150 likes | 349 Views
MSDN Webcast - SDL Process. Fuzzing And The SDL. Agenda. Fuzzing & The SDL Integration of fuzzing Importance of fuzzing Michael Eddington Déjà vu Security mike@dejavusecurity.com. How Fuzzers Work (Dumb). FUZZER. How Fuzzers Work (Smart). FUZZER. All about the bugs!.
E N D
MSDN Webcast - SDL Process Fuzzing And The SDL
Agenda • Fuzzing & The SDL • Integration of fuzzing • Importance of fuzzing Michael Eddington Déjà vu Security mike@dejavusecurity.com
How Fuzzers Work (Dumb) FUZZER
How Fuzzers Work (Smart) FUZZER
All about the bugs! • …Or really Bug Cost… • Fuzzing is about finding bugs • Fuzzing is repeatable • Integrate into automated testing • Fuzzing *should* be easy on the wallet • Cost per Bug
What are we finding? • Bugs that cause crashes, access violations • Memory corruption • Overflows • Type issues • DOS issues • Memory consumption • Process Hangs
Who uses fuzzing? • Security researchers • Majority of publicly released bugs • Top software firms in there SDL • Microsoft • Adobe • Etc.
What is SDL? Microsoft’s Secure Development Lifecycle Integration of security into development life cycle Microsoft uses SDL on all shipping products
SDL Phases • Requirements • Security Kickoff • Training • Design • Best practices • Threat modeling • Architecture review • Implementation • Use security dev tools • Best practices • Security tools built • Verification • Security response plan • Security push • Pen testing • Source review • Fuzzing • Release • Support & Servicing • Response execution • Security servicing
Fuzzing & SDL • Microsoft requires fuzzing on: • Non-executable file formats • Protocol stacks, RPC, DCOM, etc • Basically, any parser that operates on data that originates from a lesser privileged principal (trust boundary) • Fuzzing integrating into the Verification phase and the security push
Fuzzing & SDL • Deterministic fuzzing • Full run required • Non-deterministic “random” fuzzing • 250,000 to 500,000 iterations with no new faults • No recommendation on minimum code coverage
Fuzzing & SDL • Complements other verification elements • Does not replace Penetration Testing • Does not replace Source Code Review • Long term repeatable process • Initial investment should be re-usable
Numerous Fuzzing Options Open Source Commercial • Peach • Sully • Fuzzware • MiniFuzz • Etc. • beSTORM • Codenomicon • Mu Security
Open Source vs. Commercial Open Source Commercial • Custom formats • Custom protocols • Zero upfront cost • Hidden costs • Developing models • Support/Training • Existing well known file format or network protocol • Graphics formats • Video formats • Common protocols • Upfront costs • $15K to $100K
Thanks! Michael Eddington Leviathan Security Group, inc. mike@dejavusecurity.com http://phed.org http://peachfuzzer.com http://dejavusecurity.com