Vulnerability Discovery Research Articles

An Empirical Methodology to Evaluate Vulnerability Discovery Models

A precise vulnerability discovery model (VDM) will provide a useful insight to assess software security, and could be a good prediction instrument for both software vendors and users to understand security trends and plan ahead patching schedule accordingly. Thus far, several models have been proposed and validated. Yet, no systematically independent validation by somebody other than the author exists. Furthermore, there are a number of issues that might bias previous studies in the field. In this work, we fill in the gap by introducing an empirical methodology that systematically evaluates the performance of a VDM in two aspects: quality and predictability. We further apply this methodology to assess existing VDMs. The results show that some models should be rejected outright, while some others might be adequate to capture the discovery process of vulnerabilities. We also consider different usage scenarios of VDMs and find that the simplest linear model is the most appropriate choice in terms of both quality and predictability when browsers are young. Otherwise, logistics-based models are better choices.

Vulnerability Scrying Method for Software Vulnerability Discovery Prediction Without a Vulnerability Database

Predicting software vulnerability discovery trends can help improve secure deployment of software applications and facilitate backup provisioning, disaster recovery, diversity planning, and maintenance scheduling. Vulnerability discovery models (VDMs) have been studied in the literature as a means to capture the underlying stochastic process. Based on the VDMs, a few vulnerability prediction schemes have been proposed. Unfortunately, all these schemes suffer from the same weaknesses: they require a large amount of historical vulnerability data from a database (hence they are not applicable to a newly released software application), their precision depends on the amount of training data, and they have significant amount of error in their estimates. In this work, we propose vulnerability scrying, a new paradigm for vulnerability discovery prediction based on code properties. Using compiler-based static analysis of a codebase, we extract code properties such as code complexity (cyclomatic complexity), and more importantly code quality (compliance with secure coding rules), from the source code of a software application. Then we propose a stochastic model which uses code properties as its parameters to predict vulnerability discovery. We have studied the impact of code properties on the vulnerability discovery trends by performing static analysis on the source code of four real-world software applications. We have used our scheme to predict vulnerability discovery in three other software applications. The results show that even though we use no historical data in our prediction, vulnerability scrying can predict vulnerability discovery with better precision and less divergence over time.

소프트웨어 취약성 평가를 위한 길이기반 파일 퍼징 테스트 슈트 축약 알고리즘

ABSTRACT Recently, automated software testing methods such as fuzzing ha ve been researched to find software vulnerabilities. The purpose of fuzzing is to disclose software vulnerabilities by p roviding a software with malformed data. In order to increase t he probability of vulnerability discovery by fuzzing, we must solv e the test suite reduction problem because the probability depends on the test case quality. In this paper, we propose a n ew method to solve the test suite reduction problem which is suitable for the long test case such as file. First, we suggested the length of test case as a measure in addition to old measures such as coverage and redundancy. Next we designed a test suite reduction algorithm using the new measure. In the experimental results, the proposed algorithm showed better perf ormance in the size and length reduction ratio of the test suit e than previous studies. Finally, results from an empirical study suggested the viability of our proposed measure and algorithm for file fuzzing.Keywords: Test Suite Reduction, File Fuzzing, Software Vulnerability접수일(2013년 3월 6일), 게재확정일(2013년 3월 18일)†주저자, mirr1004@ensec.re.kr‡교신저자, ymkim@jnu.ac.kr

Analyses of two end-user software vulnerability exposure metrics (extended version)

Understanding the exposure risk of software vulnerabilities is an important part of the software ecosystem. Reliable software vulnerability metrics allow end-users to make informed decisions regarding the risk posed by the choice of one software package versus another. In this article, we develop and analyze two new security metrics: median active vulnerabilities (MAV) and vulnerability free days (VFD). Both metrics take into account both the rate of vulnerability discovery and the rate at which vendors produce corresponding patches. We examine how our metrics are computed from publicly available data sets and then demonstrate their use in a case study with various vendors and products. Finally, we discuss the use of the metrics by various software stakeholders and how end-users can benefit from their use.

ICMPV6 Vulnerability

Handling Internet Control Message Protocol version 6 (ICMPv6) vulnerabilities is among the challenges in securing the IPv6 deployment. Since ICMPv6 messages are crucial in IPv6 communications, this paper discusses the discovery of ICMPv6 vulnerabilities by producing a threat model of ICMPv6 vulnerabilities and proposing the use of Selective Filtering ICMPv6 Messages (SF-ICMP6) to handle some of the vulnerabilities. An experiment was conducted to verify the threat model by observing and discussing the usage of ICMPv6 threat model together with SF-ICMP6. The findings showed that the attack derived in the threat model is possible and the countermeasure associated with it is appropriate. As for SF-ICMP6, selectively filtering messages should be enforced because different messages require filtering of different type and code. It is expected that with the use of threat model and SF-ICMP6, maintaining and securing ICMPv6 messages in IPv6 deployment is attainable.

Vulnerability Discovery Technology and Its Applications

V ulnerability discovery technology becomes more and more important in software development and network security. This paper presents the classification of vulnerability discovery technologies and discusses the advantages, disadvantages and the extent of application of each class. Then we emphasize the procedure and the improvement methods of the Fuzzing test combined with protocol analysis. Furthermore, according to protocol vulnerability discovery methods, we analyze the issues of network vulnerability discovery and propose the directions of future research.

A comparison of the efficiency and effectiveness of vulnerability discovery techniques

ContextSecurity vulnerabilities discovered later in the development cycle are more expensive to fix than those discovered early. Therefore, software developers should strive to discover vulnerabilities as early as possible. Unfortunately, the large size of code bases and lack of developer expertise can make discovering software vulnerabilities difficult. A number of vulnerability discovery techniques are available, each with their own strengths. ObjectiveThe objective of this research is to aid in the selection of vulnerability discovery techniques by comparing the vulnerabilities detected by each and comparing their efficiencies. MethodWe conducted three case studies using three electronic health record systems to compare four vulnerability discovery techniques: exploratory manual penetration testing, systematic manual penetration testing, automated penetration testing, and automated static analysis. ResultsIn our case study, we found empirical evidence that no single technique discovered every type of vulnerability. We discovered that the specific set of vulnerabilities identified by one tool was largely orthogonal to that of other tools. Systematic manual penetration testing found the most design flaws, while automated static analysis found the most implementation bugs. The most efficient discovery technique in terms of vulnerabilities discovered per hour was automated penetration testing. ConclusionThe results show that employing a single technique for vulnerability discovery is insufficient for finding all types of vulnerabilities. Each technique identified only a subset of the vulnerabilities, which, for the most part were independent of each other. Our results suggest that in order to discover the greatest variety of vulnerability types, at least systematic manual penetration testing and automated static analysis should be performed.

IKE vulnerability discovery based on fuzzing

ABSTRACTInternet Key Exchange (IKE) protocol is widely applied on the Internet to protect confidentiality of the Internet communication. However, there are many high‐risk security vulnerabilities in various IKE implementations. Traditional fuzzing approaches with the aim of discovering vulnerabilities have some blind spots, such as time‐consuming, low efficiency, and low degree of automation. This paper introduces a new vulnerability discovering approach based on fuzzing and applies the approach to the IKE protocol. Through summarizing the most comprehensive vulnerable points of IKE protocol and proposing a two‐stage test cases library, an IKE protocol vulnerability discovering tool called IKEProFuzzer is designed and implemented. It is a network protocol fuzzing framework with extensibility and automated Monitor/Debugger designed by ourselves. In the experiments, IKEProFuzzer has discovered 14 vulnerabilities, including nine released vulnerabilities and five unreleased ones, which affect many kinds of routers and applications. The evaluation results prove the feasibility, efficiency, and extensibility of the approach compared with the existing approaches. Copyright © 2012 John Wiley & Sons, Ltd.

Potential Attacks on Onboard Aerospace Systems

Because security is becoming a major concern for aircraft manufacturers and satellite makers, vulnerability discovery and countermeasures should be integrated into onboard computing systems early during their development. Attacks against aerospace computer systems fall into two main classes. One aims to corrupt the computing system's core functions; the other targets fault-tolerance mechanisms (error detection and recovery).

Silver Bullet Talks with Halvar Flake

Gary McGraw interviews Halvar Flake. Before moving over to Google, Halvar Flake ran Zynamics, a company specializing in reverse engineering tools, as an independent researcher and consultant focused on reverse engineering and vulnerability discovery. Flake has spoken at RSA, Black Hat, CanSecWest, and other venues; he has also taught classes on code analysis, reverse engineering, and vulnerability analysis for independent software vendors and governments. Hear the full podcast at www.computer.org/silverbullet or www.cigital.com/silverbullet.

Static program analysis assisted dynamic taint tracking for software vulnerability discovery

The evolution of computer science has exposed us to the growing gravity of security problems and threats. Dynamic taint analysis is a prevalent approach to protect a program from malicious behaviors, but fails to provide any information about the code which is not executed. This paper describes a novel approach to overcome the limitation of traditional dynamic taint analysis by integrating static analysis into the system and presents framework SDCF to detect software vulnerabilities with high code coverage. Our experiments show that SDCF is not only able to provide efficient runtime protection by introducing an overhead of 4.16× based on the taint tracing technique, but is also capable of discovering latent software vulnerabilities which have not been exploited, and achieve code coverage of more than 90%.

Improving penetration testing through static and dynamic analysis

AbstractPenetration testing is widely used to help ensure the security of web applications. Using penetration testing, testers discover vulnerabilities by simulating attacks on a target web application. To do this efficiently, testers rely on automated techniques that gather input vector information about the target web application and analyze the application's responses to determine whether an attack was successful. Techniques for performing these steps are often incomplete, which can leave parts of the web application untested and vulnerabilities undiscovered. This paper proposes a new approach to penetration testing that addresses the limitations of current techniques. The approach incorporates two recently developed analysis techniques to improve input vector identification and detect when attacks have been successful against a web application. This paper compares the proposed approach against two popular penetration testing tools for a suite of web applications with known and unknown vulnerabilities. The evaluation results show that the proposed approach performs a more thorough penetration testing and leads to the discovery of more vulnerabilities than both the tools. Copyright © 2011 John Wiley & Sons, Ltd.

Modeling vulnerability discovery process in Apache and IIS HTTP servers

Vulnerability discovery models allow prediction of the number of vulnerabilities that are likely to be discovered in the future. Hence, they allow the vendors and the end users to manage risk by optimizing resource allocation. Most vulnerability discovery models proposed use the time as an independent variable. Effort-based modeling has also been proposed, which requires the use of market share data. Here, the feasibility of characterizing the vulnerability discovery process in the two major HTTP servers, Apache and IIS, is quantitatively examined using both time and effort-based vulnerability discovery models, using data spanning more than a decade. The data used incorporates the effect of software evolution for both servers. In addition to aggregate vulnerabilities, different groups of vulnerabilities classified using both the error types and severity levels are also examined. Results show that the selected vulnerability discovery models of both types can fit the data of the two HTTP servers very well. Results also suggest that separate modeling for an individual class of vulnerabilities can be done. In addition to the model fitting, predictive capabilities of the two models are also examined. The results demonstrate the applicability of quantitative methods to widely-used products, which have undergone evolution.

Vulnerability Discovery with Attack Injection

The increasing reliance put on networked computer systems demands higher levels of dependability. This is even more relevant as new threats and forms of attack are constantly being revealed, compromising the security of systems. This paper addresses this problem by presenting an attack injection methodology for the automatic discovery of vulnerabilities in software components. The proposed methodology, implemented in AJECT, follows an approach similar to hackers and security analysts to discover vulnerabilities in network-connected servers. AJECT uses a specification of the server's communication protocol and predefined test case generation algorithms to automatically create a large number of attacks. Then, while it injects these attacks through the network, it monitors the execution of the server in the target system and the responses returned to the clients. The observation of an unexpected behavior suggests the presence of a vulnerability that was triggered by some particular attack (or group of attacks). This attack can then be used to reproduce the anomaly and to assist the removal of the error. To assess the usefulness of this approach, several attack injection campaigns were performed with 16 publicly available POP and IMAP servers. The results show that AJECT could effectively be used to locate vulnerabilities, even on well-known servers tested throughout the years.

Vulnerability Discovery with Attack Injection

Vulnerability Discovery with Attack Injection

Application of Vulnerability Discovery Models to Major Operating Systems

A number of security vulnerabilities have been reported in the Windows, and Linux operating systems. Both the developers, and users of operating systems have to utilize significant resources to evaluate, and mitigate the risk posed by these vulnerabilities. Vulnerabilities are discovered throughout the life of a software system by both the developers, and external testers. Vulnerability discovery models are needed that describe the vulnerability discovery process for determining readiness for release, future resource allocation for patch development, and evaluating the risk of vulnerability exploitation. Here, we analytically describe six models that have been recently proposed, and evaluate those using actual data for four major operating systems. The applicability of the proposed models, and the significance of the parameters involved are examined. The results show that some of the models tend to capture the discovery process better than others.

Establishing Multi-level Security in Mobile Data Access

Transaction processing over mobile networks faces new challenges due to limitations in bandwidth and avail- able power, as well as due to intermittent connectivity that causes loss of data and transaction aborts. Besides, the possi- bility of security breach increases substantially due to the frequent motion of clients across cells, which gives rise to novel forms of covert channels. In this paper, we first investigate to what degree this breach may occur and we also assess the suitability of existing protocols for avoiding the appearance of covert channels in mobile database access. Based on the discovery of certain vulnerabilities in these protocols, we propose an optional multi-granularity locking protocol that en- sures secure access to shared data in mobile environments without compromising their consistency or the atomicity of transactions.

Measuring, analyzing and predicting security vulnerabilities in software systems

In this work we examine the feasibility of quantitatively characterizing some aspects of security. In particular, we investigate if it is possible to predict the number of vulnerabilities that can potentially be present in a software system but may not have been found yet. We use several major operating systems as representatives of complex software systems. The data on vulnerabilities discovered in these systems are analyzed. We examine the results to determine if the density of vulnerabilities in a program is a useful measure. We also address the question about what fraction of software defects are security related, i.e., are vulnerabilities. We examine the dynamics of vulnerability discovery hypothesizing that it may lead us to an estimate of the magnitude of the undiscovered vulnerabilities still present in the system. We consider the vulnerability discovery rate to see if models can be developed to project future trends. Finally, we use the data for both commercial and open-source systems to determine whether the key observations are generally applicable. Our results indicate that the values of vulnerability densities fall within a range of values, just like the commonly used measure of defect density for general defects. Our examination also reveals that it is possible to model the vulnerability discovery using a logistic model that can sometimes be approximated by a linear model.

"Patch on demand" saves even more time? [network security

Zero-day attacks are those for which users receive no prior warning and thus have no preventive measures in place. We integrate the vulnerability discovery, patch generation, and patch application cycles into a system that automatically detects a new attack, analyzes its modus operandi, determines the best software patch, and applies it at the desired level of granularity LAN, enterprise, or Internet-wide. We develop a vaccination system that automatically generates patches to protect an application's source code.