The Advantages of Block-Based Protocol Analysis for Security Testing

From: Dave Aitel (dave@IMMUNITYSEC.COM)
Date: 02/04/03

  • Next message: Russ: "Alert: Microsoft Security Bulletin - MS03-004" 
    Date:         Tue, 4 Feb 2003 16:48:41 -0500
From: Dave Aitel <dave@IMMUNITYSEC.COM>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    Immunity, Inc. is proud to announce both a new paper on SPIKE and
    related fuzzing technology, and the release of SPIKE 2.8. Both are
    available from http://www.immunitysec.com/spike.html . SPIKE is a
    full-featured network protocol analysis toolkit, written in C, and
    released under the GNU Public License (GPL).

    The most obvious change to SPIKE 2.8 is the inclusion of a DCE-RPC over
    named pipe fuzzer.

    The abstract of the paper is below. It should be noted that the paper
    contains not only detailed information on how to detect the RPC Locator
    vulnerability with SPIKE, but also several other vulnerabilities in
    Windows 2000 that were discovered as part of this testing. (For a binary
    of one of them, try http://www.immunitysec.com/downloads/plonk ).

    The Advantages of Block-Based Protocol Analysis for Security Testing

    Abstract. This paper describes an effective method for black-box testing
    of unknown or arbitrarily complex network protocols for common problems
    relating to the security of a program or system. By introducing a
    block-based method for taking advantage of all known factors in a
    network protocol, and delimiting the effect of all unknown factors, the
    potential space of inputs to a program can be reduced intelligently by a
    tester, compensating for incomplete knowledge of the target's
    implementation or design.

    Thank you,

    Dave Aitel
    Public and Media Relations
    Immunity, Inc.
    http://www.immunitysec.com/
    917-545-4742

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    Delivery co-sponsored by TruSecure Corporation
    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    TICSA - Anniversary Special - Limited Time

    Become TICSA certified for just $221.25 US when you register before 3/31/03
    with PROMO "TS0103" at www.2test.com. NO membership fees, certification
    good for 2 years. Price for international delivery just $296.25 US, with
    this offer. Offer cannot be combined with any other special and expires
    3/31/03. Visit www.trusecure.com/ticsa for full details.

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

    Relevant Pages