Year: 2014
Type: article
Abstract: FuzzingFor an introduction to the motivations and concepts of fuzzing, please see the article by Baker 1 on page 42 of this issue of Horizons.Additional background on fuzzing also has been reported previously. 2 If you read the the article by Baker, 1 you are probably convinced that fuzzing is a crucial part of any software development life cycle or validation and verification process.What now?How can you get started?This article describes where the rubber meets the road, starting from making a plan and progressing through how discovered vulnerabilities can be fixed.It provides an overview on mapping the attack surface of your target, prioritizing attack vectors, and creating a test plan.Specific recommendations on desirable fuzzer features also are described, as well as details on instrumentation, fuzzing roles, and how to help developers fix located vulnerabilities.Note that some portions of this article were adapted from the Fuzz Testing Maturity Model (FTMM).3 Creating a Test PlanBefore firing up your fuzzer and trying to discover vulnerabilities in your target device, you need a plan. Attack Surface AnalysisThe first step in creating a test plan is to map out the available attack surface.Devices and networks are vulnerable where any type of software takes any type of input.Each place at which a piece of software takes input is an attack vector.The sum of all attack vectors is an attack surface.Consider, for example, a typical infusion pump.Each place on the device that some piece of software accepts some kind of input, either through a network protocol or as a file, is an attack vector.Let's assume the pump receives drug libraries over a network from a control computer.• The drug libraries are likely described in an extensible markup language (XML) document.The XML parser is a target, as is the custom code that deals with the content of the XML document.• The XML document might be carried overHTTP.An HTTP server is responsible for parsing HTTP messages.• TLS protocol handling is most likely supported through openSSL.• TCP and IP protocols are supplied by the underlying operating system, likely a variant of Linux.• The pump might have other services running as well, such as SSH.Each attack vector represents some body of code-code that contains vulnerabilities.The attack surface of a network or system is the sum of the attack surfaces of its component devices.When mapping the attack surface, don't forget about nonnetwork inputs.For example,
Author: Jonathan Knudsen
Language: English
Subfield: Software
Field: Computer Science
Domain: Physical Sciences
Open Access status: bronze
OpenAlex ID: W2182220187