US National Security Agency tells developers to shun C and C++ programming language

IANS

San Francisco, November 12

The US National Security Agency (NSA) has requested developers worldwide to shun old programming languages like C and C++ which are more prone to hackers to shift to new, memory safe languages.

Microsoft, Google and others have flagged vulnerabilities in codes due to memory safety issues and malicious cyber actors can exploit these vulnerabilities for remote code execution or other adverse effects, which can often compromise a device and be the first step in large-scale network intrusions.

“NSA advises organisations to consider making a strategic shift from programming languages that provide little or no inherent memory protection, such as C/C++, to a memory safe language when possible. Some examples of memory safe languages are C#, Go, Java, Ruby, and Swift,” the agency said in a new document.

Commonly used languages, such as C and C++, provide a lot of freedom and flexibility in memory management while relying heavily on the programmer to perform the needed checks on memory references.

Simple mistakes can lead to exploitable memory-based vulnerabilities.

“Software analysis tools can detect many instances of memory management issues and operating environment options can also provide some protection, but inherent protections offered by memory safe software languages can prevent or mitigate most memory management issues,” said the NSA.

Even with a memory safe language, memory management is not entirely memory safe.

“Several mechanisms can be used to harden non-memory safe languages to make them more memory safe. Analysing the software using static and dynamic application security testing (SAST and DAST) can identify memory use issues in software,” said the NSA.

“The compilation and execution environment can be used to make it more difficult for cyber actors to exploit memory management issues. Most of these added features focus on limiting where code can be executed in memory and making memory layout unpredictable,” the agency suggested.


#Google

For all the latest Technology News Click Here 

 For the latest news and updates, follow us on Google News

Read original article here

Denial of responsibility! TechNewsBoy.com is an automatic aggregator around the global media. All the content are available free on Internet. We have just arranged it in one platform for educational purpose only. In each content, the hyperlink to the primary source is specified. All trademarks belong to their rightful owners, all materials to their authors. If you are the owner of the content and do not want us to publish your materials on our website, please contact us by email – [email protected]. The content will be deleted within 24 hours.