Thread: Exercise from Jumping into C++ triggers trojan alert

Hello,

I am working through Alex's excellent book, and while doing one of the practice exercises in the 'if statement' chapter which involved modifying a given password checker program

Code:

#include <iostream>
#include <string>
using namespace std;
int main ()
{
string password;
cout << "Enter your password: " << "\n";
getline( cin, password, '\n' );
if ( password == "xyzzy" )
{
cout << "Access allowed" << "\n";
}
else
{
cout << "Bad password. Denied access!" << "\n";
// returning is a convenient way to stop the program
return 0;
}
// continue onward!
}

When I built my modified code, my Kaspersky AV program quarantined it, claiming that it contained a trojan, is it possible that some content of the code has caused this, since the original did not throw this warning?

Code:

#include<iostream>
#include<string>


int main()
{
    std::string uname;
    std::string password;


    std::cout << "Enter your username: " << "\n";
    std::getline( std::cin, uname, '\n');
    std::cout << "Enter your password: " << "\n";
    std::getline( std::cin, password, '\n');


    if(uname == "david" || password == "xyzzz")
    {
        std::cout << "Access granted Dave!" << "\n";
    }


    else if(uname == "claire" || password == "xyxyx")
    {
        std::cout << "Access granted Claire!" << "\n";
    }
    else
    {
        std::cout << "Access Denied!" << "\n";
        return 0;
    }
}

Thank you
Dave

Thanks for your speedy and detailed response, I can now see why this exercise might look unusual for an AV program, as you correctly pointed out, this is a learning exercise on the use of if constructions.

I would assume that in more realistic code, there would be some sort of lookup list elsewhere of allowed combinations which were checked using a loop instead of being hard-coded.

Originally Posted by grumpy

On your program itself, I'd probably check that the username is correct AND they have entered the correct password in order to grant access, not one or the other.

That's a very good point, I hadn't realised the flaw in my logic.

Dave

Of course, for programs that really require top-notch security, the program would try to ensure that both the path where the username is invalid and valid would take the same amount of clock cycles, and of course, simply say "invalid username or password." That way, a hacker cannot tell if the username is valid or not.

That sounds like a fancy way of saying that there should be only one code path in authentication. In order to "to ensure that both the path where the username is invalid and valid would take the same amount of clock cycles" doesn't that mean that you always hash the password input regardless of how valid anything else is?