DOCSLIB.ORG

Integuard: Toward Automatic Protection of Third-Party Web Service Integrations

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Integuard: Toward Automatic Protection of Third-Party Web Service Integrations InteGuard: Toward Automatic Protection of Third-Party Web Service Integrations Luyi Xing, Yangyi Chen, XiaoFeng Wang Shuo Chen Indiana University Bloomington Microsoft Research Bloomington, IN, USA Redmond, WA, USA fluyixing, yangchen, [email protected] [email protected] Abstract—A web application today often utilizes web APIs to has made the web applications complicated and error-prone, incorporate third-party services into its functionality. Such API as discovered in our recent studies [1], [2]. integration, however, is full of security perils: recent studies show that popular web sites using high-profile web services, Logic flaws in web-API integrations. The unique security such as PayPal/Amazon checkouts and Facebook/Google single- challenge such a hybrid web application (i.e., those inte- sign-on (SSO) services, are riddled with logic flaws, enabling a malicious party to shop for free or log into a victim’s account. grating third-party web services) faces is how to securely To address this new threat, techniques need to be developed to coordinate different parties it involves, including the one that facilitate secure integration of third-party web services. integrates the API services (called integrator), the provider To answer this urgent call, we present in this paper of the services and the web clients using the application. InteGuard, the first system that offers security protection Our prior research shows that this is very difficult to be to vulnerable web API integrations. InteGuard operates a done securely: given the diversity in the ways that an API proxy in front of the service integrator’s web site, performing security checks on a set of invariant relations among the HTTP service is integrated and the partial view the integrator and messages the integrator receives during a transaction (e.g., a the API provider share about each other’s code and runtime checkout from a web store or a web SSO). These invariants state, logic flaws in API integration are hard to avoid and link multiple HTTP sessions to a transaction and capture their can often be easily exploited by a malicious party to cause security-critical relations. They also characterize transaction- miscoordinations and bypass security protection [1]. An ex- related communication the proxy cannot directly observe, which happens between the client and the service provider. ample is NopCommerce’s integration of Amazon Payments, InteGuard includes a suite of novel techniques that automati- in which a shopper is supposed to place an order on the cally extract such invariants from a variety of communication web store powered by NopCommerce and pay for the order channels adopted by diverse integrations and achieve effective on Amazon. What has been found is that miscoordination false positive control in this process. Our evaluation shows that can be introduced by a malicious shopper who exploits a InteGuard can defeat complicated exploits on high-profile web services, with little impact on their normal operations. logic loophole in the integration to convince the store that the order has been paid through Amazon and Amazon that the payment should be made to the shopper’s own Amazon I. INTRODUCTION seller account [1]. As another example, some websites’ Recent years have witnessed the growing trend of moving integrations of PayPal Access SSO are found to be evadable, computing from the desktop to the web, which gives rise to a simply by convincing the integrators that a message field huge demand for web applications. To meet such a demand, signed by PayPal is a user’s PayPal ID and PayPal that it web developers increasingly utilize existing web services should contain the person’s mailing address [2]. (e.g., search, map, payment, authentication, etc.) to rapidly The studies we conducted in the past years show that such build up their own applications, through integrating the Ap- logic flaws are pervasive [1]: leading web stores (Buy.com, plication Programming Interfaces (APIs) provided by these JR.com), popular merchant systems (NopCommerce, In- services. For example, many web stores (e.g., Buy.com) terspire) and even mainstream payment service providers call third-party payment APIs provided by cashier services (Amazon) all contain loopholes in their integration code such as PayPal, Amazon Payments and Google Checkout; that enable miscreants to shop for free; important websites more and more websites include single sign-on (SSO) APIs integrating SSO mechanisms of Facebook Connect, Google of Facebook, Google, Yahoo, Twitter, PayPal and others to ID, PayPal Access, etc. are vulnerable to the threat that let their customers log in through these identity providers allows unauthorized parties to log into victims’ accounts (IdP). As a result, today’s web applications become increas- [2]. The problem cannot be solved by solely relying on ingly hybrid, with their program logic distributed across existing techniques like protocol verifications, due to the multiple parties, including not only the websites hosting diversity in the ways an API service is incorporated and these applications and their clients but also various third- used by different integrators, and the limited understanding party API service providers. Such a development, however, each party (the integrator, the provider) has about the other’s behavior (e.g., how the other party verifies a signed message) order ID) need to be found so as to link them to the checkout and the underlying runtime system (e.g., whether Adobe and ensure their consistency (e.g., payment matching price) Flash allows cross-domain communication [3]). So far, little in the presence of other checkouts and unrelated activities has been done to address this emerging security challenge. (e.g., choosing items, etc.). Even more challenging, the merchant-side protection cannot see the session between the Integration protection. Although the above security flaws shopper and PayPal (unlike Waler, which sees the whole can be introduced by all parties involved in an API inte- program, and BLOCK, which sees all the traffic), and has gration, prior research [1], [2] shows that the weakest link to infer its content from what the merchant sends to the remains on the integrator side, whose code appears to be shopper. This requires extracting the parameters related to way more error-prone than that of the provider. Effective the shopper-PayPal interaction from the merchant-shopper integrator protection, therefore, will significantly mitigate communication channels, which are very diverse in different the threats posed to vulnerable integrations. In our research, integrations of even the same API (e.g., HTTP redirect, form, we made the first attempt to find such a solution, with JavaScript, JSON, etc.). Also, the efficacy of this protection an aim to develop a generic and automated technique to critically depends on effective false positive control of traffic protect integrations from exploits. Note that our approach invariants, which needs a novel solution. cannot count on the availability of integration-related source code, as the integrator does not have provider-side code Our work. In this paper, we present a suite of new tech- and often utilizes off-the-shelf integration solutions such as niques to address these challenges, making a first step toward software development kit (SDK) released by the provider or automatic protection of vulnerable web API integrations. commercial software (e.g., Interspire). The approach is also Our approach, called InteGuard, performs security checks expected to work independently of integrations’ semantics on transaction traffic forwarded by a proxy sitting in front (e.g., payment, SSO), which needs human effort to specify. of the integrator’s website. Such a proxy can simply be a An observation we can leverage is that for a specific load balancer operated by most large websites to distribute integrator-side implementation, its interactions with the ser- web traffic to their clusters. For smaller websites, it can be vice provider are rather mechanic: given a small set of run by a trusted intermediary, such as Janrain that integrates client inputs (e.g., items to be purchased, usernames, etc.), major SSO services to offer its customers convenient access the HTTP messages to be exchanged during a multi-party to them [6]. Attached to the proxy is our InteGuard server, integration-related operation like checkouts or SSO (called a which inspects invariants within web traffic before it reaches transaction in the paper) are predictable and the parties in- web servers. The invariants we look at are specified on the volved typically do not perform complicated transformations parameters automatically identified through a simple data- on the content of the messages they receive for response flow analysis that links what the browser can see to the generation. This makes us believe that the invariant relations communication channels the InteGuard server observes, and among those messages’ parameters can be identified and extracted from such channels through an in-depth analysis on utilized to avoid the situation that necessary security checks related HTTP messages, HTML/XML files, JavaScript code, fall through the cracks. etc. From these parameters, invariants are automatically Program invariants have been used to detect faulty appli- generated to bind transactions to an integrator, messages to a cation logics. For example, Waler [4] infers likely invariants transaction and each message within a transaction to its legit- from a web application’s normal operation and analyzes its imate successor. InteGuard achieves effective false-positive source code to find violations. The approach is language- control through strategic selection of normal traffic traces specific and needs source code, which is often unavail- for invariant generation and carefully-designed differential able to an integrator-side protection, particularly when it analyses on the traces. comes to the provider’s program. Simple traffic invariants We put our design to the test against 11 real-world exploits (e.g., session parameters) are employed by BLOCK [5] to reported by prior research [1], [2].
Load more

Recommended publications
  • In-Depth Evaluation of Redirect Tracking and Link Usage
    Proceedings on Privacy Enhancing Technologies ; 2020 (4):394–413 Martin Koop*, Erik Tews, and Stefan Katzenbeisser In-Depth Evaluation of Redirect Tracking and Link Usage Abstract: In today’s web, information gathering on 1 Introduction users’ online behavior takes a major role. Advertisers use different tracking techniques that invade users’ privacy It is common practice to use different tracking tech- by collecting data on their browsing activities and inter- niques on websites. This covers the web advertisement ests. To preventing this threat, various privacy tools are infrastructure like banners, so-called web beacons1 or available that try to block third-party elements. How- social media buttons to gather data on the users’ on- ever, there exist various tracking techniques that are line behavior as well as privacy sensible information not covered by those tools, such as redirect link track- [52, 69, 73]. Among others, those include information on ing. Here, tracking is hidden in ordinary website links the user’s real name, address, gender, shopping-behavior pointing to further content. By clicking those links, or or location [4, 19]. Connecting this data with informa- by automatic URL redirects, the user is being redirected tion gathered from search queries, mobile devices [17] through a chain of potential tracking servers not visible or content published in online social networks [5, 79] al- to the user. In this scenario, the tracker collects valuable lows revealing further privacy sensitive information [62]. data about the content, topic, or user interests of the This includes personal interests, problems or desires of website. Additionally, the tracker sets not only third- users, political or religious views, as well as the finan- party but also first-party tracking cookies which are far cial status.
    [Show full text]
  • Spamming Botnets: Signatures and Characteristics
    Spamming Botnets: Signatures and Characteristics Yinglian Xie, Fang Yu, Kannan Achan, Rina Panigrahy, Geoff Hulten+,IvanOsipkov+ Microsoft Research, Silicon Valley +Microsoft Corporation {yxie,fangyu,kachan,rina,ghulten,ivano}@microsoft.com ABSTRACT botnet infection and their associated control process [4, 17, 6], little In this paper, we focus on characterizing spamming botnets by effort has been devoted to understanding the aggregate behaviors of leveraging both spam payload and spam server traffic properties. botnets from the perspective of large email servers that are popular Towards this goal, we developed a spam signature generation frame- targets of botnet spam attacks. work called AutoRE to detect botnet-based spam emails and botnet An important goal of this paper is to perform a large scale analy- membership. AutoRE does not require pre-classified training data sis of spamming botnet characteristics and identify trends that can or white lists. Moreover, it outputs high quality regular expression benefit future botnet detection and defense mechanisms. In our signatures that can detect botnet spam with a low false positive rate. analysis, we make use of an email dataset collected from a large Using a three-month sample of emails from Hotmail, AutoRE suc- email service provider, namely, MSN Hotmail. Our study not only cessfully identified 7,721 botnet-based spam campaigns together detects botnet membership across the Internet, but also tracks the with 340,050 unique botnet host IP addresses. sending behavior and the associated email content patterns that are Our in-depth analysis of the identified botnets revealed several directly observable from an email service provider. Information interesting findings regarding the degree of email obfuscation, prop- pertaining to botnet membership can be used to prevent future ne- erties of botnet IP addresses, sending patterns, and their correlation farious activities such as phishing and DDoS attacks.
    [Show full text]
  • DIR-ESS-TGOV-SVCS-254 Exhibit 4.5 Third Party Contracts
    State of Texas Department of Information Resources Texas.gov Services Exhibit 4.5 Third Party Contracts DIR-ESS-TGOV-SVCS-254 Page 1 of 10 Texas Department of Information Resources Third-Party Contracts - Software Entry Number of Respondent License Reference Vendor Software Product Name Description Licenses (if Assume (A) or Comment Transferable? Number applicable) Displace (D) SW001 MongoDB mongoDB A free and open-source cross-platform document-oriented database program. Yes A Classified as a NoSQL database program, MongoDB uses JSON-like documents with schemas. SW002 activiti Activiti is an open-source workflow engine written in Java that can execute Yes A business processes described in BPMN 2.0 SW003 Red Hat Red Hat Linux Server Red Hat Enterprise Linux (RHEL) is a Linux distribution developed by Red Hat 20 Yes A and targeted toward the commercial market SW004 Melissa Data Corp Melissa Data Lookups for ZIP Codes, maps, ZIP+4, Carrier Routes, addresses, reverse 1 Yes A phone, IP location, SIC codes, street names, property info and much more SW005 Oracle Oracle WebLogic Suite Oracle WebLogic Suite is an integrated solution for building on-premise cloud 4 Processors. 60 Yes A application infrastructures that span web server, application server and data Users. grid technology tiers. SW006 Oracle Oracle SOA Suite for Oracle Middleware Oracle SOA Suite is a comprehensive, standards-based Middleware Users Yes A software suite to build, deploy and manage integration following the concepts 30. WebLogic Suite of service-oriented architecture (SOA). Users 30. SW007 Symantec Symantec EndPoint Symantec Endpoint Protection, developed by Symantec, is a security software 243 Yes A suite, which consists of anti-malware, intrusion prevention and firewall features for servers and desktops.
    [Show full text]
  • Redirect URL
    July 2012 Redirect URL User Guide Welcome to AT&T Website Solutions SM We are focused on providing you the very best web hosting service including all the tools necessary to establish and maintain a successful website. This document contains information that will help you to redirect pages from your site to other locations. You can use it to create a new Domain Redirection as well. © 2012 AT&T Intellectual Property. All rights reserved. AT&T products and services are provided or offered by subsidiaries and affiliates of AT&T Inc. under the AT&T brand and not by AT&T Inc. AT&T, AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies. All other trademarks are the property of their owners. This document is not an offer, commitment, representation or warranty by AT&T and is subject to change. Your Web Hosting service is subject to the Terms and Conditions (T&Cs), which may be found at http://webhosting.att.com/Terms-Conditions.aspx . Service terms and Fees are subject to change without notice. Please read the T&Cs for additional information. © 2010 AT&T Intellectual Property. All rights re served. AT&T and the AT&T logo are trademarks of AT&T Intellectual Property. Table of ContenContentstststs Introduction ........................................................................................................................................................ 3 Create a New Redirect ...................................................................................................................................
    [Show full text]
  • Detection of Malicious Urls by Correlating the Chains of Redirection in an Online Social Network (Twitter)
    International Journal of Research Studies in Computer Science and Engineering (IJRSCSE) Volume 1, Issue 3, July 2014, PP 33-38 ISSN 2349-4840 (Print) & ISSN 2349-4859 (Online) www.arcjournals.org Detection of Malicious URLs by Correlating the Chains of Redirection in an Online Social Network (Twitter) 1MD.Sabeeha, SK.Karimullah, 2P.Babu 1PG Schalor,CSE, Quba college of engineering and technology 2, Associate professor, QCET, NELLORE ABSTRACT: Twitter is prone to malicious tweets containing URLs for spam, phishing, and malware distribution. Conventional Twitter spam detection schemes utilize account features such as the ratio of tweets containing URLs and the account creation date, or relation features in the Twitter graph. These detection schemes are ineffective against feature fabrications or consume much time and resources. Conventional suspicious URL detection schemes utilize several features including lexical features of URLs, URL redirection, HTML content, and dynamic behavior. However, evading techniques such as time-based evasion and crawler evasion exist. In this paper, we propose WARNINGBIRD, a suspicious URL detection system for Twitter. Our system investigates correlations of URL redirect chains extracted from several tweets. Because attackers have limited resources and usually reuse them, their URL redirect chains frequently share the same URLs. We develop methods to discover correlated URL redirect chains using the frequently shared URLs and to determine their suspiciousness. We collect numerous tweets from the Twitter public timeline and build a statistical classifier using them. Evaluation results show that our classifier accurately and efficiently detects suspicious URLs. We also present WARNINGBIRD as a near real-time system for classifying suspicious URLs in the Twitter stream.
    [Show full text]
  • OWASP Asia 2008 Rsnake.Pdf
    1 Robert Hansen - CEO SecTheory LLC Bespoke Boutique Internet Security Web Application/Browser Security Network/OS Security http://www.sectheory.com/ Advisory capacity to VCs/start-ups Founded the web application security lab http://ha.ckers.org/ - the lab http://sla.ckers.org/ - the forum 2 iHumble I want to explain the history… Only a few know the whole story. Sit back and relax, it’s story time. 3 We’ve all heard these sentiments: “If you find a vulnerability, we ask that you share it with us. If you share it with us, we will respond to you with a time we will fix that hole.” Scott Petry – Director @ Google (We’ll be coming back to this!) 4 It all started four years ago… We found that redirection vulnerabilities were being used by phishers in a number of sites, Visa, Doubleclick, eBay and of course, Google to confuse consumers. Timeframes for fixes: Visa closed their hole down within hours Double Click within days (partially) eBay within weeks Google still hasn’t closed them (~4 years later) Every company agrees it’s a hole. Everyone 5 Word gets out – fast! http://blogs.geekdojo.net/brian/archive/2004/10/14/googlephishing.aspx http://lists.virus.org/dshield-0602/msg00156.html http://blog.eweek.com/blogs/larry_seltzer/archive/2006/03/05/8240.aspx http://thespamdiaries.blogspot.com/2006/03/google-used-as-url-cloaking-device- in.html http://www.docuverse.com/blog/donpark/EntryViewPage.aspx?guid=e08af74b- 8b86-418c-94e0-7d29a7cb91e2 http://email.about.com/od/outlooktips/qt/et043005.htm http://listserv.educause.edu/cgi- bin/wa.exe?A2=ind0511&L=security&T=0&F=&S=&P=15599 http://www.zataz.com/news/13296/google-corrige-une-faille.html http://google.blognewschannel.com/archives/2007/02/22/google-changes-redirects- adds-nofollow-to-blogger/ http://googlesystem.blogspot.com/2007/02/google-redirect-notice.html And others… 6 Everyone has vulns.
    [Show full text]
  • Real-Time Detection System for Suspicious Urls Krishna Prasad Chouty Governors State University
    Governors State University OPUS Open Portal to University Scholarship All Capstone Projects Student Capstone Projects Fall 2015 Real-Time Detection System for Suspicious URLs Krishna Prasad Chouty Governors State University Anup Chandra Thogiti Governors State University Kranthi Sudha Vudatha Governors State University Follow this and additional works at: http://opus.govst.edu/capstones Part of the Digital Communications and Networking Commons, and the Information Security Commons Recommended Citation Chouty, Krishna Prasad; Thogiti, Anup Chandra; and Vudatha, Kranthi Sudha, "Real-Time Detection System for Suspicious URLs" (2015). All Capstone Projects. 164. http://opus.govst.edu/capstones/164 For more information about the academic degree, extended learning, and certificate programs of Governors State University, go to http://www.govst.edu/Academics/Degree_Programs_and_Certifications/ Visit the Governors State Computer Science Department This Project Summary is brought to you for free and open access by the Student Capstone Projects at OPUS Open Portal to University Scholarship. It has been accepted for inclusion in All Capstone Projects by an authorized administrator of OPUS Open Portal to University Scholarship. For more information, please contact [email protected]. REAL-TIMEDETECTION SYSTEM FOR SUSPICIOUS URL’S By Krishna Prasad, Chouty B.Tech, JAWAHARLAL NEHURU TECHNOLOGICAL UNIVERSITY, 2012 AnupChandra, Thogiti B.Tech, JAWAHARLAL NEHURU TECHNOLOGICAL UNIVERSITY, 2011 Kranthi Sudha, Vudatha B.Tech, JAWAHARLAL NEHURU TECHNOLOGICAL UNIVERSITY,
    [Show full text]
  • Comparative Studies of 10 Programming Languages Within 10 Diverse Criteria
    Department of Computer Science and Software Engineering Comparative Studies of 10 Programming Languages within 10 Diverse Criteria Jiang Li Sleiman Rabah Concordia University Concordia University Montreal, Quebec, Concordia Montreal, Quebec, Concordia [email protected] [email protected] Mingzhi Liu Yuanwei Lai Concordia University Concordia University Montreal, Quebec, Concordia Montreal, Quebec, Concordia [email protected] [email protected] COMP 6411 - A Comparative studies of programming languages 1/139 Sleiman Rabah, Jiang Li, Mingzhi Liu, Yuanwei Lai This page was intentionally left blank COMP 6411 - A Comparative studies of programming languages 2/139 Sleiman Rabah, Jiang Li, Mingzhi Liu, Yuanwei Lai Abstract There are many programming languages in the world today.Each language has their advantage and disavantage. In this paper, we will discuss ten programming languages: C++, C#, Java, Groovy, JavaScript, PHP, Schalar, Scheme, Haskell and AspectJ. We summarize and compare these ten languages on ten different criterion. For example, Default more secure programming practices, Web applications development, OO-based abstraction and etc. At the end, we will give our conclusion that which languages are suitable and which are not for using in some cases. We will also provide evidence and our analysis on why some language are better than other or have advantages over the other on some criterion. 1 Introduction Since there are hundreds of programming languages existing nowadays, it is impossible and inefficient
    [Show full text]
  • Modelagem E Simulação Discreta
    Versão 12/05/2021 Brauliro G Leal Modelagem e Simulação Discreta Quarta Edição Juazeiro – BA 2021 Modelagem e Simulação Discreta 2 Copyright© 2016, 2017, 2018, 2019, 2020, 2021 by Brauliro Gonçalves Leal O conteúdo deste livro eletrônico é livre para uso de qualquer natureza desde que citado a fonte. Toda e qualquer parte desta publicação pode ser reproduzida, distribuída ou transmitida de qualquer forma ou por qualquer meio, ou armazenada de qualquer forma ou em qualquer sistema desde que reconhecida a autoria. Atribuição-CompartilhaIgual – esta licença permite que outros remixem, adaptem e criem a partir deste trabalho, mesmo para fins comerciais, desde que lhe atribuam o devido crédito e que licenciem as novas criações sob termos idênticos (creativecommons.org/licenses). e-mail: [email protected] Quarta Edição Eletrônica: maio de 2021 ISBN: a ser feito# O autor Brauliro Gonçalves Leal Professor do Colegiado de Engenharia da Computação Universidade Federal do Vale do São Francisco Avenida Antônio Carlos Magalhães, 510 Santo Antônio Juazeiro/BA – Brasil 48.902-300 e-mail: [email protected] site: www.univasf.edu.br/~brauliro.leal Sobre este documento Este documento foi escrito em LibreOffice (www.libreoffice.org), suas imagens foram produzidas pelo Kolourpaint (www.kolourpaint.org), seus programas foram editados na IDE Code::Blocks (www.codeblocks.org) e compilados com o GNU GCC (gcc.gnu.org). O Sistema Operacional utilizado foi o GNU/Linux Mint Cinnamon. Software livre é a melhor ideia! Modelagem e Simulação Discreta 3 Pois o conforto intelectual e o hábito têm horror das mensagens que os incomodam. Edgar Morin (Le Monde: 20 de abril de 2020) Modelagem e Simulação Discreta 4 Modelagem e Simulação Discreta Prefácio O objetivo principal deste livro é servir de texto para a disciplina Modelagem e Simulação do curso de Engenharia da Computação do Colegiado de Engenharia da Computação da Universidade Federal do Vale do São Francisco.
    [Show full text]
  • TIBCO Iprocess Objects Server Administrator's Guide
    TIBCO iProcess® Objects Server Administrator’s Guide Software Release 11.4 July 2013 Two-Second Advantage® Important Information SOME TIBCO SOFTWARE EMBEDS OR BUNDLES OTHER TIBCO SOFTWARE. USE OF SUCH EMBEDDED OR BUNDLED TIBCO SOFTWARE IS SOLELY TO ENABLE THE FUNCTIONALITY (OR PROVIDE LIMITED ADD-ON FUNCTIONALITY) OF THE LICENSED TIBCO SOFTWARE. THE EMBEDDED OR BUNDLED SOFTWARE IS NOT LICENSED TO BE USED OR ACCESSED BY ANY OTHER TIBCO SOFTWARE OR FOR ANY OTHER PURPOSE. USE OF TIBCO SOFTWARE AND THIS DOCUMENT IS SUBJECT TO THE TERMS AND CONDITIONS OF A LICENSE AGREEMENT FOUND IN EITHER A SEPARATELY EXECUTED SOFTWARE LICENSE AGREEMENT, OR, IF THERE IS NO SUCH SEPARATE AGREEMENT, THE CLICKWRAP END USER LICENSE AGREEMENT WHICH IS DISPLAYED DURING DOWNLOAD OR INSTALLATION OF THE SOFTWARE (AND WHICH IS DUPLICATED IN THE LICENSE FILE) OR IF THERE IS NO SUCH SOFTWARE LICENSE AGREEMENT OR CLICKWRAP END USER LICENSE AGREEMENT, THE LICENSE(S) LOCATED IN THE “LICENSE” FILE(S) OF THE SOFTWARE. USE OF THIS DOCUMENT IS SUBJECT TO THOSE TERMS AND CONDITIONS, AND YOUR USE HEREOF SHALL CONSTITUTE ACCEPTANCE OF AND AN AGREEMENT TO BE BOUND BY THE SAME. This document contains confidential information that is subject to U.S. and international copyright laws and treaties. No part of this document may be reproduced in any form without the written authorization of TIBCO Software Inc. TIBCO, Two-Second Advantage, TIBCO ActiveMatrix BusinessWorks, TIBCO Business Studio, TIBCO Enterprise Message Service, TIBCO Hawk, TIBCO iProcess, TIBCO iProcess Suite, and TIBCO Rendezvous are either registered trademarks or trademarks of TIBCO Software Inc. in the United States and/or other countries.
    [Show full text]
  • Adam Tornhill — «Your Code As a Crime Scene
    Early praise for Your Code as a Crime Scene This book casts a surprising light on an unexpected place—my own code. I feel like I’ve found a secret treasure chest of completely unexpected methods. Useful for programmers, the book provides a powerful tool to smart testers, too. ➤ James Bach Author, Lessons Learned in Software Testing You think you know your code. After all, you and your fellow programmers have been sweating over it for years now. Adam Tornhill uses thinking in psychology together with hands-on tools to show you the bad parts. This book is a red pill. Are you ready? ➤ Björn Granvik Competence manager Adam Tornhill presents code as it exists in the real world—tightly coupled, un- wieldy, and full of danger zones even when past developers had the best of inten- tions. His forensic techniques for analyzing and improving both the technical and the social aspects of a code base are a godsend for developers working with legacy systems. I found this book extremely useful to my own work and highly recommend it! ➤ Nell Shamrell-Harrington Lead developer, PhishMe By enlisting simple heuristics and data from everyday tools, Adam shows you how to fight bad code and its cohorts—all interleaved with intriguing anecdotes from forensic psychology. Highly recommended! ➤ Jonas Lundberg Senior programmer and team leader, Netset AB After reading this book, you will never look at code in the same way again! ➤ Patrik Falk Agile developer and coach Do you have a large pile of code, and mysterious and unpleasant bugs seem to appear out of nothing? This book lets you profile and find out the weak areas in your code and how to fight them.
    [Show full text]
  • Java Auto Grader Santhoshini Rao Chakrapani Governors State University
    Governors State University OPUS Open Portal to University Scholarship All Capstone Projects Student Capstone Projects Spring 2016 Java Auto Grader Santhoshini Rao Chakrapani Governors State University Vasu Babu Dodda Governors State University Sharat Kumar Vasa Governors State University Follow this and additional works at: http://opus.govst.edu/capstones Part of the Computer Sciences Commons Recommended Citation Chakrapani, Santhoshini Rao; Dodda, Vasu Babu; and Vasa, Sharat Kumar, "Java Auto Grader" (2016). All Capstone Projects. 201. http://opus.govst.edu/capstones/201 For more information about the academic degree, extended learning, and certificate programs of Governors State University, go to http://www.govst.edu/Academics/Degree_Programs_and_Certifications/ Visit the Governors State Computer Science Department This Project Summary is brought to you for free and open access by the Student Capstone Projects at OPUS Open Portal to University Scholarship. It has been accepted for inclusion in All Capstone Projects by an authorized administrator of OPUS Open Portal to University Scholarship. For more information, please contact [email protected]. Abstract The aim of the project is to develop a “Java Automatic Grader” for java project assignment. It ensures that every assignment or work given to the students is done in the right way. The student should get automatic evaluation after submitting the assignment. We are implementing each test case in such a way that student should only get marks for satisfying all the requirements of the project assignment in fruitful manner i.e. If the student submits the assignment by reaching all the requirements and the expected result is achieved in the right way, then only the student will get full marks.
    [Show full text]