Microsoft’s Free Security Tools – banned.h

This article in our series focused on Microsoft’s free security tools is on the Security Development Lifecycle (SDL) banned.h header file. This is an important tool for developers who are trying to minimize the number of security vulnerabilities that exist in the C or C++ code they write.  It’s also important for IT Professionals to know about this tool as they can ask the ISVs and developers of the applications they deploy and operate in their environments whether they were developed using banned.h.

The banned.h header file is a sanitizing resource that is designed to help developers avoid using and help identify and remove banned functions from code that may lead to vulnerabilities. Banned functions are those calls in code that have been deemed dangerous by making it relatively easy to introduce vulnerabilities into code during development.  For example, if a developer decided to use the strcpy function in his/her code, using banned.h in the same application will generate error(s) when its recompiled telling the developer that strcpy has been deprecated.  When the developer investigates why the error is being generated, they will likely figure out that strcpy has been replaced with a more secure version called strcpy_s, that makes it more difficult to make mistakes that lead to simple buffer overflows.

Any code that is exposed to the internet or is used to process personally identifiable information should be verified to see if banned application programming interfaces (APIs) are present.  By removing banned APIs, developers can help minimize an application’s risk exposure and ultimately improve the customer experience.

Banned.h is designed to provide a list of all banned APIs so that developers can quickly locate them in the code and address each accordingly.  To illustrate how banned.h works, I’ve provide a screen shot below of an application loaded into a compiler using banned.h.

In this example we have inserted the following code (circled in Red):

#include “banned.h”

Then by recompiling the code we can see which APIs have been banned by the Microsoft Security Development Lifecycle. In the example above, we can see the banned APIs in the Output box highlighted in Red at the bottom of the screen shot.  Existing code that has banned APIs identified should either be replaced with a more secure version or re-architected so that the banned function is not used.

If you are interested in learning more about the Security Development Lifecycle Banned.h header file, I encourage you to check out these resources:

Tim Rains
Director, Trustworthy Computing