15
$\begingroup$

My first website with a login form had the password hardcoded in the JavaScript code, and if the entered password matched it would redirect to a private URL that was just not linked anywhere, but still public if anyone knew the URL, and yes, that URL was also hardcoded in the JavaScript code.

So in terms of security this was basically a "Do not read" banner, with the "private" content just written below it.

Now, this is just a specific example of me not knowing any better in the early days of web development. There are many other domains in programming where you might introduce vulnerabilities if you don't think about what you're doing.

Is there a generic technique to teach students to keep an eye on their code's security, maybe trying to get them into figuratively hacking their own programs and exploit vulnerabilities?

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ Is this really something you want to incorporate into programming courses? In my experience, courses work better when they focus on one, or a few closely related topics. So, I'd suggest a separate security course in the curriculum. $\endgroup$
    – user24
    May 23, 2017 at 19:05
  • $\begingroup$ I was thinking about beginners here. I know there are CS master's courses that explicitly focus on detecting vulnerabilities (network security, for example). $\endgroup$
    – Floern
    May 24, 2017 at 11:14

6 Answers 6

Reset to default
14
$\begingroup$

Make it into an assignment/game. Each student creates a project that is passed to another, randomly chosen student, to hack. Give points for both the project and the "hacking" results. The hacking assignment should also be graded.

Security has to be taught and the value learned, usually painfully. I have lived through many "no one will do that!" only to have a product, or network, broken because someone did.

Improve this answer
$\endgroup$
6
  • 1
    $\begingroup$ If someone finds a flaw in your app, you lose 1 credit. Who finds it first gets 1 extra credit. Let the games begin! $\endgroup$
    – ecc
    May 24, 2017 at 7:50
  • $\begingroup$ How would I handle the case when there are no flaws in the code? You can't assign points for flaws that don't exist. So you'd have to require the students to explain why there is no flaw? $\endgroup$
    – Floern
    May 24, 2017 at 11:10
  • 1
    $\begingroup$ @ecc When the course objective is not related to security, it is inappropriate to deduct points for security flaws. $\endgroup$
    – user24
    May 24, 2017 at 12:09
  • 1
    $\begingroup$ @Keelan I disagree. For example in a C class, code that could have buffer overflows should lose points. $\endgroup$
    – Eric Johnson
    May 25, 2017 at 11:41
  • 2
    $\begingroup$ @EricJohnson that depends. If the course objective is to implement algorithms, it is not really relevant. As a rule of thumb, I would say don't grade what you don't teach. $\endgroup$
    – user24
    May 25, 2017 at 11:43
4
$\begingroup$

As mentioned in other answer making education like a game is good idea.

You can use SQL Injection as one of the examples, other like password to be word from the web page itself, other can be default username/passwords like root/root, admin/admin and so on. During the class you mention this keyword (SQL for example) and give them as home work URL to dig.

Further you can create teams which can try to work together on specific challenge. Also those teams can create some site, program, etc and give to other team as challenge to hack.

Improve this answer
$\endgroup$
2
$\begingroup$

I would just try to make resources available to them and make sure to give examples of what not to do (e.g. Your example). In terms of resources, I'd provide info about attack vectors, threat models, etc. Specifically I'd provide the OWASP top 10.

Improve this answer
$\endgroup$
2
$\begingroup$

Security vulnerabilities are just bugs. In your example the code does not do what it is supposed to do (keep the bad people out).

So treat them this way. “We have a bug. The program does not meet its security requirement of …”.

The worse thing we can do (and I have seen this in classes), is to demonstrate bad code, unless it is part of a “What is wrong with this?”. I have seen a teacher present this as an example of how to do things (a lesson on selection).

if entered_password == "fred1234":
    print ("welcome")

I have heard the argument that doing this properly would be do difficult for a beginner class. I agree. I would not try to fix this program. I would just present a different program.

I have seen a lot of bad practice taught, that then needs to be untaught latter on. When I was a software engineer, it was often me un-teaching new recruits. This was not easy when they were not good at critical thinking, and saw what they were taught as truth.

Improve this answer
$\endgroup$
2
$\begingroup$

Emphasize the 'stupidity' of security holes - they aren't weaknesses that only geniuses with a bone to pick can root out, they're the same mistakes repeated ad nauseam between different companies, therefore every application is liable to run into them. Using the CWSS (common weakness scoring system) the highest priority vulnerabilities are SQL Injection, OS Command Injection and classic buffer overflow. (full list)

As other answers have said, a game is the best approach; preferably a readymade "Please hack me" style website for them to attack.

Example

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ Welcome to Computer Science Educators! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. $\endgroup$
    – ItamarG3
    Aug 10, 2017 at 16:23
1
$\begingroup$

I would have a "guest lecturer" who was a cybersecurity professional teach one class. (Maybe I would give a test on the lecture the following day.)

Most CS instructors are aware of security problems connected with software, but not all of them understand the hardware issues. Unless you happen to have a professional cybersecurity background, you may be better off "farming out" that one session to someone that does. In such matters, you want to present an integrated view, or at least one that is as fully integrated as you can make it.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.