Top 25 most dangerous mistakes in software development

Once a year, the CWE and SANS Institute publish a study into the 25 most commonly made programming mistakes that can, ultimately, lead to critical vulnerabilities in software. In this year's "Top 25 Most Dangerous Software Errors" the top of the bottom of the pile is SQL injection, which is the result of unfiltered or poorly filtered parameters.

Using SQL injection, an attacker can often get access to an entire system's data, which can lead to massive information leaks. SQL injection attacks were, along with DDoS attacks, a favourite of the recently disbanded LulzSec and allowed them to release large numbers of user records and passwords, both in plain text and encrypted; as users often use the same password on different systems, those passwords can be the key to other systems too.

In the number two position came OS command injection, which is when unfiltered parameters are used as part of a command to be executed by the underlying operating system. Still in the top three, classic buffer overflows, described as "still pernicious after all these decades", came in third thanks to their ability to allow code to be injected into running applications.

With the Top 25 list, the Institute hopes to inform developers of the potential hazards that can be created by their programming errors and how they can avoid potential vulnerabilities. The list is the result of a collaboration between SANS, MITRE and various European and American experts. This year's list has been ranked using the new Common Weakness Scoring System (CWSS), which quantifies the nature of a weakness and its potential impact.

(djwm)