empowering security teams
TRANSCRIPT
Fuzz Testing for Embedded Device Security Assurance (EDSA)
ISASecure EDSA Certification
Communication/Network Robustness Testing (CRT)
• “CRT examines the capability of the device to
• adequately maintain essential functions while being subjected to:
• normal and erroneous network protocol traffic at normal to extremely high traffic rates (flood conditions).
ISASecure.org
• ANSI and IEEE have defined robustness as the degree to which a system or component can function correctly in the presence of invalid inputs or stressful environmental conditions
• - Wikipedia
FUZZINGRANDOM TESTING, BLACK BOX TESTING
The standard definition of Fuzzing (according to the Standard Glossary of Software Engineering Terminology, IEEE) is
“The degree to which a system or component can function correctly in the presence of invalid inputs or stressful environmental conditions.”
Fuzzing Trigger system errors and faults by sending invalid data intentionally
The best way to find “zero day vulnerabilities”
Many global companies use fuzzing as part of the developing process
Microsoft Security Development Lifecycle (SDL)
For ProgrammersInputs are the triggers for outputs
LOGIC
For AttackersInputs trigger possible problems
LOGICUnhandled (Unexpected)
INPUT
INPUT OUTPUT
UnexpectedConsequence(Possible Vulnerability) “Unexpected input causes unexpected results.”
(Michael Sutton)
All the input space
Code/Spec
Unit
test
s
Unit
test
s
Unit
test
sUnit
test
s
Test Coverage
QA
Vulnerable
Smart and Dumb Fuzzing
• Dumb Fuzzers
• has no built-in intelligence about the program being fuzzed
• generates completely random input
Smart Fuzzers like beSTORM
• has knowledge of the input format (e.g. a protocol definition or rules for a file format)
• generates mostly valid input and only fuzz parts of the input within that known format
beSTORM Client and Monitor module
beSTORM MAIN COMPONENTS
Protocol test coverage - beSTORM Generate comprehensive test cases to cover the entire protocol
Crawl through the entire protocol tree (beSTORM combinatorically goes through
all possible test cases)
With comprehensive test coverage, beSTORM detects all vulnerabilities
Monitoring for Possible Vulnerabilities
• A powerful monitor detects if even the slightest buffer overflow, format string, or memory exception occurs
• Runs automatically until all test scenarios are exhausted, trying the most probable combinations first
Other forms of Monitor –Waveform Monitor
beSTORM main features
Export a “Proof of Concept” Perl script Recreate the vulnerabilities without needing
beSTORM
Perl script is platform independent
This site can not
be reached
ISCI EDSA ARP Testing Specs
EDSA ARP Fuzzing Project Walkthru
Select ARP fuzzing
ARP Fuzz Testing Configuration
Select EDSA ARP Test Requirements
Select Built-in Monitor & Start
ARP Load Testing Completed
Detailed result report
beSTORM REPORTING
Smart Fuzzers like beSTORM
• has knowledge of the input format (e.g. a protocol definition or rules for a file format)
• generates mostly valid input and only fuzz parts of the input within that known format
Generation FuzzerWorking with 61850 MMS Protocol
Snippets of 61850 MMS Scripts
beSTORM USE CASES
Critical Infrastructure, certified by the ISA Security Compliance Institute (ISCI) as an approved ‘CRT Test Tool’ for use in the ISASecure EDSAv1 and EDSAv2
beSTORM, used in the automotive industry for the new driverless security testing. Supports CANBus, CAN-FD,UDS, DoCAN, new generation of automotive head-end units and all types of ECUs
Product Development and Lab Certification, Beyond Security is a member of the Microsoft SDL Pro Network that specialize in application security and have substantial experience and expertise with the methodology and technologies of the SDL
LOCATE FAULTS AND SECURITY VULNERABILITIES
Using Fuzzing method to detect zero day vulnerabilities before they are publicly discovered.
FULL TOOL SUITE
• 2ND Generation fuzz engine
• Self Learning Module and Propriety software testing
• System Under Test monitoring engines
• Auto generation of proof of concept attacks
• Easy to customize
TEST ANY TARGET
• Servers
• Clients
• Applications/Software
• Hardware
• API
• DLL
• Libraries
• PLC
FIND 0 DAYS WITH beSTORM
• Provides the highest control and transparency for your testing of any tool in the market
• beSTORM, real fuzzing, and protocol description, field by field. No test cases, real Fuzzing!
• Using the monitor, attach like a debugger, tells beSTORM there’s an exception and exactly where and when problem is found (step back and forth). Then export and exploit via Python. Engineering can then test offline
• Monitor if application is answering with icmp ping, there’s also a process monitor, providing detailed additional DUT information.
• Monitor via API, and when there’s a failure beSTORM can notify you via email
• beSTORM consolidated reports shows: • exactly what problems were found.• Shows everything that was tested and why.• Shows all settings and tests that were done – Great for testing certification
• Adjust your speed: adjust how many sessions/sec. • lower speed for slow devices • Increase speed for time constraints, • Prioritize the parts of your protocols you want tested first• Change testing granularity
• Proprietary protocols, smart and intuitive Self-Learning. Add your own protocols
BeSTORM ADVANTAGES
KNOW THAT YOU’RE SAFE
Thank you!