Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Fuzzing

1,534 views

Published on

Fuzzing, Brute Force Vulnerability Discovery

Published in: Software
  • Be the first to comment

Fuzzing

  1. 1. Fuzzing Brute ForceVulnerability Discovery Khalegh Salehi salehi@sorenasecurity.com SSP, Sorena Secure Processing A brief introduction on
  2. 2. About me • Khalegh Salehi • Software Security & Vulnerability Assessment • http://khalegh.net • FoxFuzzing Project – All-In-One Full Network Protocols & File Format Fuzzing. SSP, Sorena Secure Processing
  3. 3. Software Security Analyzing • Static analysis: – Approach for verifying software (including finding defects) without executing software • Source code vulnerability scanning tools, code inspections, etc. • Dynamic analysis: – Approach for verifying software (including finding defects) by executing software on specific inputs & checking results (“oracle”) • Functional testing, fuzz testing, etc. • Hybrid analysis: – Combine above approaches • Operational: – Tools in operational setting • Minimize risks, report information back, etc. • Themselves may be static, dynamic, hybrid; often dynamic SSP, Sorena Secure Processing
  4. 4. Software Security Analyzing • Static analysis: – Approach for verifying software (including finding defects) without executing software • Source code vulnerability scanning tools, code inspections, etc. • Dynamic analysis: – Approach for verifying software (including finding defects) by executing software on specific inputs & checking results (“oracle”) • Functional testing, fuzz testing, etc. • Hybrid analysis: – Combine above approaches • Operational: – Tools in operational setting • Minimize risks, report information back, etc. • Themselves may be static, dynamic, hybrid; often dynamic SSP, Sorena Secure Processing Why ?
  5. 5. SSP, Sorena Secure Processing
  6. 6. SSP, Sorena Secure Processing I see. Let's talk on business...
  7. 7. Software Security Analyzing • Static analysis: – Approach for verifying software (including finding defects) without executing software • Source code vulnerability scanning tools, code inspections, etc. • Dynamic analysis: – Approach for verifying software (including finding defects) by executing software on specific inputs & checking results (“oracle”) • Functional testing, fuzz testing, etc. • Hybrid analysis: – Combine above approaches • Operational: – Tools in operational setting • Minimize risks, report information back, etc. • Themselves may be static, dynamic, hybrid; often dynamic SSP, Sorena Secure Processing
  8. 8. Fuzzing in Wikipedia “Fuzz testing or fuzzing is a software testing technique, often automated or semi-automated, that involves providing invalid, unexpected, or random data to the inputs of computer program. The program is then monitored for exceptions such as crashes, or failing built-in code assertions or for finding potential memory leaks. Fuzzing is commonly used to test for security problems in software or computer systems. It is a form of random testing which has been used for testing hardware or software” SSP, Sorena Secure Processing
  9. 9. Fuzz testing history • Fuzz testing concept from Barton Miller’s 1988 class project University of Wisconsin – Project created “fuzzer” to test reliability of command-line Unix programs – Repeatedly generated random data for them until crash/hang – Later expanded for GUIs, network protocols, etc. • Approach quickly found a number of defects • Many tools & approach variations created since SSP, Sorena Secure Processing
  10. 10. Fuzzing in brief • A form of vulnerability analysis and testing • Many slightly anomalous test cases are input into the target application • Application is monitored for any sign of error SSP, Sorena Secure Processing
  11. 11. Fuzz testing process SSP, Sorena Secure Processing ©softScheck
  12. 12. Fuzzing Phase SSP, Sorena Secure Processing Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability
  13. 13. SSP, Sorena Secure Processing Case Study
  14. 14. 14 FileFuzz • Application vs. file type – One file type  multiple targets • Vendor history – Past vulnerabilities • High risk targets – Default file handlers • Windows Explorer • Windows Registry – Commonly traded file types • Media files • Office documents • Configuration files Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability SSP, Sorena Secure Processing
  15. 15. 15 • Proprietary vs. open formats – Vendor documents – Wotsit.org – Google • Binary files – e.g. images, video, audio, office documents, etc. – Headers vs. data • Text files – e.g. *.ini, *.inf, *.xml – Name/value pairs Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability SSP, Sorena Secure Processing FileFuzz
  16. 16. 16 • Binary files – Breadth (All or Range) • Identify potential weaknesses FF FF FF FF 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ÿÿÿÿ..Ûþ..Å...è. D7 FF FF FF FF 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×ÿÿÿÿ.Ûþ..Å...è. D7 CD FF FF FF FF DB FE 0B 00 C5 00 00 01 E8 03 ; ×ÍÿÿÿÿÛþ..Å...è. – Depth • Determine level of control/influence D7 CD FD 9A 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×Íýš..Ûþ..Å...è. D7 CD FE 9A 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×Íþš..Ûþ..Å...è. D7 CD FF 9A 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×Íÿš..Ûþ..Å...è. • Text Files – name = value file_size = 10 file_size = AAAAA file_size = AAAAAAAAAA Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability SSP, Sorena Secure Processing FileFuzz
  17. 17. 17 • Command line arguments – Windows explorer • Tools…Folder Options…File Types Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability SSP, Sorena Secure Processing FileFuzz
  18. 18. 18 • Visual – Error messages – Blue screen • Event logs – System logs – Application logs • Debuggers • Return codes • Debugging API Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability SSP, Sorena Secure Processing FileFuzz
  19. 19. 19 • Execute – Automated and repeated • Monitor – Library - libdasm – Capture • Memory location • Registry values • Exception type • Kill – Set timeout Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability [*] "crash.exe" "C:Program FilesWordPerfect Office 12ProgramsUA120.exe" 2000 /qt c:fuzzast8.ast [*] Access Violation [*] Exception caught at 00403f06 mov eax,[eax+edi*4] [*] EAX:0014b1b8 EBX:00000005 ECX:00435c00 EDX:0012fbac [*] ESI:00435c00 EDI:cccccccc ESP:0012fab8 EBP:0012fae8 SSP, Sorena Secure Processing FileFuzz
  20. 20. 20 • Skills – Disassembly ,Debugging • Vulnerability types – Stack, Heap overflow, Integer handling, etc. • Overflows • Signedness – DoS • Out of bounds reads • Infinite loops • NULL pointer dereferences – Logic errors • Windows WMF vulnerability (MS06-001) – Format strings, Race conditions Identify target Identify inputs Generate fuzzed data Execute fuzzed data Monitor for exceptions Determine exploitability SSP, Sorena Secure Processing FileFuzz
  21. 21. 21 SSP, Sorena Secure Processing FileFuzz FileFuzz is a graphical, Windows based file format fuzzing tool. FileFuzz was designed to automate the creation of abnormal file formats and the execution of applications handling these files. FileFuzz also has built in debugging capabilities to detect exceptions resulting from the fuzzed file formats.
  22. 22. SSP, Sorena Secure Processing call your guys…
  23. 23. Type of Fuzzers • File Fuzzers As the name implies, fuzzers that target file formats only. They do not have the ability to speak any network protocol. • Network Fuzzers And these are fuzzers that target only network protocols. There are allot of these as the discovery of network based vulnerabilities has always attracted allot of attention. • General Fuzzers Following with our captain obvious theme, these fuzzers that can target a wide variety of targets, typically both file and network, and also others via custom I/O interfaces. For example: COM, shared libraries, RPC, etc. • Custom or One-off Fuzzers These are custom written fuzzers that target a specific format or network protocol. Typically these hand written, many times by testers. Custom fuzzers vary widely on how good their data mutation/generation is. For the purposes of this document we will not examine any custom or one-off fuzzers. • API Fuzzers, Hardware Fuzzers and dozens of Fuzzers, There is not limitations for subject… (Chapter 5, Page 161-166) SSP, Sorena Secure Processing
  24. 24. Type of Fuzzers… There is no limitation of, Intuitively I have to say… Where there is a Input, There’s Fuzz… There is an undeniable fact, Before start your cool fuzzing, please formally let me know about your target. SSP, Sorena Secure Processing
  25. 25. Example • Standard HTTP GET request – GET /index.html HTTP/1.1 • Anomalous requests – AAAAAA...AAAA /index.html HTTP/1.1 – GET ///////index.html HTTP/1.1 – GET %n%n%n%n%n%n.html HTTP/1.1 – GET /AAAAAAAAAAAAA.html HTTP/1.1 – GET /index.html HTTTTTTTTTTTTTP/1.1 – GET /index.html HTTP/1.1.1.1.1.1.1.1 – etc... SSP, Sorena Secure Processing
  26. 26. Example of Vulnerable Source Code #include <stdio.h> int main( int argc, char *argv[] ) { char buffer[1024]; strcpy(buffer,argv[1]); printf("The string is a %s nn",buffer); return 0; } SSP, Sorena Secure Processing
  27. 27. Example of Simple Fuzzing scheme import subprocess,time; for i in range(1,10000): print i; subprocess.call(["./ example ","A"*i]); time.sleep(1); # figure out debugger, crash log, etc. Go head and run the application via uninvited arguments such as and not limited to, ./example `python -c “print ‘A’*10000”` SSP, Sorena Secure Processing
  28. 28. SSP, Sorena Secure Processing The situation under controls...
  29. 29. Definition of fuzzing “Fuzzing is a technique for intelligently and automatically generating and passing into a target system valid and invalid message sequences to see if the system breaks, and if it does, what it is that makes it break” CODENOMICON SSP, Sorena Secure Processing
  30. 30. The Solution That Found Heartbleed  fuzzing(Defensics) was the primary solution being used when the Heartbleed flaw was identified. A security research was running a routine test of the Fuzzing (Defensics) feature, SafeGuard, identifying the flaw that had gone unidentified for over two years and impacted over 500,000 websites. SSP, Sorena Secure Processing CODENOMICON
  31. 31. Fuzzing Approach Mutation Based - “Dumb Fuzzing”  Generation Based - “Smart Fuzzing”  Evolutionary SSP, Sorena Secure Processing
  32. 32. Mutation Based - “Dumb Fuzzing” SSP, Sorena Secure Processing
  33. 33. Mutation Based - “Dumb Fuzzing” • Little or no knowledge of the structure of the inputs is assumed • Anomalies are added to existing valid inputs • Anomalies may be completely random or follow some heuristics • Requires little to no set up time • Dependent on the inputs being modified • May fail for protocols with checksums, those which depend on challenge response, etc. Examples: • Taof, GPF, ProxyFuzz, etc. SSP, Sorena Secure Processing
  34. 34. SSP, Sorena Secure Processing Generation Based - “Smart Fuzzing”
  35. 35. Generation Based - “Smart Fuzzing” • Test cases are generated from some description of the format: RFC, documentation, etc. • Anomalies are added to each possible spot in the inputs • Knowledge of protocol should give better results than random fuzzing • Can take significant time to set up • Examples – SPIKE, Sulley, Mu-4000, Codenomicon, Bestorm SSP, Sorena Secure Processing
  36. 36. Evolutionary SSP, Sorena Secure Processing
  37. 37. Evolutionary • Attempts to generate inputs based on the response of the program • Autodafe – Prioritizes test cases based on which inputs have reached dangerous API functions • EFS – Generates test cases based on code coverage metrics (more later) • This technique is still in the alpha stage SSP, Sorena Secure Processing
  38. 38. Issues & Problems Mutation based fuzzers can generate an infinite number of test cases... When has the fuzzer run long enough? Generation based fuzzers generate a finite number of test cases. What happens when they’re all run and no bugs are found? How do you monitor the target application such that you know when something “bad” has happened? SSP, Sorena Secure Processing
  39. 39. Issues with Fuzzing What happens when you find too many bugs? Or every anomalous test case triggers the same (boring) bug? How do you figure out which test case caused the fault? Given a crash, how do you find the actual vulnerability After fuzzing, how do you know what changes to make to improve your fuzzer? When do you give up on fuzzing an application? SSP, Sorena Secure Processing
  40. 40. Products & Frameworks SSP, Sorena Secure Processing
  41. 41. Products & Frameworks SSP, Sorena Secure Processing Dozens of Open-Source Fuzzing Tools & Frameworks has been collected in FoxFuzzing, there is list of products with bit information of, are available by https://github.com/khaleghsalehi/FoxFuzzing/list.pdf Not(A2
  42. 42. ? SSP, Sorena Secure Processing Thank you &
  43. 43. References 1. SWE 681 / ISA 681,Secure Software Design & Programming, Lecture 9, Analysis Approaches & Tools, Dr. David A. Wheeler, 2014-08-17 2. Real World Fuzzing, Charlie Miller, Independent Security Evaluators, ctober 19, 2007, cmiller@securityevaluators.com 3. Robustness Testing, Discover unknown vulnerabilities with Testing & QA, Ari Takanen, Codenomicon Ltd. 4. Michael Eddington, Leviathan Security Group, Inc. 2009 5. A Study of Commercially Available Fuzzers: Identification of Undisclosed Vulnerabilities with the Aid of Commercial Fuzzing Tools. Prof. Dr. Hartmut Pohl and Daniel Baier, B.Sc. Department of Computer Sciences, Bonn-Rhein-Sieg University of Applied Sciences 6. “Fuzzing for Software Security Testing and Quality Assurance”, Ari Takanen, Jared DeMott, Charlie Miller Fuzzing for Software Security Testing and Quality Assurance (Artech House Information Security and Privacy), 2008 7. Fuzzing: Brute Force Vulnerability Discovery Paperback – July 9, 2007 by Michael Sutton, Adam Greene, Pedram Amini 8. Michael Sutton, Director, iDefense Labs, msutton@idefense.com, Fuzzing Brute Force Vulnerability Discovery 9. [Slide No. 11.] A Study of Commercially Available Fuzzers: Identification of Undisclosed Vulnerabilities with the Aid of Commercial Fuzzing Tools. By: Prof. Dr. Hartmut Pohl and Daniel Baier, B.Sc. Department of Computer Sciences, Bonn-Rhein-Sieg University of Applied Sciences. SSP, Sorena Secure Processing
  44. 44. Awesome Books SSP, Sorena Secure Processing Fuzzing: Brute Force Vulnerability Discovery Paperback – July 9, 2007 by Michael Sutton (Author), Adam Greene (Author), Pedram Amini (Author)
  45. 45. Awesome Books SSP, Sorena Secure Processing Fuzzing for Software Security Testing and Quality Assurance (Artech House Information Security and Privacy) Hardcover – June 30, 2008 by Ari Takanen (Author), Jared DeMott (Author), Charlie Miller (Author)
  46. 46. Awesome Books SSP, Sorena Secure Processing Open Source Fuzzing Tools Paperback – December 28, 2007 by Noam Rathaus (Author), Gadi Evron (Author)
  47. 47. Awesome Books SSP, Sorena Secure Processing Violent Python: A Cookbook for Hackers, Forensic Analysts, Penetration Testers and Security Engineers Paperback – August 11, 2012 & many so many books…

×