Comprehensive Security Testing Made Easy
The number of cyber attacks is increasing every year. The European Union is adopting regulations, e. g., the Cyber Resilience Act, to counteract this trend by imposing new obligations on manufacturers regarding product security, including regular security testing to identify vulnerabilities.
These new obligations are reinforced by the new Product Liability Directive, which makes manufacturers of digital products liable not only for damages caused by vulnerabilities, but also for all damages caused by an attacker exploiting a vulnerability. The new regulations apply to many manufacturers who weren‘t previously required by law to perform security testing. In addition, the obligations apply not only to the manufacturer’s source code, but also to any included third-party software component. The explicit inclusion of open-source software presents new technical challenges for manufacturers.
Fuzzing is one of the most widely used security testing techniques. Its core idea is to execute a system with randomly generated inputs to uncover vulnerabilities. Even though fuzzing can be quite effective, many fuzzing tools suffer from certain challenges and limitations. These can be significant, particularly to small and medium-sized companies which may lack experience or resources.
Our solution Fuzzino addresses these challenges and limitations through a set of thoroughly developed features. As a result, it significantly enhances the usability, efficiency, and effectiveness of security testing. These improvements enable manufacturers to leverage state-of-the-art security testing without the need for specialized and expensive security testing training.
Usability
Fuzzing is associated with the need for specific skills to use those tools, how to integrate them in a test environment, and how to interpret their results, which hinders their wide adoption. To provide the output of a fuzzer as input to a component, often a so-called fuzzing harness is necessary. Its implementation requires manual effort and knowledge of the component and of the
fuzzing tool. Our solution overcomes fuzzing harnesses, since it enables you to reuse your adapter from functional testing without any changes.
Statefulness
Many vulnerabilities are hidden deep in the business logic of the system. Many fuzzers can’t find them as their inputs are rejected in early processing stages and as these fuzzers do not operate statefully. Our solution provides a simple and intuitive language to describe message sequences, and thus system states. Operating on these descriptions, our solution effectively finds vulnerabilities deep in the system that other fuzzing tools would miss.
Speed
Our advanced test generation engine allows vulnerabilities to be identified in minutes rather than hours or days. This enables integration into daily tests, build pipelines and DevOps processes.
Message descriptions
Many fuzzers require well-formed example inputs, so-called seeds. However, obtaining a set, which is concise and representative, is not trivial. Our solution employs scalable protocol descriptions. These allow you to describe protocol compliant inputs not only by example inputs (i.e., seeds), but also by describing their data structures and rules they follow. Such descriptions can often be directly obtained or derived from official specifications.
Adaptive vulnerability detection
Existing fuzzers often detect vulnerabilities that manifest themselves in crashes or memory corruptions. Fuzzino also detects bugs that have more subtle effects than memory corruptions. Our solution can go beyond maximizing code coverage as a test objective. It can be configured to observe any runtime property, e. g., to identify denial of service vulnerabilities as a test objective.
Your Benefits with Fuzzino
Developers and testers without security testing knowledge benefit from these features to perform comprehensive security testing of any software components within a product.