beSTORM - Product Security Testing

Products - Product Security

beSTORM performs a comprehensive analysis, exposing security holes in your products during development and after release.

beSTORM represents a new approach to security auditing. This new approach is sometimes called "fuzzing", "fuzz testing" or "fuzzer" and can be used for securing in-house developed applications and devices, as well as applications and devices of external vendors.

Most of the security holes found today in products and applications, can be discovered automatically. By using an automated attack tool that tries virtually all different attack combinations, with the ability to detect certain application anomalies and indicate a successful attack, those security holes can be found almost without user intervention.

How it works

• Innovative beSTORM performs an exhaustive analysis to uncover new and unknown vulnerabilities in software products. This is different than older generation tools that use attack signatures or attempt to locate known vulnerabilities in products. beSTORM does not need the source code to analyze and uncover vulnerabilities.
• Broad range Many of the common Internet protocols can be tested by beSTORM - even complex protocols such as SIP (used in Voice over IP products) are supported.
• Attack Prioritization Special attack prioritizing algorithms allow beSTORM to start with the attacks most likely to succeed, depending on the specific protocol that is audited. This saves considerable time during the audit process and highlights the most important problems, first.
• Report accuracy beSTORM checks the application externally by triggering actual attacks. Vulnerabilities are reported only if an actual attack has been successful, for example if a buffer overflow has been triggered. Simply put, beSTORM emulates an attacker. If the attacker cannot carry out the attack, beSTORM will not report it, effectively reducing the number of false positives.
• Protocol compliance beSTORM is able to convert the protocol standard text to automated set of tests by converting the BNF description used in technical RFC documents to attack language. This ensures that the entire functionality of the system is checked, and enables to quickly find bugs that otherwise surface only months or years after the product is released to the market.
• Comprehensive analysis beSTORM detects vulnerabilities by attaching to the audited process and detecting even the slightest anomalies. By doing so, beSTORM can find attacks as subtle as 'off-by-one' attacks, as well as buffer overflow attacks that do not crash the application.
• Scaling beSTORM is extremely scalable, with the ability to use multiple processors or multiple machines to parallelize the audit and substantially reduce the testing duration.
• Extensibility beSTORM tests the protocol rather than the product, and therefore can be used to test extremely complicated products with a large code base.
• Flexibility beSTORM's protocol analysis can be easily extended to support your proprietary protocol.
• Language independent beSTORM tests the binary application, and is therefore completely indifferent to the programming language or system libraries used. beSTORM will report the exact interaction that triggers the vulnerability, and the programmers can now debug the application with whatever development environment they wish to see what causes the fault.

Automated Binary Analysis
beSTORM includes an automated engine that can parse through binary data, decode ASN.1 structures as well as length value pairs:

Automated Textual Analysis
beSTORM includes an automated engine that can parse through textual data, recognize multiple forms of data encoding, as well as decode XML structures:

Custom Protocols
For those protocols that cannot be automatically analyzed beSTORM includes a graphical interface that can be used to easily support your proprietary protocols:

Advanced Debugging and Stack Tracing
beSTORM includes an advanced debugging and stack tracing engine that can not only discover potential coding issues, but also show what is the stack trace that brought you to the specific coding issue:

Advantages

• Integrates with the existing development strategy Search for security vulnerabilities during development or as part of your QA process.
• Source code not necessary No need for source code - perfect for auditing 3rd party applications.
• Reproducable Vulnerabilities are searched for in a methodical way which can be reproduced.
• Powerful substitute beSTORM can be used to substitute existing tools used by security auditors and black-box testers.