confu configuration fuzzing testing framework for software vulnerability detection n.
Download
Skip this Video
Loading SlideShow in 5 Seconds..
CONFU: Configuration Fuzzing Testing Framework for Software Vulnerability Detection PowerPoint Presentation
Download Presentation
CONFU: Configuration Fuzzing Testing Framework for Software Vulnerability Detection

Loading in 2 Seconds...

play fullscreen
1 / 22

CONFU: Configuration Fuzzing Testing Framework for Software Vulnerability Detection - PowerPoint PPT Presentation


  • 126 Views
  • Uploaded on

CONFU: Configuration Fuzzing Testing Framework for Software Vulnerability Detection. Master Thesis Huning Dai Advisor: Gail Kaiser Committee: Tal Malkin, Bradley Jensen Columbia University. Observation. Most vulnerabilities only reveal themselves under three conditions:

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

CONFU: Configuration Fuzzing Testing Framework for Software Vulnerability Detection


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
    Presentation Transcript
    1. CONFU: Configuration Fuzzing Testing Framework for Software Vulnerability Detection Master Thesis Huning Dai Advisor: Gail Kaiser Committee: Tal Malkin, Bradley Jensen Columbia University

    2. Observation Most vulnerabilities only reveal themselves under three conditions: 1. particular inputs Fuzz Testing (Miller et al., 1988 ) • A. Randomly generated inputs may fail to satisfy syntactic constraints. • B. It is hard to evaluate how much of the input space is explored • C. Limited information about the "failure"

    3. Observation Most vulnerabilities only reveal themselves under three conditions: 2. particular configurations of the software Configuration Testing (Memon and Porter et al., 2004) A. Didn’t apply to security testing. B. Provide little information other than pass/fail

    4. Observation Most vulnerabilities only reveal themselves under three conditions: 3. particular runtime environment. Fault Injection (Hsueh et al., 1997) A. Relies on the faults being injected. B. Considerable false postives.

    5. Our Solution • Configuration Fuzzing A. Instead of generating random inputs, Configuration Fuzzing mutates the application configuration. B. To increase effectiveness, Configuration Fuzzing tests are carried out “In Vivo”ly after a software is released, with real-world inputs and runtime environment. C. Instead of only checking for failure, surveillance functions are run throughout the tests; these functions check for violations of “security invariants” and log detailed information.

    6. Overview • Background • Model • ConFu Framework • Case Studies • Demo • Limitations and Conclusion

    7. Background • In Vivo Testing (Murphy et al., 2009) Executes tests in the context of the running program after the software is released without affecting the main process. • Security Invariants (Biskup, 2009) Not merely const int security; const char secure; But rules once broken indicates …

    8. Approach • Configuration Fuzzing Configuration Fuzzing mutates the application configuration under predefined configuration constraints of the software-under-test to look for potential vulnerabilities. Surveillance functions using security invariants are executed throughout the test in order to detect vulnerabilities. Tests are executed in the deployment process using real user inputs while the application is running, “in vivoly”.

    9. Model

    10. Introduction to ConFu • ConFu: CONfiguration FUzzing testing framework • Steps: 1. Identifying the configuration variables 2. Generating fuzzing code 3. Identifying functions to test 4. Generating test code 5. Executing tests

    11. STEP 1 • Identifying the configuration variables Part of the annotated configuration file of OpenSSH

    12. STEP 2 • Generating fuzzing code An example fuzzer for OpenSSH

    13. STEP 3 & STEP 4 • Identifying functions to test do_child()  ConFu_do_child() • Generating test code Test function for do_child()

    14. STEP 5 • Executing tests do_child(Wrapper) fork() Confu_test_do_child(test) Confu_do_child(original) exit continue Wrapper function for do_child()

    15. Case Studies: Feasibility • Reproduce known vulnerabilities and use ConFu to detect them. CVE-2000-0525: early versions of OpenSSH do not properly drop privileges when the UseLogin option is enabled, which allow local users to execute arbitrary commands by providing the command to the ssh daemon. CVE-2009-2958: The tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a TFTP read (aka RRQ) request.

    16. Case Studies: Performance • Target program: OpenSSH 2.1.0 • Chosen function: do_child() • Configuration: permit root login, ignore rhosts, ignore user known hosts, strict modes, x11 forwarding … a total of 15 configuration variables. • Environment: Intel Core2Quad Q6600 server with 2.40GHz and 2GB of RAM running Ubuntu 8.04.3

    17. Case Studies: Performance • Results Overhead of instrumented do_child()(in seconds) with varying number of tests

    18. Demo • Dummy FTP application • A total of fifteen configuration options • Directory traversal vulnerability when:

    19. Limitations and Future Work • Testers’ intervention is required to identify the functions to test • A priori knowledge of the potential exploitation behavior is required • Each configuration is tested with relative few inputs

    20. Conclusion • Our contribution is an approach that checks for software vulnerability after the software is released and developed a testing framework based on this approach. • Useful in helping developers build more secure software and improve the security of existing software systems.

    21. CONFU: Configuration Fuzzing Testing Framework for Software Vulnerability Detection Huning Dai dai@cs.columbia.edu

    22. What is Covering Array? A B C 0 0 0 0 1 1 1 0 1 1 1 0 A 2-way covering array for three binary variables We notice that whichever two columns out of the three columns are chosen, all possible pairs of values appear. Specifically, the pairs 00, 01, 10 and 11 all appear in the rows when we look at the columns of AB only, AC only and BC only. Back