How I Learned to Stop Fuzzing and Find More Bugs

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "How I Learned to Stop Fuzzing and Find More Bugs"

Transcription

1 How I Learned to Stop Fuzzing and Find More Bugs Jacob West Fortify Software August 3-5, 2007 Las Vegas

2 Agenda Introduction to fuzzing What is fuzzing? Challenges with fuzzing Introduction to static analysis How static analysis works Examples of bugs static analysis is good at finding Untapped potential: Customization Experiment Fuzzing versus static analysis Conclusion

3 What is Fuzzing? Encompasses runtime testing that attempts to induce faults in software systems by inputting random or semi-random values Introduced by Barton Miller at the University of Wisconsin, Madison in 1990 (cs.wisc.edu/~bart/fuzz/)

4 How Fuzzing Works Identify sources of input to a program Permute or generate pseudorandom input Monitor the program for failures Record the input and program state combinations that generate faults Repeat for desired duration

5 Input Sources: File Formats Identify all valid file formats (e.g. JPG, TIFF, PDF, DOC, XLS) Collect a library of valid files Malform a file Consume the file and observe the application

6 Input Sources: Protocols Create bogus messages (e.g. TCP/IP, RPC, SOAP, HTTP) Record-fuzz-replay Enable a sniffer Collect a few thousand messages Fuzz the messages Replace the fuzzed messages Fuzz messages at program boundary

7 Intelligence Dumb fuzzing = modify data randomly Most input will be entirely invalid Can make for good test cases Takes a long time to enumerate valid test cases May test the validation logic of high-level protocols instead of the underlying application Smart fuzzing = aware of data structure Altering content size Replacing null-terminated strings Altering numeric values or flipping signs 0, 2^n +/- 1 Adding invalid headers, altering header values, duplicate headers

8 Challenges: Nebulous File Formats / Protocols No problem for a standard Web application What about? Proprietary Web Services interfaces Network servers Thick client software Difficult to enumerate input sources to fuzz Even harder to generate valid input Requires customization

9 Challenges: Program Semantics / Reachability Example: if (!strcmp(input1, static_string ) { strcpy(buffer2, input2); } Need to provide value of input1 equal to static_string and large value of input2 Requires N*M random inputs to reach bug guarded by two-variable conditions Requires customization

10 Challenges: Identifying Errors Error reporting conventions differ between programs Good design guidelines require programs to mask errors and error details Requires customization

11 Challenges: Completeness / Coverage Microsoft SDL mandates that you run 100,000 iterations per file format/parser. If you find a bug, you reset to 0 and start running another 100,000 with a new random seed. Why? How many input sources were missed? How much of the program was tested? How good were the tests?

12 Advantages Verifiable and reproducible at runtime Scalable to across programs that utilize the same protocol Least effort to find a bug, impossible to ensure completeness, very costly to approach

13 Tools Open Source / Free SPIKE Scratch Peach Commercial Cenzic idefense SPI Dynamics ( /21/fuzz-testing-tools-and-techniques/)

14 chainsaw

15 Static Source Code Analysis Benefits 1000x faster than code review Security knowledge built in Consistent Limitations Does not understand architecture Does not understand application semantics Does not understand social context

16 The Many Faces of Static Analysis Type checking Style checking Program understanding Program verification / Property checking Bug finding Security review

17 Type Checking Taken for granted Imperfect: short s = 0; int i = s; /* the type checker allows this */ short r = i; /* false positive: this will cause a type checking error at compile time. */ /* false negative: passes type checking, fails at runtime */ Object[] objs = new String[1]; objs[0] = new Object();

18 Style Checking Pickier than type checker, might look at Whitespace Naming Deprecated functions gcc -Wall does some style checking typedef enum { red, green, blue } Color; char* getcolorstring(color c) { char* ret = NULL; switch (c) { case red: printf("red"); } return ret; } Tools Lint, PMD

19 Program Understanding Help make sense of a large codebase Tools: Fujaba Klockwork CAST Systems

20 Program Verification / Property Checking Prove that a program has particular properties Partial specification -> property checking Often focuses on temporal safety properties Example: allocated memory must be freed inbuf = (char*) malloc(bufsz); if (inbuf == NULL) return -1; outbuf = (char*) malloc(bufsz); if (outbuf == NULL) return -1; /* memory leak */ Soundness Aspires to Sound WRT the specification : reports all bugs Tools: Praxis, PolySpace, GrammaTech

21 Bug Finding More sophisticated than a style checker Less ambitious than program verification Search code for bug idioms Find high-confidence, low noise results (low false positives) Soundness Aspires to Sound WRT counterexample : never reports a bug that isn t a bug Example: double checked locking if (fitz == null) { synchronized (this) { if (fitz == null) { fitz = new Fitzer(); } } } Tools: FindBugs, Coverity, Klocwork, Prefast

22 Security Review Focus on finding exploitable code Find high-risk code constructs for review (low false negatives) Example int main(int argc, char* argv[]) { char buf1[1024]; char buf2[1024]; char* shortstring = "a short string"; strcpy(buf1, shortstring); /* innocuous use of strcpy */ strcpy(buf2, argv[0]); /* dangerous use of strcpy */... Tools: RATS, ITS4, FlawFinder; Fortify Software and Ounce Labs

23 Security Example: Dataflow Analysis Trace potentially tainted data through the program Report locations where an attacker could take advantage of a vulnerable function or construct buff = getinputfromnetwork(); copybuffer( newbuff, buff ); exec( newbuff ); (command injection vulnerability)

24 A Peek Inside a Static Analysis Tool Analyzer src Front End System Model Analyzer Results Viewer Analyzer Modeling Rules Security Properties

25 Parsing Language support One language/parser is straightforward Lots of combinations is harder Could analyze compiled code Everybody has the binary No need to guess how the compiler works No need for rules but Decompilation can be difficult Loss of context hurts Want to report line numbers

26 Analysis / Rules: Structural Identify bugs in the program's structure Example: calls to gets() FunctionCall: function is [name == "gets"] Structural rule:

27 Analysis / Rules: Structural Identify bugs in the program's structure Example: memory leaks caused by realloc() buf = realloc(buf, 256); Structural rule: FunctionCall c1: ( c1.function is [name == "realloc"] and c1 in [AssignmentStatement: rhs is c1 and lhs == c1.arguments[0] ] )

28 Analysis / Rules: Dataflow Source Rule Following interesting values through the program Example: Command injection vulnerability buff = getinputfromnetwork(); copybuffer( newbuff, buff ); exec( newbuff ); Source rule: Function: getinputfromnetwork() Postcondition: return value is tainted

29 Analysis / Rules: Dataflow Pass-Through Rule Following interesting values through the program Example: Command injection vulnerability buff = getinputfromnetwork(); copybuffer( newbuff, buff ); exec( newbuff ); Pass-through rule: Function: copybuffer() Postcondition: if the second argument is tainted, then the first argument becomes tainted

30 Analysis / Rules: Dataflow Sink Rule Following interesting values through the program Example: Command injection vulnerability buff = getinputfromnetwork(); copybuffer( newbuff, buff ); exec( newbuff ); Sink rule: Function: exec() Precondition: the first argument must not be tainted

31 Analysis / Rules: Control Flow Look for dangerous sequences Example: Double-free while ((node = *ref)!= NULL) { *ref = node->next; free(node); if (!unchain(ref)) { break; } } if (node!= 0) { free(node); return UNCHAIN_FAIL; } (other operations) (other operations) start initial state freed error free(x) free(x)

32 Analysis / Rules: Control Flow Look for dangerous sequences Example: Double-free while ((node = *ref)!= NULL) { *ref = node->next; free(node); if (!unchain(ref)) { break; } } if (node!= 0) { free(node); return UNCHAIN_FAIL; } (other operations) (other operations) start initial state freed error free(x) free(x)

33 Analysis / Rules: Control Flow Look for dangerous sequences Example: Double-free while ((node = *ref)!= NULL) { *ref = node->next; free(node); if (!unchain(ref)) { break; } } if (node!= 0) { free(node); return UNCHAIN_FAIL; } (other operations) (other operations) start initial state freed error free(x) free(x)

34 Common Problems False positives Incomplete/inaccurate model Conservative analysis Missing rules False negatives Incomplete/inaccurate model Forgiving analysis Missing rules

35 Untapped Potential: Customization Improve tool understanding of the program Model the behavior of third-party libraries Describe program semantics Identify program-specific vulnerabilities Enforce specific coding standards Find vulnerabilities in custom interfaces Design for testability Write code knowing that it will be checked

36 Advantages of Static Analysis over Fuzzing Speed Doesn t require running the code Customization has almost no impact on performance Thoroughness Considers every path through the program,

37 Experiment Comparison of fuzzing and static analysis on an open-source code base Without customization With customization

38 Results TBA

39 Summary Static analysis is spot-on for security Important attributes Language support Analysis techniques Rule set Performance Results management Customization Better return on investment with static analysis

40 <end> PDF for talk available here: Send me ! Jacob West Secure Programming with Static Analysis

Secure Programming with Static Analysis. Jacob West jacob@fortify.com

Secure Programming with Static Analysis. Jacob West jacob@fortify.com Secure Programming with Static Analysis Jacob West jacob@fortify.com Software Systems that are Ubiquitous Connected Dependable Complexity U Unforeseen Consequences Software Security Today The line between

More information

Iron Chef: John Henry Challenge

Iron Chef: John Henry Challenge Iron Chef: John Henry Challenge Brian Chess Pravir Chandra Black Hat 3/27/2008 Amsterdam Sean Fay Jacob West Concept We love Iron Chef. We can t cook. Concept Compare tools and manual code review in head-tohead

More information

Fuzzing in Microsoft and FuzzGuru framework

Fuzzing in Microsoft and FuzzGuru framework Fuzzing in Microsoft and FuzzGuru framework OWASP-IL May-2007 John Neystadt jney@microsoft.com Lead Program Manager Forefront Edge, Microsoft Agenda Overview Introduction to Fuzzing FuzzGuru Architecture

More information

Software security assessment based on static analysis

Software security assessment based on static analysis Software security assessment based on static analysis Christèle Faure Séminaire SSI et méthodes formelles Réalisé dans le projet Baccarat cofinancé par l union européenne Context > 200 static tools for

More information

Application Code Development Standards

Application Code Development Standards Application Code Development Standards Overview This document is intended to provide guidance to campus system owners and software developers regarding secure software engineering practices. These standards

More information

Static Analysis Techniques for Testing Application Security. OWASP San Antonio January 31 st, 2008

Static Analysis Techniques for Testing Application Security. OWASP San Antonio January 31 st, 2008 Static Analysis Techniques for Testing Application Security OWASP San Antonio January 31 st, 2008 Dan Cornell dan@denimgroup.com Agenda What is Application Security? What is Static Analysis? Static versus

More information

Static Analysis Techniques for Testing Application Security. OWASP Austin March 25 th, 2008

Static Analysis Techniques for Testing Application Security. OWASP Austin March 25 th, 2008 Static Analysis Techniques for Testing Application Security OWASP Austin March 25 th, 2008 Dan Cornell dan@denimgroup.com Agenda What is Application Security? What is Static Analysis? Static versus Dynamic

More information

Bug hunting. Vulnerability finding methods in Windows 32 environments compared. FX of Phenoelit

Bug hunting. Vulnerability finding methods in Windows 32 environments compared. FX of Phenoelit Bug hunting Vulnerability finding methods in Windows 32 environments compared FX of Phenoelit The goal: 0day What we are looking for: Handles network side input Runs on a remote system Is complex enough

More information

Software Vulnerabilities

Software Vulnerabilities Software Vulnerabilities -- stack overflow Code based security Code based security discusses typical vulnerabilities made by programmers that can be exploited by miscreants Implementing safe software in

More information

A Test Suite for Basic CWE Effectiveness. Paul E. Black. paul.black@nist.gov. http://samate.nist.gov/

A Test Suite for Basic CWE Effectiveness. Paul E. Black. paul.black@nist.gov. http://samate.nist.gov/ A Test Suite for Basic CWE Effectiveness Paul E. Black paul.black@nist.gov http://samate.nist.gov/ Static Analysis Tool Exposition (SATE V) News l We choose test cases by end of May l Tool output uploaded

More information

Why Do Software Assurance Tools Have Problems Finding Bugs Like Heartbleed?

Why Do Software Assurance Tools Have Problems Finding Bugs Like Heartbleed? April 22 WP003 2014 Why Do Software Assurance Tools Have Problems Finding Bugs Like Heartbleed? James A. Kupsch and Barton P. Miller University of Wisconsin-Madison In response to the Heartbleed vulnerability,

More information

Visualizing Information Flow through C Programs

Visualizing Information Flow through C Programs Visualizing Information Flow through C Programs Joe Hurd, Aaron Tomb and David Burke Galois, Inc. {joe,atomb,davidb}@galois.com Systems Software Verification Workshop 7 October 2010 Joe Hurd, Aaron Tomb

More information

*[Bug hunting ] Jose Miguel Esparza 7th November 2007 Pamplona. 2007 S21sec

*[Bug hunting ] Jose Miguel Esparza 7th November 2007 Pamplona. 2007 S21sec *[Bug hunting ] Jose Miguel Esparza 7th November 2007 Pamplona 2007 S21sec AGENDA Finding holes Fuzzing What is this? How to obtain data? Phases Tools Pros and cons Malybuzz What is this? Protocol specifications

More information

Automatic vs. Manual Code Analysis

Automatic vs. Manual Code Analysis Automatic vs. Manual Code Analysis 2009-11-17 Ari Kesäniemi Senior Security Architect Nixu Oy ari.kesaniemi@nixu.com Copyright The Foundation Permission is granted to copy, distribute and/or modify this

More information

Oracle Solaris Studio Code Analyzer

Oracle Solaris Studio Code Analyzer Oracle Solaris Studio Code Analyzer The Oracle Solaris Studio Code Analyzer ensures application reliability and security by detecting application vulnerabilities, including memory leaks and memory access

More information

Common Errors in C/C++ Code and Static Analysis

Common Errors in C/C++ Code and Static Analysis Common Errors in C/C++ Code and Static Analysis Red Hat Ondřej Vašík and Kamil Dudka 2011-02-17 Abstract Overview of common programming mistakes in the C/C++ code, and comparison of a few available static

More information

Secure Software Programming and Vulnerability Analysis

Secure Software Programming and Vulnerability Analysis Secure Software Programming and Vulnerability Analysis Christopher Kruegel chris@auto.tuwien.ac.at http://www.auto.tuwien.ac.at/~chris Testing and Source Code Auditing Secure Software Programming 2 Overview

More information

Automating Security Testing. Mark Fallon Senior Release Manager Oracle

Automating Security Testing. Mark Fallon Senior Release Manager Oracle Automating Security Testing Mark Fallon Senior Release Manager Oracle Some Ground Rules There are no silver bullets You can not test security into a product Testing however, can help discover a large percentage

More information

Tools and Techniques to automate the discovery of Zero Day Vulnerabilities. A.K.A Fuzzing 101

Tools and Techniques to automate the discovery of Zero Day Vulnerabilities. A.K.A Fuzzing 101 Tools and Techniques to automate the discovery of Zero Day Vulnerabilities A.K.A Fuzzing 101 Agenda GEEKZONE Overview of fuzzing techniques Tutorials on specific open-source fuzzers Demonstrations DIY

More information

protocol fuzzing past, present, future

protocol fuzzing past, present, future protocol fuzzing past, present, future luiz eduardo senior systems & security engineer leduardo (at) musecurity.com Hack in the Box 07 - Kuala Lumpur Mu Security, Inc. All Rights Reserved Copyright 2007

More information

NWEN405: Security Engineering

NWEN405: Security Engineering NWEN405: Security Engineering Lecture 15 Secure Software Engineering: Security Evaluation Engineering & Computer Science Victoria University of Wellington Dr Ian Welch (ian.welch@vuw.ac.nz) Waterfall Secure

More information

C Primer. Fall Introduction C vs. Java... 1

C Primer. Fall Introduction C vs. Java... 1 CS 33 Intro Computer Systems Doeppner C Primer Fall 2016 Contents 1 Introduction 1 1.1 C vs. Java.......................................... 1 2 Functions 1 2.1 The main() Function....................................

More information

Security Tools - Hands On

Security Tools - Hands On Security Tools - Hands On SecAppDev 2014 Ken van Wyk, @KRvW! Leuven, Belgium 10-14 February 2014 Caveats and Warnings This is not a sales pitch for any product(s) If you want to talk to a sales person,

More information

The Hacker Strategy. Dave Aitel dave@immunityinc.com. Security Research

The Hacker Strategy. Dave Aitel dave@immunityinc.com. Security Research 1 The Hacker Strategy Dave Aitel dave@immunityinc.com Security Research Who am I? CTO, Immunity Inc. History: NSA->@stake -> Immunity Responsible for new product development Vulnerability Sharing Club

More information

Peach Fuzzer Platform

Peach Fuzzer Platform Fuzzing is a software testing technique that introduces invalid, malformed, or random data to parts of a computer system, such as files, network packets, environment variables, or memory. How the tested

More information

Introduction to Automated Testing

Introduction to Automated Testing Introduction to Automated Testing What is Software testing? Examination of a software unit, several integrated software units or an entire software package by running it. execution based on test cases

More information

Integrating Tools Into the SDLC

Integrating Tools Into the SDLC Integrating Tools Into the SDLC FIRST Conference 2007 The problem Too many organizations have either: Failed to try software security tools at all Tried tools, but became overwhelmed Tools relegated to

More information

Fuzzing Apache OpenOffice

Fuzzing Apache OpenOffice Fuzzing Apache OpenOffice An Approach to Automated Black-box Security Testing Rob Weir April 7th, 2014 Who is Rob? 1) Rob Weir from Westford Massachusetts 2) rob@robweir.com, @rcweir, http://www.linkedin.com/in/rcweir

More information

Towards the Industrial Scale Development of Custom Static Analyzers

Towards the Industrial Scale Development of Custom Static Analyzers Towards the Industrial Scale Development of Custom Static Analyzers John Anton, Eric Bush, Allen Goldberg, Klaus Havelund, Doug Smith, Arnaud Venet Kestrel Technology LLC 4984 El Camino Real #230 Los Altos,

More information

Static Code Analysis Procedures in the Development Cycle

Static Code Analysis Procedures in the Development Cycle Static Code Analysis Procedures in the Development Cycle Tools, Technology, and Process in Engineering at Microsoft Mooly Beeri Microsoft Haifa R&D Center Agenda Static code analysis tools PREfix and PREfast

More information

Source Code Review Using Static Analysis Tools

Source Code Review Using Static Analysis Tools Source Code Review Using Static Analysis Tools July-August 05 Author: Stavros Moiras Supervisor(s): Stefan Lüders Aimilios Tsouvelekakis CERN openlab Summer Student Report 05 Abstract Many teams at CERN,

More information

Hands-on Hacking Unlimited

Hands-on Hacking Unlimited About Zone-H Attacks techniques (%) File Inclusion Shares misconfiguration SQL Injection DNS attack through social engineering Web Server external module intrusion Attack against the administrator/user

More information

Transparent Monitoring of a Process Self in a Virtual Environment

Transparent Monitoring of a Process Self in a Virtual Environment Transparent Monitoring of a Process Self in a Virtual Environment PhD Lunchtime Seminar Università di Pisa 24 Giugno 2008 Outline Background Process Self Attacks Against the Self Dynamic and Static Analysis

More information

DISCOVERY OF WEB-APPLICATION VULNERABILITIES USING FUZZING TECHNIQUES

DISCOVERY OF WEB-APPLICATION VULNERABILITIES USING FUZZING TECHNIQUES DISCOVERY OF WEB-APPLICATION VULNERABILITIES USING FUZZING TECHNIQUES By Michael Crouse Dr. Errin W. Fulp, Ph.D., Advisor Abstract The increasingly high volume of users on the web and their use of web

More information

Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda

Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. Current

More information

The Advantages of Block-Based Protocol Analysis for Security Testing

The Advantages of Block-Based Protocol Analysis for Security Testing The Advantages of Block-Based Protocol Analysis for Security Testing Dave Aitel Immunity,Inc. 111 E. 7 th St. Suite 64, NY NY 10009, USA dave@immunitysec.com February, 4 2002 Abstract. This paper describes

More information

OpenAutonomy Authentication

OpenAutonomy Authentication OpenAutonomy Authentication Open Autonomy Inc. January 2014 Abstract: A system of federated components, such as OpenAutonomy, requires a protocol to authenticate messages between servers so that a message's

More information

Braindumps.C2150-810.50 questions

Braindumps.C2150-810.50 questions Braindumps.C2150-810.50 questions Number: C2150-810 Passing Score: 800 Time Limit: 120 min File Version: 5.3 http://www.gratisexam.com/ -810 IBM Security AppScan Source Edition Implementation This is the

More information

System modeling. Budapest University of Technology and Economics Department of Measurement and Information Systems

System modeling. Budapest University of Technology and Economics Department of Measurement and Information Systems System modeling Business process modeling how to do it right Partially based on Process Anti-Patterns: How to Avoid the Common Traps of Business Process Modeling, J Koehler, J Vanhatalo, IBM Zürich, 2007.

More information

Memory management in C: The heap and the stack

Memory management in C: The heap and the stack Memory management in C: The heap and the stack Leo Ferres Department of Computer Science Universidad de Concepción leo@inf.udec.cl October 7, 2010 1 Introduction When a program is loaded into memory, it

More information

CORBA Programming with TAOX11. The C++11 CORBA Implementation

CORBA Programming with TAOX11. The C++11 CORBA Implementation CORBA Programming with TAOX11 The C++11 CORBA Implementation TAOX11: the CORBA Implementation by Remedy IT TAOX11 simplifies development of CORBA based applications IDL to C++11 language mapping is easy

More information

The Road from Software Testing to Theorem Proving

The Road from Software Testing to Theorem Proving The Road from Software Testing to Theorem Proving A Short Compendium of my Favorite Software Verification Techniques Frédéric Painchaud DRDC Valcartier / Robustness and Software Analysis Group December

More information

Learning objectives for today s session

Learning objectives for today s session Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP Learning objectives for today s session Understand what a black box and white box assessment is and how they differ Identify

More information

Logistics. Software Testing. Logistics. Logistics. Plan for this week. Before we begin. Project. Final exam. Questions?

Logistics. Software Testing. Logistics. Logistics. Plan for this week. Before we begin. Project. Final exam. Questions? Logistics Project Part 3 (block) due Sunday, Oct 30 Feedback by Monday Logistics Project Part 4 (clock variant) due Sunday, Nov 13 th Individual submission Recommended: Submit by Nov 6 th Scoring Functionality

More information

Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP

Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP Learning objectives for today s session Understand different types of application assessments and how they differ Be

More information

Lecture 03 Bits, Bytes and Data Types

Lecture 03 Bits, Bytes and Data Types Lecture 03 Bits, Bytes and Data Types In this lecture Computer Languages Assembly Language The compiler Operating system Data and program instructions Bits, Bytes and Data Types ASCII table Data Types

More information

-.% . /(.0/.1 . 201 . ) 53%/(01 . 6 (01 (%((. * 7071 (%%2 $,( . 8 / 9!0/!1 . # (3(0 31.%::((. ;.!0.!1 %2% . ".(0.1 $) (%+"",(%$.(6

-.% . /(.0/.1 . 201 . ) 53%/(01 . 6 (01 (%((. * 7071 (%%2 $,( . 8 / 9!0/!1 . # (3(0 31.%::((. ;.!0.!1 %2% . .(0.1 $) (%+,(%$.(6 !""#"" ""$"$"# $) ""$"*$"# %%&''$ $( (%( $) (%+"",(%$ -.% Number Phase Name Description. /(.0/.1.(((%( $. 201 2,%%%% %$. %(01 3-(4%%($. ) 53%/(01 %%4.%%2%, ($. 6 (01 (%((. * 7071 (%%2. 8 / 9!0/!1 ((((($%

More information

GSM. Global System for Mobile Communications, 1992. Security in mobile phones. System used all over the world. Sikkerhed04, Aften Trusler

GSM. Global System for Mobile Communications, 1992. Security in mobile phones. System used all over the world. Sikkerhed04, Aften Trusler GSM Global System for Mobile Communications, 1992 Security in mobile phones System used all over the world 1 GSM: Threat Model What Cloning Eavesdropping Tracking Who Criminals Secret Services Why Break

More information

Introduction to Static Analysis for Assurance

Introduction to Static Analysis for Assurance Introduction to Static Analysis for Assurance John Rushby Computer Science Laboratory SRI International Menlo Park CA USA John Rushby Static Analysis for Assurance: 1 Overview What is static analysis?

More information

CSCI E 98: Managed Environments for the Execution of Programs

CSCI E 98: Managed Environments for the Execution of Programs CSCI E 98: Managed Environments for the Execution of Programs Draft Syllabus Instructor Phil McGachey, PhD Class Time: Mondays beginning Sept. 8, 5:30-7:30 pm Location: 1 Story Street, Room 304. Office

More information

X05. An Overview of Source Code Scanning Tools. Loulwa Salem. Las Vegas, NV. IBM Corporation 2006. IBM System p, AIX 5L & Linux Technical University

X05. An Overview of Source Code Scanning Tools. Loulwa Salem. Las Vegas, NV. IBM Corporation 2006. IBM System p, AIX 5L & Linux Technical University X05 An Overview of Source Code Scanning Tools Loulwa Salem Las Vegas, NV Objectives This session will introduce better coding practices and tools available to aid developers in producing more secure code.

More information

Java 7 Recipes. Freddy Guime. vk» (,\['«** g!p#« Carl Dea. Josh Juneau. John O'Conner

Java 7 Recipes. Freddy Guime. vk» (,\['«** g!p#« Carl Dea. Josh Juneau. John O'Conner 1 vk» Java 7 Recipes (,\['«** - < g!p#«josh Juneau Carl Dea Freddy Guime John O'Conner Contents J Contents at a Glance About the Authors About the Technical Reviewers Acknowledgments Introduction iv xvi

More information

Buffer Overflow Vulnerability Detection in the Binary Code

Buffer Overflow Vulnerability Detection in the Binary Code Buffer Overflow Vulnerability Detection in the Binary Code Shehab Gamal El-Dien, Reda Salama, Ahmed Eshak shehab@ispofegypt.com, redasalama@hotmail.com, a_issac@sakhr.com Al-Azhar University, Faculty of

More information

I Control Your Code Attack Vectors Through the Eyes of Software-based Fault Isolation. Mathias Payer, ETH Zurich

I Control Your Code Attack Vectors Through the Eyes of Software-based Fault Isolation. Mathias Payer, ETH Zurich I Control Your Code Attack Vectors Through the Eyes of Software-based Fault Isolation Mathias Payer, ETH Zurich Motivation Applications often vulnerable to security exploits Solution: restrict application

More information

Assurance in Service-Oriented Environments

Assurance in Service-Oriented Environments Assurance in Service-Oriented Environments Soumya Simanta Research, Technology, and System Solutions (RTSS) Program Software Engineering Institute Carnegie Mellon University Pittsburgh 15232 28 th October,

More information

Static Analysis for Software Verification. Leon Moonen

Static Analysis for Software Verification. Leon Moonen Static Analysis for Software Verification Leon Moonen Today s topics Software inspection it s relation to testing benefits and drawbacks Static (program) analysis potential benefits limitations and their

More information

ITDUMPS QUESTION & ANSWER. Accurate study guides, High passing rate! IT dumps provides update free of charge in one year!

ITDUMPS QUESTION & ANSWER. Accurate study guides, High passing rate! IT dumps provides update free of charge in one year! ITDUMPS QUESTION & ANSWER Accurate study guides, High passing rate! IT dumps provides update free of charge in one year! HTTP://WWW.ITDUMPS.COM Exam : 70-549(C++) Title : PRO:Design & Develop Enterprise

More information

Software security specification and verification

Software security specification and verification Software security specification and verification Erik Poll Security of Systems (SoS) group Radboud University Nijmegen Software (in)security specification and verification/detection Erik Poll Security

More information

Comparing Application Security Tools

Comparing Application Security Tools Comparing Application Security Tools Defcon 15-8/3/2007 Eddie Lee Fortify Software Agenda Intro to experiment Methodology to reproduce experiment on your own Results from my experiment Conclusions Introduction

More information

Blind Security Testing

Blind Security Testing Blind Security Testing An Evolutionary Approach Black Hat USA 2007 Scott Stender Vice President, Blind Security Testing An Evolutionary Approach Who are you? Co-Founder and Vice President of Security consultant

More information

The FDA Forensics Lab, New Tools and Capabilities

The FDA Forensics Lab, New Tools and Capabilities U. S. Department of Health and Human Services The FDA Forensics Lab, New Tools and Capabilities Symposium on Static Code Analysis and Complex Medical Devices University of Minnesota July 23, 2009 Static

More information

SQLITE C/C++ TUTORIAL

SQLITE C/C++ TUTORIAL http://www.tutorialspoint.com/sqlite/sqlite_c_cpp.htm SQLITE C/C++ TUTORIAL Copyright tutorialspoint.com Installation Before we start using SQLite in our C/C++ programs, we need to make sure that we have

More information

HEALERS: A Toolkit for Enhancing the Robustness and Security of Existing Applications

HEALERS: A Toolkit for Enhancing the Robustness and Security of Existing Applications HEALERS: A Toolkit for Enhancing the Robustness and Security of Existing Applications Christof Fetzer, Zhen Xiao AT&T Labs Research 180 Park Avenue Florham Park, N.J. 07932 christof, xiao @research.att.com

More information

CODE ASSESSMENT METHODOLOGY PROJECT (CAMP) Comparative Evaluation:

CODE ASSESSMENT METHODOLOGY PROJECT (CAMP) Comparative Evaluation: This document contains information exempt from mandatory disclosure under the FOIA. Exemptions 2 and 4 apply. CODE ASSESSMENT METHODOLOGY PROJECT (CAMP) Comparative Evaluation: Coverity Prevent 2.4.0 Fortify

More information

Building accurate intrusion detection systems. Diego Zamboni Global Security Analysis Lab IBM Zürich Research Laboratory

Building accurate intrusion detection systems. Diego Zamboni Global Security Analysis Lab IBM Zürich Research Laboratory Building accurate intrusion detection systems Diego Zamboni Global Security Analysis Lab IBM Zürich Research Laboratory Outline Brief introduction to intrusion detection The MAFTIA project Accurate intrusion

More information

Extended Static Checking for Java

Extended Static Checking for Java Lukas TU München - Seminar Verification 14. Juli 2011 Outline 1 Motivation 2 ESC/Java example 3 ESC/JAVA architecture VC generator Simplify 4 JML + ESC/Java annotation language JML What ESC/Java checks

More information

Software testing. Objectives

Software testing. Objectives Software testing cmsc435-1 Objectives To discuss the distinctions between validation testing and defect testing To describe the principles of system and component testing To describe strategies for generating

More information

Integrating Web Application Security into the IT Curriculum

Integrating Web Application Security into the IT Curriculum Integrating Web Application Security into the IT Curriculum James Walden Northern Kentucky University Topics 1. 2. 3. 4. Why should we teach web application security? What material do we need to cover?

More information

Detecting Critical Defects on the Developer s Desktop

Detecting Critical Defects on the Developer s Desktop Detecting Critical Defects on the Developer s Desktop Seth Hallem CEO Coverity, Inc. Copyright Coverity, Inc. 2006. All Rights Reserved. This publication, in whole or in part, may not be reproduced, stored

More information

Rake: Semantics Assisted Networkbased Tracing Framework

Rake: Semantics Assisted Networkbased Tracing Framework Rake: Semantics Assisted Networkbased Tracing Framework Yan Chen Lab for Internet and Security Technology (LIST) Northwestern Univ. Joint work with Yao Zhao, Yinzhi Cao, Anup Goyal (NU), and Ming Zhang

More information

Precise XSS Detection with Static Analysis using String Analysis

Precise XSS Detection with Static Analysis using String Analysis Eindhoven University of Technology Department of Mathematics and Computing Science Precise XSS Detection with Static Analysis using String Analysis By Henri Hambartsumyan Thesis submitted in partial fulfilment

More information

Web application security: automated scanning versus manual penetration testing.

Web application security: automated scanning versus manual penetration testing. Web application security White paper January 2008 Web application security: automated scanning versus manual penetration testing. Danny Allan, strategic research analyst, IBM Software Group Page 2 Contents

More information

Towards practical reactive security audit using extended static checkers 1

Towards practical reactive security audit using extended static checkers 1 Towards practical reactive security audit using extended static checkers 1 Julien Vanegue 1 Shuvendu K. Lahiri 2 1 Bloomberg LP, New York 2 Microsoft Research, Redmond May 20, 2013 1 The work was conducted

More information

Design of a secure system. Example: trusted OS. Bell-La Pdula Model. Evaluation: the orange book. Buffer Overflow Attacks

Design of a secure system. Example: trusted OS. Bell-La Pdula Model. Evaluation: the orange book. Buffer Overflow Attacks Stware Security Holes and Defenses Design a secure system Follows a ring design. Every object has an associated security attribute. Every subject has a security clearance. Least secure Highest security

More information

Tail call elimination. Michel Schinz

Tail call elimination. Michel Schinz Tail call elimination Michel Schinz Tail calls and their elimination Loops in functional languages Several functional programming languages do not have an explicit looping statement. Instead, programmers

More information

Between Mutual Trust and Mutual Distrust: Practical Fine-grained Privilege Separation in Multithreaded Applications

Between Mutual Trust and Mutual Distrust: Practical Fine-grained Privilege Separation in Multithreaded Applications Between Mutual Trust and Mutual Distrust: Practical Fine-grained Privilege Separation in Multithreaded Applications Jun Wang, Xi Xiong, Peng Liu Penn State Cyber Security Lab 1 An inherent security limitation

More information

Common C Errors. Compiled by: Leela Kamalesh Yadlapalli

Common C Errors. Compiled by: Leela Kamalesh Yadlapalli Common C Errors Compiled by: Leela Kamalesh Yadlapalli This document shows some of the common errors and warnings that you may encounter during this class. Always remember to use the Wall option if you

More information

The Security Development Lifecycle. OWASP 24 June 2010. The OWASP Foundation http://www.owasp.org

The Security Development Lifecycle. OWASP 24 June 2010. The OWASP Foundation http://www.owasp.org The Security Development Lifecycle 24 June 2010 Steve Lipner Senior Director of Security Engineering Strategy Trustworthy Computing Microsoft Corporation SLipner@microsoft.com +1 425 705-5082 Copyright

More information

Vulnerability Assessment for Middleware

Vulnerability Assessment for Middleware Vulnerability Assessment for Middleware Elisa Heymann, Eduardo Cesar Universitat Autònoma de Barcelona, Spain Jim Kupsch, Barton Miller University of Wisconsin-Madison Barcelona, September 21st 2009 Key

More information

Software Security Analysis: Control Flow Security Analysis with McCabe IQ

Software Security Analysis: Control Flow Security Analysis with McCabe IQ Software Security Analysis: Control Flow Security Analysis with McCabe IQ Applying a Path-based Method to Vulnerability Assessment of the Microsoft SDL Banned Function Calls Introduction When considering

More information

CSC230 Getting Starting in C. Tyler Bletsch

CSC230 Getting Starting in C. Tyler Bletsch CSC230 Getting Starting in C Tyler Bletsch What is C? The language of UNIX Procedural language (no classes) Low-level access to memory Easy to map to machine language Not much run-time stuff needed Surprisingly

More information

Intro to Firewalls. Summary

Intro to Firewalls. Summary Topic 3: Lesson 2 Intro to Firewalls Summary Basic questions What is a firewall? What can a firewall do? What is packet filtering? What is proxying? What is stateful packet filtering? Compare network layer

More information

Measuring the Effect of Code Complexity on Static Analysis Results

Measuring the Effect of Code Complexity on Static Analysis Results Measuring the Effect of Code Complexity on Static Analysis Results James Walden, Adam Messer, and Alex Kuhl Department of Computer Science Northern Kentucky University Highland Heights, KY 41099 Abstract.

More information

Analog Monitoring Tool AMT 0.3b User Manual

Analog Monitoring Tool AMT 0.3b User Manual Analog Monitoring Tool AMT 0.3b User Manual 1 Introduction AMT (Analog Monitoring Tool) is a tool for checking the correctness of analog and mixed-signal simulation traces with respect to a formal specification

More information

Testing for Security

Testing for Security Testing for Security Kenneth Ingham September 29, 2009 1 Course overview The threat that security breaches present to your products and ultimately your customer base can be significant. This course is

More information

Software Security Testing

Software Security Testing Software Security Testing Elizabeth Sanders Department of Electrical & Computer Engineering Missouri University of Science and Technology ejwxcf@mst.edu 2015 Elizabeth Sanders Pop Quiz What topics am I

More information

Monday, April 8, 13. Creating Successful Magento ERP Integrations

Monday, April 8, 13. Creating Successful Magento ERP Integrations Creating Successful Magento ERP Integrations Happy Together Creating Successful Magento ERP Integrations David Alger CTO / Lead Engineer www.classyllama.com A Little About Me Exclusively focused on Magento

More information

Load testing with WAPT: Quick Start Guide

Load testing with WAPT: Quick Start Guide Load testing with WAPT: Quick Start Guide This document describes step by step how to create a simple typical test for a web application, execute it and interpret the results. A brief insight is provided

More information

The Security Development Lifecycle. Steven B. Lipner, CISSP SLipner@microsoft.com Senior Director Security Engineering Strategy Microsoft Corp.

The Security Development Lifecycle. Steven B. Lipner, CISSP SLipner@microsoft.com Senior Director Security Engineering Strategy Microsoft Corp. The Security Development Lifecycle Steven B. Lipner, CISSP SLipner@microsoft.com Senior Director Security Engineering Strategy Microsoft Corp. 2 Overview Introduction A look back Trustworthy Computing

More information

Using Trace Replayer Debugger and Managing Traces in IDA

Using Trace Replayer Debugger and Managing Traces in IDA Using Trace Replayer Debugger and Managing Traces in IDA Copyright 2014 Hex-Rays SA Table of contents Introduction...2 Quick Overview...2 Following this tutorial...2 Supplied files...2 Replaying and managing

More information

VA SOFTWARE ASSURANCE PROGRAM OFFICE

VA SOFTWARE ASSURANCE PROGRAM OFFICE VA Code Review Process elearning Module Start >> VA Code Review Process elearning Module Getting Started About Fortify About VA This section provides an introduction to this elearning course. This section

More information

<Insert Picture Here> Oracle Web Cache 11g Overview

<Insert Picture Here> Oracle Web Cache 11g Overview Oracle Web Cache 11g Overview Oracle Web Cache Oracle Web Cache is a secure reverse proxy cache and a compression engine deployed between Browser and HTTP server Browser and Content

More information

Session 3: Security in a Software Project

Session 3: Security in a Software Project Session 3: Security in a Software Project Part 1: Parts of a software project Until now, we have mainly discussed what goes wrong during low- level design and implementation. However, implementation in

More information

Securing PHP Based Web Application Using Vulnerability Injection

Securing PHP Based Web Application Using Vulnerability Injection International Journal of Information and Computation Technology. ISSN 0974-2239 Volume 3, Number 5 (2013), pp. 391-398 International Research Publications House http://www. irphouse.com /ijict.htm Securing

More information

Formal Software Testing. Terri Grenda, CSTE IV&V Testing Solutions, LLC www.ivvts.com

Formal Software Testing. Terri Grenda, CSTE IV&V Testing Solutions, LLC www.ivvts.com Formal Software Testing Terri Grenda, CSTE IV&V Testing Solutions, LLC www.ivvts.com Scope of Testing Find defects early Remove defects prior to production Identify Risks Unbiased opinion When Should Testing

More information

Oracle Tuxedo Systems and Application Monitor (TSAM)

Oracle Tuxedo Systems and Application Monitor (TSAM) Oracle Tuxedo Systems and Application Monitor (TSAM) Reference Guide 10g Release 3 (10.3) January 2009 Tuxedo Systems and Application Monitor Reference Guide, 10g Release 3 (10.3) Copyright 2007, 2009,

More information

Eliminating Vulnerabilities in Third-Party Code with Binary Analysis

Eliminating Vulnerabilities in Third-Party Code with Binary Analysis White Paper April 2014 Eliminating Vulnerabilities in Third-Party Code with Binary Analysis Background Over the last few years, third-party code has moved from a minor factor in software development to

More information

Off-by-One exploitation tutorial

Off-by-One exploitation tutorial Off-by-One exploitation tutorial By Saif El-Sherei www.elsherei.com Introduction: I decided to get a bit more into Linux exploitation, so I thought it would be nice if I document this as a good friend

More information

Critical Infrastructure Security: The Emerging Smart Grid. Cyber Security Lecture 5: Assurance, Evaluation, and Compliance Carl Hauser & Adam Hahn

Critical Infrastructure Security: The Emerging Smart Grid. Cyber Security Lecture 5: Assurance, Evaluation, and Compliance Carl Hauser & Adam Hahn Critical Infrastructure Security: The Emerging Smart Grid Cyber Security Lecture 5: Assurance, Evaluation, and Compliance Carl Hauser & Adam Hahn Overview Assurance & Evaluation Security Testing Approaches

More information

CHAPTER 5 INTELLIGENT TECHNIQUES TO PREVENT SQL INJECTION ATTACKS

CHAPTER 5 INTELLIGENT TECHNIQUES TO PREVENT SQL INJECTION ATTACKS 66 CHAPTER 5 INTELLIGENT TECHNIQUES TO PREVENT SQL INJECTION ATTACKS 5.1 INTRODUCTION In this research work, two new techniques have been proposed for addressing the problem of SQL injection attacks, one

More information