C and C++: A Security Perspective Security Beyond Memory Safety Using Modern C++ to Avoid Vulnerabilities by DesignMax Hoffmann Security Beyond Memory Safety CppCon 2024 2 Security Beyond Memory Safety Hoffmann Security Beyond Memory Safety CppCon 2024 3 FIFTY SHADES OF SHOOTING YOURSELF IN THE FOOT WITH A RAILGUNMax Hoffmann Security Beyond Memory Safety CppCon 2024 4Max Hoffmann Security Beyond yearsMax Hoffmann Security Beyond Memory Safety CppCon 2024 6Max Hoffmann Security Beyond Memory Safety CppCon 2024 7Max Hoffmann Security Beyond Memory Safety CppCon 2024 8Max Hoffmann Security Beyond Memory

Embracing an Adversarial Mindset for C++ Security Amanda Rousseau 9/18/2024 This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY1 Strategies for Secure C++ DevelopmentWHOAMI 0x401006 Microsoft 0x40100C Offensive 0x40100F Research & Security 0x401018 Engineering 0x40101A (MORSE) CURRENT 0x401000 MALWARE UNICORN AMANDA ROUSSEAU 0x402001 perspectiveFactors Influencing Trends Increased Security Awareness and Practices Adoption of Modern Technologies •secure coding, regular patching, comprehensive security testing •Improved Discovery Methods -

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 11.2 Conditional settings, options and requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 11.3 Build . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 11.7 Sharing the settings and other configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 11.8 . . . . . . . . . . . . . . . . . . . . . . . . . 175 13 Extending Conan 179 13.1 Customizing settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 13.2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 12.2 Conditional settings, options and requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 12.3 Build . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 12.7 Sharing the settings and other configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 12.8 . . . . . . . . . . . . . . . . . . . . . . . . . 210 14 Extending Conan 215 14.1 Customizing settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 14.2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 12.2 Conditional settings, options and requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 12.3 Build . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 12.7 Sharing the settings and other configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 12.8 . . . . . . . . . . . . . . . . . . . . . . . . . 210 14 Extending Conan 215 14.1 Customizing settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 14.2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 12.2 Conditional settings, options and requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 12.3 Build . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 12.7 Sharing the settings and other configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 12.8 . . . . . . . . . . . . . . . . . . . . . . . . . 210 14 Extending Conan 215 14.1 Customizing settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 14.2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 12.2 Conditional settings, options and requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 12.3 Build . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 12.7 Sharing the settings and other configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 12.8 . . . . . . . . . . . . . . . . . . . . . . . . . 210 14 Extending Conan 215 14.1 Customizing settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 14.2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 12.2 Conditional settings, options and requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 12.3 Build . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 12.7 Sharing the settings and other configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 12.8 . . . . . . . . . . . . . . . . . . . . . . . . . 208 14 Extending Conan 213 14.1 Customizing settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 14.2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 12.2 Conditional settings, options and requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 12.3 Build . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 12.7 Sharing the settings and other configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 12.8 . . . . . . . . . . . . . . . . . . . . . . . . . 206 14 Extending Conan 211 14.1 Customizing settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 14.2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179 12.2 Conditional settings, options and requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 12.3 Build . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 12.7 Sharing the settings and other configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 12.8 . . . . . . . . . . . . . . . . . . . . . . . . . 204 14 Extending Conan 209 14.1 Customizing settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209 14.2