TL;DR: Ignoring constant replacement leads to severe security risks.

Problems

Vulnerable endpoints
Lack of Testing
Documentation Nobody Reads

Solutions

Enforce constant key replacement
Audit upstream vendors
Automate security checks
Enforce your Documentation with tests
Use invalid defaults to ensure they are always replaced

Context

A major security flaw, PKfail, persisted unnoticed for 12 years, compromising hundreds of devices.

The vulnerability stems from vendors failing to replace a "DO NOT TRUST" Secure Boot master key, a critical step that was neglected despite clear instructions.

This oversight left countless devices open to exploitation, allowing threat actors to bypass security measures and install malicious software.

Sample Code

Wrong

fn generate_pk() -> String {
    "DO NOT TRUST".to_string()
}

// Vendor forgets to replace PK
fn use_default_pk() -> String {
    let pk = generate_pk();
    pk // "DO NOT TRUST" PK used in production
}

Right

fn generate_pk() -> String {
    "DO NOT TRUST".to_string()
    // The documentation tells vendors to replace this value
}

fn use_default_pk() -> String {
    let pk = generate_pk();

    if pk == "DO NOT TRUST" {
        panic!("Error: PK must be replaced before use.");
    }

    pk // Valid PK used in production
}

Detection

[X] Automatic

You can detect this smell by checking for default values that must be replaced before deployment.

Tools like static analyzers and manual code reviews help you identify hardcoded or placeholder keys that should be updated.

Level

[X] Intermediate

AI Generation

AI generators might create this smell unless instructed for context-specific security steps.

You must provide clear instructions to ensure proper key replacement.

AI Detection

AI tools can catch this smell with rules that flag placeholder values through testing and reviews.

Conclusion

Ignoring crucial steps in the security process, such as replacing default keys, can lead to severe vulnerabilities.

This long-lasting flaw emphasizes the need for diligent security practices.

Replace all your documentation with acceptance tests.

Relations

https://maximilianocontieri.com/code-smell-02-constants-and-magic-numbers

https://maximilianocontieri.com/refactoring-011-replace-comments-with-tests

More Info

https://www.techradar.com/pro/security/secure-boot-has-a-major-security-issue-hundreds-of-devices-from-dell-supermicro-and-more-all-affected-heres-what-we-know

Disclaimer

Code Smells are my opinion.

Credits

Photo by Jason Leung on Unsplash

It takes 20 years to build a reputation and a few minutes of cyber-incident to ruin it.

Stephane Nappo

https://maximilianocontieri.com/software-engineering-great-quotes

This article is part of the CodeSmell Series.

https://maximilianocontieri.com/how-to-find-the-stinky-parts-of-your-code

Code Smell 262 - Not Replaced Constants

Comments

Code Smells

More from this blog

AI Coding Tip 031 - Stop Over-Prompting Reasoning Models

AI Coding Tip 030 - Script Your Skills, Not Your Prompts

AI Coding Tip 029 - Stop Using One Model for Everything

AI Coding Tip 028 - Build a Company Brain

AI Coding Tip 027 - Force Code Standards

Problems

Solutions

Context

Sample Code

Wrong

Right

Detection

Tags

Level

AI Generation

AI Detection

Conclusion

Relations

More Info

Disclaimer

Credits

Command Palette

Comments

Code Smells

More from this blog

Problems

Solutions

Context

Sample Code

Wrong

Right

Detection

Tags

Level

AI Generation

AI Detection

Conclusion

Relations

More Info

Disclaimer

Credits