The US National Security Agency (NSA) has requested developers worldwide to shun old programming languages like C and C++ which are more prone to hackers to shift to new, memory-safe languages.
Microsoft, Google, and others have flagged vulnerabilities in codes due to memory safety issues and malicious cyber actors can exploit these vulnerabilities for remote code execution or other adverse effects, which can often compromise a device and be the first step in large-scale network intrusions.
“NSA advises organizations to consider making a strategic shift from programming languages that provide little or no inherent memory protection, such as C/C++, to a memory-safe language when possible. Some examples of memory-safe languages are C#, Go, Java, Ruby, and Swift,” the agency said in a new document.
Commonly used languages, such as C and C++, provide a lot of freedom and flexibility in memory management while relying heavily on the programmer to perform the needed checks on memory references.
Simple mistakes can lead to exploitable memory-based vulnerabilities.
“Software analysis tools can detect many instances of memory management issues and operating environment options can also provide some protection, but inherent protections offered by memory-safe software languages can prevent or mitigate most memory management issues,” said the NSA.
Even with a memory-safe language, memory management is not entirely memory safe.
“Several mechanisms can be used to harden non-memory safe languages to make them more memory safe. Analyzing the software using static and dynamic application security testing (SAST and DAST) can identify memory use issues in software,” said the NSA.
“The compilation and execution environment can be used to make it more difficult for cyber actors to exploit memory management issues. Most of these added features focus on limiting where code can be executed in memory and making memory layout unpredictable,” the agency suggested.
