A Review of the Role of Programming Languages in Cybersecurity Attacks and Prevention

Bashir Jabbarov discusses this in detail in his review.

1. Introduction 

Due to the constantly evolving nature of technology, cybersecurity is always in high demand.  With each advancement comes a new way to commit cybercrime and protect yourself from it. As  technology becomes more mainstream, programming languages are also being used more  frequently to both commit and defend against cybercrime.  

This survey aims to give an overview of programming languages and their relationship with cybersecurity. Given how vital the digital world is, it is more important than ever to stay updated on potential cybersecurity threats. As computer science becomes more mainstream, programming languages will be used even more frequently. In order to shield yourself from potential danger, it is important to keep yourself up to date on how to recognise and protect 
yourself from potential digital threats.  

This survey aims to give an overview of the current relationship between programming languages and how they may be used in the context of cybersecurity. The survey covers an array of cyberattacks: DDoS, an attack with the intent of making a target server unavailable by disrupting a server’s traffic flow; Buffer overflow attacks, a type of attack that targets 
vulnerabilities that occur due to inefficient memory allocation; Man-in-the-middle attacks, a type of attack that involves a third party spying or interfering in an online conversation; Social engineering attacks, which can be characterized by maliciously convincing people into giving out sensitive information; and SQL injection attacks, which occur due to malicious code being put into an SQL query. 

The survey also goes over how mainstream programming languages are often utilised to both  mitigate and conduct the aforementioned attacks.  

Overall, defending against cyber threats will always be immensely important. As technology  continues to improve upon itself, so will cyber attacks and defences. The types of attacks listed  in this survey have similarly persevered throughout the ages, evolving and going through many renditions. Likewise, so have defence measures.  

In the past, works and surveys have examined cybersecurity, programming, and their intersections.

 Surveys such as [i4] and [i5] have explored the topics surrounding cybersecurity. Paper [i4] specifically has gone as far as to explore the relation between cybersecurity and programming languages. Papers akin to [i3] have gone on to explore the intersection of programming and cybersecurity in the context of defensive programming and CS education. Similarly, survey 
papers [i1] and [i2] have explored the technical side of cybersecurity and programming languages. Paper [i1] has explored the requirements for applying cybersecurity, whilst paper [i2] has reviewed cybersecurity and programming choices in relation to it.  

This survey focuses on the foundational interactions between cybersecurity and programming languages, specifically how programming languages can aid or harm security.  

Author of the article: Bashir Jabbarov.

2. Discussion Section 

This survey will cover an array of cyberattacks: DDoS, Buffer overflow, man-in-the-middle attacks, Social engineering, and SQL injection attacks. The paper will discuss each, briefly covering their background and how they work before discussing their relation and interactions with mainstream programming languages. The paper will acknowledge the potential harm and the good programming languages bring in relation to the aforementioned cyberattacks. 

2.1 DDoS 

A DDoS attack, also known as a distributed denial-of-service attack, is an attempt to disrupt a target server’s traffic flow with the intent of making the service unavailable. A DDoS attack, also known as distributed denial-of-service, is an attempt to disrupt a target server’s traffic flow with 
the intent of making the service unusable [10]. It has been shown that DDoS attacks continue to increase and become more of an issue for today’s systems [2]. A common approach to DDoS involves sending a large number of packets to a destination, causing excessive amounts of endpoints and possibly transit network bandwidth to be consumed. These specific variants of DDoS are commonly referred to as packet flooding attacks. 

There has been a lot of work on the connection between DDoS and the development of programming language tools. The first category is about predicting DDoS attacks [1–5]. The detection of DDoS attacks can be classified by their activity level to either preventive or reactive [1]. Some of these works predict DDoS attacks via ML models [2,3]. For example, ARIMA has been used in libraries to detect anomalies that pertain to DDoS attacks [2].  Additionally, there is research on doing such detection in ways other than ML [4,5]. For example, cloud services have been developed to perform DDoS detection [4,5]. 

The second category is for the development of methods for protecting against DDoS attacks [2,7–9]. DDoS attacks can be mitigated and detected through a multitude of ways. For instance, DDoS attacks can be detected using machine learning with the P4 data plane programming language. P4 operates on SDN switches, which allows for a more efficient detection of incoming attacks. To be more exact, the P4 language enables switches to remember handled packets, allowing them to perform attack detection directly at the data plane [6]. Furthermore, the developments in the anomaly detection algorithms now allow for easier DDoS detection and mitigation [2]. Through the use of Frenetic, a network programming language, DDoS anomalies can be detected and mitigated by dropping the packets from the offending bots [8].  

The final category is about tools and software for creating DDoS attacks [11]. Utilities that serve as sources of DDoS attacks are often referred to as attack tools or traffic generators. The following are examples of the programming languages used in such tools [11]. The programming language Java is utilised to operate the traffic generator named SEER [12]. The popular programming language C++ is also utilised to operate D-ITG [13], which is responsible 
for IPv4 and IPv6 traffic generation. Lastly, the very widely used programming language Python is used to aid traffic generators Pylot [14] and Ostinato [15].

2.2 BOF 

Buffer overflow (BOF) attacks can be characterised as vulnerabilities that occur due to inefficient memory allocation in programs. These vulnerabilities can be used by others for malicious intent by overloading the buffer with more information than the space allocated for that buffer. This may lead to additional data being written in critical areas for malicious intent. This is often done 
in order to gain access and damage files without proper authentication.  

The simplest and most popular BOF attack is stack smashing [16]. The stack smashing attack operates by overwriting the return address of a stack. A stack is a region of memory that stores information, such as variables. An attacker overflows a buffer by overwriting the return address of a function within a stack, so that the return address points to the attack code that is injected 
into the stack by the attacker rather than the legitimate call point [17].  

Primarily, the programming languages most vulnerable to BOF attacks are C and C++. This is the result of them prioritising efficiency and performance over security measures, making it susceptible to buffer overflows when used by novice programmers [17,18]. This is caused by allowing programmers to manipulate and have direct access to the program’s memory. In C for 
example, functions such as gets (), strcmp (), strcpy (), scanf (), and memcpy () are particularly vulnerable to buffer overflow attacks as they may impact memory beyond the variables they access [18]. 

Buffer overflow vulnerabilities can also be mitigated through either static or dynamic means. Dynamic testing checks for possible vulnerabilities while the code is running, whereas static testing checks the code prior to its launch. In the case of static code, the tools: Fortify, Checkmarx, and Splint are often used for checks.[19] For dynamic checks, they function by detecting buffer overruns before they occur, thereby preventing attacks from occuring. However, dynamic checks are adopted far less frequently as they cannot adapt to all types of attacks, break pre-existing code, and have a significant overhead. In contrast, static code also incurs a large overhead; however, because the check occurs before the code starts, the overhead is relatively negligible. With more recent developments, more advanced dynamic checks such as CRED (C Range Error Detec tor) came into fruition. Unlike the usual dynamic checks, CRED does not break code, as it utilises a novel solution that supports program manipulation with out-of-bounds addresses. [20] 

2.3 MITM 

In simple terms, a Man-in-the-middle attack is when a third, unauthorised party maliciously eavesdrops on a conversation between two other users [21]. The malware in MitM attacks can also alter the contents of information exchanged between the two users. MitM attackers are also prone to imitating individuals. 

One of the first ever methods of preventing man-in-the-middle attacks was with the wireless encryption standard of Wired Equivalent Privacy (WEP). WEP would work by encrypting data transmitted over radio waves, making attacks pointless as the attackers had no way of decrypting the messages. It should be noted that WEP was a built-in computer system; hence, it was written in low-level languages such as assembly. However, systems that were authorised 
by WEP had access to the shared network, and had been granted the static key, and would be able to decrypt the messages. WEP encrypts its keys using either a 64-bit or 128-bit key in hexadecimal.[22] Though strong for its time, WEP’s efficiency dropped significantly as computing power increased, making exploiting vulnerabilities easier. This would eventually lead to the retirement of WEP in the year 2004.  

After WEP came WPA, or Wi-fi Protected Access. Introduced in 2003 as a replacement for WEP, it improved upon the original’s design. It was similarly written in a low-level language, this time it being C. While WEP provided keys for encryption and decryption, WPA implemented a protocol that dynamically changed keys in order to make it impossible for attackers to manufacture their own keys. To go into more detail, the keys supplied by WPA were also 256-bit, a significant upgrade over WEP. [22] 

However, in today’s day, both WEP and WPA can very well be broken through. Online communication suffers from structural flaws and exploits which allow others to eavesdrop with malicious intent in mind. An example of such tools would be a package called wifimitm, which not only exploits vulnerabilities within systems such as WEP and WPA but also allows for automation of attacks [23]. Wifimitm and other MITM systems accomplish this by disguising themselves as the network gateway, which the data must first travel through in order to get to its destination. Wifimitm is automated to perform attacks on its own, using Python 3.5. By utilising Python 3.5, it is also possible to incorporate the wifimitm package into other Python-based programs.  

On the contrary, tools to mitigate attacks are also compatible with Python.  
For instance, Mininet functions as a network sandbox, allowing users to get a feel for how networks would function in the real world. This allows for penetration testing, giving developers a way to recognise potential flaws [24].

2.4 Social engineering   

Despite its numerous types and ways to do so, the definition of social engineering has not changed over the years. Social engineering refers to the act of maliciously influencing people to give out sensitive information for personal gain[25]. In the modern day, social engineering can come in different forms, such as a phishing email. To mitigate such attacks, proper defences can 
be implemented.  

The programming language Python has seen high usage within the field of cybersecurity. Partially due to its simplistic nature, but primarily because of its access to tools and packages  in free and open source distribution in its open repository. Similarly, Java offers tools such as Vega, an open source tool used primarily for both cross-site scripting testing and penetration testing.[26] This tool is especially relevant to social engineering, as phishing links and emails are often delivered via cross-site scripting. 

Python has also seen use in machine learning algorithms that combat phishing attacks. Using Python, a classification machine learning algorithm can be trained on malicious emails and links to detect phishing attempts. This can be achieved simply by preprocessing dialogs of data and applying a classification algorithm. A Python library, SymSpellpy, can be utilised to check for potential spelling mistakes that would not be present on official websites and emails.  

This classification algorithm would go as far as checking for malicious links and spelling mistakes, and identifying the intent of the message by utilising a pre-made blacklist of words. Finally, the algorithm would give a definitive answer by evaluating the overall reputation of the message using the aforementioned metrics.[27]  

Akin to the good that can be done with the automation of phishing checking, similar damage could be inflicted as well. One of the most successful phishing attacks takes form as an unofficial pop-up urging a user to update an application. Upon downloading the supposedly updated versions of an application, a user would unfortunately be infected. Most curiously, these pop-ups most often pose as Java updates. Whilst it’s not the direct fault of the programming language, the threat is big enough to warrant attention. However, programming languages can very well be used to inflict real damage. Using JavaScript, a website can be reopened and injected with malicious code. Assuming the user was searching for something to download, the script will attempt to download a folder presumably containing what the user was searching for. In actuality, however, the folder will contain malware. [28]

With recent advancements in machine learning and LLMs, spear phishing has also increased. Spear phishing refers to custom-tailored social engineering methods. Due to the nature of spear phishing, attacks can even target a single individual.  In the past, spear phishing attacks were rare because they were very resource-intensive to conduct. However, the advancements in LLMs have made spear phishing significantly more common. LLM agents allow LLMs to work autonomously and take actions on their own. LLM agents would allow an LLM to perform actions such as downloading and creating files. Being an LLM agent would also allow an LLM to react to the changes caused by its actions. This unique toolset could be used for spear phishing, as LLM chatbots are now hard to distinguish from humans and have learned to project 
authority and influence people’s behaviour. The danger is already present, as GPT-3.5 and GPT-4 have already been used to conduct spear phishing attacks on the British Parliament. It’s been found that GPT-conducted attacks were as effective as those conducted by communications professionals, while also being less resource-intensive. [29] 

2.5 SQL Injection  

SQL, also known as Structured Query Language, is one of the most crucial and foundational tools in the modern computer science industry. SQL can be summarised as a language used for data manipulation within databases [30]. With how essential SQL is, there are bound to be ways for people to maliciously exploit its weaknesses for personal gain. One of the biggest ways to exploit SQL is through SQL Injection. 

SQL injection refers to the process of injecting malicious code into an SQL query with the intent of modifying it. Such modifications can allow an attacker to extract valuable information and access the database [31]. Attackers can carry out these attacks primarily in 3 ways. An SQL manipulation attack changes the SQL command within an application. A code injection attack 
adds malicious statements to a pre-existing SQL statement by exploiting a bug. Lastly, function call injection applies a database or operating system function, primarily to manipulate data [32]. 

The primary way to counter SQL injection attacks is through defensive coding. SQLIVs, or SQL injection vulnerabilities, exist because of insufficient input validation. These checks can take the form of simple Input type checkers that verify numeric or string data. If an unnecessary data type is sent, the algorithm can reject it. If needed, checks can be more advanced, with certain algorithms checking for potentially dangerous characters and converting them into safe, readable inputs [33]. 

Additionally, many types of SQL attacks can be countered by utilising pre-made stored procedures in order to eliminate the need for dynamic queries. By avoiding dynamic queries, you prevent SQL injection, since it is impossible to inject additional code. Lastly, a technique referred to as SQL escaping can be used whilst dynamic queries are enabled. SQL escaping refers to replacing special characters with “escape characters” while reading user input. In other 
words, this would cause potential SQL injection attempts to be read as simple data or a string [32]. 

Apart from this, other programming languages can be used to assist SQL defences. Many tools are publicly available for download in order to combat SQL injection attacks. For example, the tool AMNESIA is publicly available and can be run on Java [34]. Java has also seen use as a programming language of choice when creating dynamic network filters that detect SQL injections [31].  

3. Conclusion 

With the constant advances in technology, the aforementioned methods of attacking and defending yourself from cyber attacks will continue to develop. The knowledge of how programming languages could potentially be used to harm or to protect you will increase in necessity as technology advances.  

This survey has given an overview of the current cybersecurity landscape, describing the impact of programming languages on different types of security threats, both in terms of mitigation and protection. As shown, there seems to be a common pattern of attacks and defences evolving as time passes. Despite evolving through many iterations of programming languages, it seems like being wary of attacks and knowing how to defend yourself will always be a high priority.  

For further development, research into a larger number of cyber attacks can be done, expanding upon the 5 types of attacks mentioned in this paper. Future research could also focus on individual programming languages rather than cyber attacks, examining each language and the tools it provides.