Instructor: Improper Error Handling. 2 2
In this lesson, we're going to talk about 3 3
improper error handling. 4 4
Now, if you've used a computer for any length of time, 5 5
you've probably gotten an error. 6 6
Now, that error can be really detailed or not so detailed. 7 7
It really depends on how it was coded, 8 8
and what we're going to talk about is how a programmer 9 9
should really create a well-written application 10 10
and to be able to handle errors 11 11
and exceptions more gracefully. 12 12
I'm not going to bother to define an error here 13 13
because we all know what errors are, 14 14
but what causes an error? 15 15
Well, errors could be caused by invalid user input, 16 16
a loss of network connectivity 17 17
or another service or process failing. 18 18
Essentially, something went wrong, 19 19
and so we're going to generate some kind of a message. 20 20
Now, when we talk about an error handler, 21 21
this is some kind of coding method 22 22
that's being used to anticipate 23 23
and deal with exceptions that are thrown 24 24
during the execution of a process. 25 25
Now, error handling is critically important for us 26 26
because error handling can prevent the application 27 27
from failing in a way that allows the attacker 28 28
to execute code or perform some sort of injection attack. 29 29
And so if we don't do proper error handling, 30 30
for instance, checking for a buffer 31 31
to make sure it has enough room 32 32
before putting something in it, 33 33
you can have something like a buffer overflow. 34 34
That would allow some kind of an injection attack 35 35
or a code execution to occur. 36 36
And so we want to make sure we're doing proper error handling. 37 37
Let me give you a really silly example here 38 38
using some pseudo code. 39 39
Here is a program I wrote. 40 40
Now, this isn't a real program 41 41
or any real programming language. 42 42
It's just something that looks kind of like code. 43 43
So we call it pseudo code. 44 44
Now, here I am initializing four variables. 45 45
I'm initializing X, Y, Z, and total. 46 46
Then I'm going to take in as input X, Y, and Z from my user. 47 47
Then I have this program, 48 48
and the first thing I'm going to do is I'm going to test, 49 49
is Z equal to zero? 50 50
Now, if Z is equal to zero, 51 51
then I'm going to print to the screen an error message, 52 52
"Z cannot be zero." 53 53
Otherwise, I'm going to do some calculations. 54 54
I'm going to set the value of total 55 55
to X plus Y divided by Z, 56 56
essentially add together X and Y divide by Z 57 57
to give me some sort of a number. 58 58
Now, once I have that, I'm going to print, "The average is," 59 59
and then the variable total that I just calculated. 60 60
This is a really simple program, right? 61 61
But it does show you the concept of error handling. 62 62
Now, let's go through this and see what happens 63 63
if I give some values to X, Y, and Z. 64 64
First, let's say that I have X equals five, 65 65
Y equals 10 and Z equals five. 66 66
What's going to happen? 67 67
Well, we're going to go through. 68 68
We're going to see that Z is five. It's not equal to zero. 69 69
So we're going to skip the error, and do the L statement, 70 70
which in this case means we're going to set the total 71 71
equal to X plus Y divided by Z, 72 72
or five plus 10 divided by five, 73 73
which in this case will be 15 divided by five, 74 74
which gives me three. 75 75
And then I'm going to print that to the screen 76 76
and say the average is three. 77 77
That works perfectly fine. 78 78
All right, so let's take a look at another example. 79 79
This time I'm going to use the same program, 80 80
but I'm going to give X, Y and Z the values 81 81
of five, 10, and zero. 82 82
Now, when I go to run that program, 83 83
the first thing I'm going to test is, 84 84
is Z equal to zero? 85 85
Well, it is, so I'm going to print the error to the screen, 86 86
"Z cannot be zero." 87 87
Now, why do I do this? 88 88
Well, if I didn't have that if-then statement 89 89
and I just said, "Let's just use total and print," 90 90
what would happen? 91 91
I would try to divide by zero. 92 92
And if you know anything about math, 93 93
you know that you cannot divide by zero. 94 94
It'll give you an error. 95 95
And so if I tried to just divide by zero, 96 96
the program would crash. 97 97
I can divide by any other number in the whole world, 98 98
but I cannot divide by zero. 99 99
And so therefore I put in a little bit of error handling 100 100
to prevent the system from crashing. 101 101
Now, let me give you another warning here 102 102
when it comes to error messages. 103 103
Notice in this, I actually used my own error message. 104 104
I said, "Z cannot be zero." 105 105
That was the error message I wanted to present. 106 106
But the warning I want to give you is this, 107 107
sometimes default error messages 108 108
could leak sensitive information. 109 109
Now, what I mean by this is sometimes your programs 110 110
will just give out the error messages by default 111 111
and not something you told them to give. 112 112
So if you're using something 113 113
that's going to be calling a database function, 114 114
and you have an error on the SQL statement, 115 115
it might actually print out the full SQL statement 116 116
including the file pass and stack traces 117 117
and other information that could really be used 118 118
by an attacker to hack your system. 119 119
So when you're creating error messages, 120 120
and you're doing error handling, 121 121
you want to make sure that you're creative 122 122
and think about using custom error handlers 123 123
to be able to prevent accidental leakage, 124 124
just like I did in my little program. 125 125
Because if I didn't have that error message 126 126
and I tried to divide by zero, 127 127
it could have actually done a brain dump 128 128
of the memory onto the screen, 129 129
and that could have had sensitive information in it. 130 130
So by me catching that error before running the application, 131 131
I'm handling that error 132 132
and giving you a message that makes more sense. 133 133
Now, one more area that I like to think about this 134 134
when we talk about errors, 135 135
let's talk about your login system. 136 136
Oftentimes people will create their website, 137 137
and they'll have a login with username and password. 138 138
Well, what if you have a message that looks like this, 139 139
"Error: incorrect password"? 140 140
So I go to your website. I type in my username. 141 141
I type in my password. 142 142
I hit login, and I get a message that says, 143 143
"Error: incorrect password." 144 144
What does this tell me? 145 145
Well, if I'm an attacker, 146 146
this is actually valuable information 147 147
because this tells me the username I submitted was correct, 148 148
but the password was wrong. 149 149
So now I can keep using that username, 150 150
and then I can keep guessing passwords. 151 151
So what would I want to use instead of this? 152 152
Maybe I would use error: incorrect username/password, 153 153
incorrect username or password, something like that 154 154
because then they don't know which one is incorrect. 155 155
And now that makes it harder for them 156 156
to continue to game your system and try to hack into it.