Cybersecurity Testing Using Fuzzing
- Verification of static analysis findings to minimize manual effort for identifying
- Validation of security patches to avoid vulnerable systems
- Identifying vulnerabilities in the business logic that may lead, e.g., to Denial-of-Service vulnerabilities
- Advanced dynamic instrumentation to accelerate vulnerability discovery
White-box Cybersecurity Testing
Static analysis is used to guarantee that no vulnerability is missed. This method often suffers from a large numbers of false positives of usually more than 70 percent. Therefore it requires large amounts of effort to manually investigate.
Fuzzino Solution
Fuzzino automatically verifies static analysis findings through dynamic analysis, constraint solving and directed fuzzing to show the presence of a vulnerability (true positive). Statistical estimators are used to show the absence of a vulnerability (false positive).
Grey-box Cybersecurity Testing
This method employs runtime information from dynamic testing, usually code coverage and focusses on memory corruption,(e.g., buffer overflows) by instrumenting the code (using Sanitizers). It’s currently the de-facto standard. It is currently considered the standard method, but it focuses on maximizing code coverage, which does not necessarily correlate with the discovery of vulnerabilities and is measured with the least minimal information.
Fuzzino Solution
Fuzzino employs advanced instrumentation to gather information about the internal state of a system under test to detect semantic weaknesses. In this way fine-grained code coverage information is obtained and vulnerability discovery is accelerated.
Black-box Cybersecurity Testing
Black-box Cybersecurity Testing assesses the security of a system via its interface. This method focusses on memory corruption, (e.g., buffer overflows) by instrumenting the code using Sanitizers. It requires high effort for providing protocol information, data formats and system states. Furthermore, it suffers from the inability to detect weaknesses other than memory corruption, such as Denial-of-Service vulnerabilities, and semantic weaknesses.
Fuzzino Solution
Fuzzino employs protocol knowledge available from specifications, which for example can be simply copied from RfCs, to deeply penetrate the system under test, and generate complex test scenarios. The re-use of functional test infrastructure for cybersecurity tests lowers barriers since it requires only little security know how. Our solution evaluates runtime information to detect, for instance, Denial-of-Service vulnerabilities, which do not result from memory corruption.
Bare-metal Firmware Fuzzing
This method assesses the security of embedded and IoT devices, which do not utilize operating systems (so called bare-metal systems) and focusses on memory corruption (e.g., buffer overflows) and non-responsiveness. Due to instrumentation restrictions on bare-metal systems this method suffers from a lack of sanitization. Furthermore, many memory-related vulnerabilities are undetectable.
Fuzzino Solution
Fuzzino combines static code analysis, grey-box fuzzing and virtualization to detect previously undetectable vulnerabilities, e.g., stack and global variable access violations. In this way, it is possible to test bare-metal firmware without the actual hardware. Using this approach, we successfully found a new vulnerability in a bare-metal PLC firmware.
Security Patch Validation
Security patch development is often specific for a certain exploit. Thus, attackers can often easily bypass a security patch, by slightly modifying its original attack. To overcome this, rigorous testing of patches is required. Existing tools are not able to evaluate the effectiveness of a security patch.
Fuzzino Solution
Fuzzino offers a fine-grained code coverage measurement and generates a test suite to trigger a given vulnerability. The patch validation tests suite evaluates the effectiveness of a security patch, and provides examples (test cases) if a vulnerability can still be triggered.