on LinkedIn.