CERT/CC Blog

CERT Basic Fuzzing Framework 2.5 Released

Mon, 30 Apr 2012 11:00:00 -0500

Hi folks, Allen Householder here. In addition to the recent introduction of our new Failure Observation Engine (FOE) fuzzing framework for Windows and Linux Triage Tools, we have updated the CERT Basic Fuzzing Framework (BFF) to version 2.5. This post highlights the significant changes.

CERT Linux Triage Tools 1.0 Released

Wed, 25 Apr 2012 10:21:00 -0500

As part of the vulnerability discovery work at CERT, we have developed a GNU Debugger (GDB) extension called "exploitable" that classifies Linux application bugs by severity. Version 1.0 of the extension is available for public download here. This blog post contains an overview of the extension and how it works.

CERT Failure Observation Engine 1.0 Released

Mon, 23 Apr 2012 16:39:17 -0500

Hello, this is David Warren from the CERT Vulnerability Analysis team. In May 2010, CERT released the Basic Fuzzing Framework, a Linux-based file fuzzer. We released BFF with the intent to increase awareness and adoption of automated, negative software testing. An often-requested feature is that BFF support the Microsoft Windows platform. To this end, we have worked to create a Windows analog to the BFF: the Failure Observation Engine (FOE). Through our internal testing, we've been able to help identify, coordinate, and fix exploitable vulnerabilities in Adobe, Microsoft, Google, Oracle, Autonomy, and Apple software, as well as many others. Our office shootout post is a good example of this testing.

Vulnerability Severity Using CVSS

Wed, 11 Apr 2012 22:10:10 -0500

If you analyze, manage, publish, or otherwise work with software vulnerabilities, hopefully you've come across the Common Vulnerability Scoring System (CVSS). I'm happy to announce that US-CERT Vulnerability Notes now provide CVSS metrics.

CNAME flux

Thu, 05 Jan 2012 16:15:00 -0500

Hello this is Jonathan Spring. Recently, Leigh Metcalf and I uncovered some interesting results in our continuing work on properties of the Domain Name System (DNS). Our work involves an unconventional use of CNAME (canonical name) records. Besides an IP address, CNAME records are the only other location a domain may have in the DNS. Instead of an IP address, a CNAME record is a redirection or alias service that points to another name.

Challenges in Network Monitoring above the Enterprise

Fri, 23 Sep 2011 10:06:00 -0500

Recently George Jones, Jonathan Spring, and I attended USENIX Security '11. We hosted an evening Birds of a Feather (BoF) session where we asked a question of some significance to our CERT^® Network Situational Awareness (NetSA) group:

Is Large-Scale Network Security Monitoring Still Worth Effort?

Signed Java and Cisco AnyConnect

Thu, 09 Jun 2011 13:35:13 -0500

A few years ago, I published a blog entry called Signed Java Applet Security: Worse than ActiveX? In that entry, I explained the problems that arise when a vulnerability is discovered in a signed Java applet. Let's see how the Cisco AnyConnect vulnerability is affected.

Effectiveness of Microsoft Office File Validation

Thu, 19 May 2011 14:26:00 -0500

Microsoft recently released a component for Office called Office File Validation that is supposed to help protect against attacks using malformed files. Because I recently performed file fuzzing tests on Microsoft Office, I decided to test the effectiveness of Office File Validation.

A Security Comparison: Microsoft Office vs. Oracle Openoffice

Wed, 13 Apr 2011 14:52:00 -0500

Recently, Dan Kaminsky published a blog entry that compared the fuzzing resiliency of Microsoft Office and Oracle OpenOffice. This blog entry contains the results from a similar test that I performed in November 2010. Also included are some other aspects of the Office suites that can affect the software's security.

Announcing the CERT Basic Fuzzing Framework 2.0

Mon, 28 Feb 2011 15:53:00 -0500

Version 2.0 of the CERT Basic Fuzzing Framework (BFF) made its debut on Valentine's Day at the 2011 CERT Vendor Meeting in San Francisco. This new edition has a lot of cool features that we'll be describing in more detail in future posts, but we wanted to let you know that it's available so that you can download and try it.

"Network Monitoring for Web-Based Threats" released

Mon, 14 Feb 2011 13:32:00 -0500

The CERT Network Situational Awareness (NetSA) team, specifically our talented and hard-working intern Matthew Heckathorn under Sid Faber's guidance, has published an SEI Technical Report on monitoring web-based threats.

Blog reorganization

Fri, 11 Feb 2011 15:01:00 -0500

Hi, folks. As you can see, we've changed the name of the Vulnerability Analysis Blog to the CERT/CC Blog. With this name change, we're expanding the focus of the blog to include content from other technical teams.

CERT Basic Fuzzing Framework Update

Wed, 22 Sep 2010 11:26:00 -0500

Hi, folks. We've recently updated the CERT^® Basic Fuzzing Framework (BFF). The new BFF 1.1 contains new functionality and improves performance.

Study of Malicious Domain Names: TLD Distribution

Tue, 31 Aug 2010 14:28:00 -0500

Hello, folks. This post comes to you courtesy of Aaron Shelmire from the Network Situational Awareness team. Aaron writes:

Recently the Network Situational Awareness team at CERT has been researching the characteristics of malicious network touchpoints. The findings of this initial research are very telling as to the true state of security on the internet.

CERT Basic Fuzzing Framework

Wed, 26 May 2010 14:00:00 -0500

Hi folks. I've been involved in a fuzzing effort at CERT. One of the ways that I've been able to discover vulnerabilities is through "dumb" or mutational fuzzing. We have developed a framework for performing automated dumb fuzzing. Today we are releasing a simplified version of automated dumb fuzzing, called the Basic Fuzzing Framework (BFF).