Device and method for inspecting software for vulnerabilities

CROSS-REFERENCE TO RELATED APPLICATION

0001This application claims priority to and the benefit of <patcit id="pcit0001" dnum="KR2007110850"><text>Korean Patent Application No. 2007-110850, filed November 1, 2007</text></patcit>.

BACKGROUND

1. Field of the Invention

0002The present invention relates to a device and method for inspecting software for vulnerabilities, and more particularly, to a device and method for inspecting software for vulnerabilities that performs fuzzing for specific functions of the software.

2. Discussion of Related Art

0003In a process of developing software, analysis of the software is generally performed by setting a break point at a part of source code likely to have vulnerability using a debugging program, and observing an execution environment of the software when the executed software stops at the break point.

0004On the other hand, since software vulnerability analysis is generally performed in an environment where a source code cannot be obtained, vulnerability of the software is analyzed in a black box test method which can be performed only with an executable file. Here, a black box test is a test method in which the software itself is regarded as a black box whose inner operation cannot be observed directly but can be analyzed based on input/output values of the software.

0005Fuzzing, one such black box test method, is an analysis method used to find defects of software in processing an input by inputting a variety of random data to the software and looking for abnormal operation. Fuzzing is generally performed by making a test case including random data, sequentially executing the test case by software, and analyzing any malfunction of the software.

0006<nplcit id="ncit0001" npl-type="b"><text>Michael Sutton; Adam Greene; Pedram Amini: "Fuzzing: Brute Fore Vulnerability Discovery", 29 July 2007, Addison-Wesley Professional, ISBN: 978-0-321-44611-4, pages 169 - 179</text></nplcit>, discloses a specialized fuzzing method, namely file format fuzzing. The file format fuzzing is used to find an exploitable flaw in the way that an application parses a certain file of type. In order to achieve this goal, file format fuzzing is disclosed to use, for example, brute force fuzzing or intelligent brute force fuzzing.

0007A conventional method for inspecting software for vulnerabilities using such fuzzing randomly generates and analyzes data from regardless of the function of the software. Thus, this method does not enable intensive inspection for vulnerabilities in specific functions of the software.

SUMMARY OF THE INVENTION

0008The present invention is directed to a device and method for inspecting software for vulnerabilities which can intensively fuzz the software by function.

0009One aspect of the present invention provides a device for inspecting software for vulnerabilities, including: a target function selecting module for selecting a function of the software for vulnerabilities to be inspected; a comparison file generating module for generating a first file including the selected function and a second file not including the selected function; a binary pattern comparing module for detecting a changed or added binary pattern by comparing binary values of the first file and the second file; a test case generating module for generating at least one test case based on the detected binary pattern; and a vulnerability verifying module for inspecting vulnerabilities based on the at least one test case and generating a vulnerability inspection result.

0010Another aspect of the present invention provides a method for inspecting software for vulnerabilities, including: selecting a function of the software for vulnerabilities to be inspected; generating a first file including the selected function; generating a second file not including the selected function; comparing binary values of the first file and the second file to detect a changed or added binary pattern; generating at least one test case based on the detected binary pattern; performing vulnerability inspection based on the at least one test case; and outputting a result of the vulnerability inspection.

BRIEF DESCRIPTION OF THE DRAWINGS

0011The above and other objects, features and advantages of the present invention will become more apparent to those of ordinary skill in the art by describing in detail exemplary embodiments thereof with reference to the attached drawing, in which: <ul id="ul0001" list-style="none" compact="compact"><li><figref idref="f0001">FIG. 1</figref> is a block diagram illustrating a configuration of a software vulnerability inspecting device according to an exemplary embodiment of the present invention;</li><li><figref idref="f0002">FIG. 2</figref> is a flowchart illustrating a method for inspecting software for vulnerabilities according to an exemplary embodiment of the present invention; and</li><li><figref idref="f0003 f0004 f0005">FIGS. 3A to 3C</figref> are diagrams illustrating operations of modules included in a software vulnerability inspecting device according to an exemplary embodiment of the present invention.</li></ul>

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

0012The foregoing and other objects, features and advantages of the invention will be apparent from the following more particular description of exemplary embodiments of the invention, as illustrated in the accompanying drawings.

0013<figref idref="f0001">FIG. 1</figref> is a block diagram illustrating a configuration of a software vulnerability inspecting device according to an exemplary embodiment of the present invention.

0014Referring to <figref idref="f0001">FIG. 1</figref>, a software vulnerability inspecting device 100 includes a target function selecting module 110 for selecting a function for inspection, a comparison file generating module 120, a binary pattern comparing module 130, a test case generating module 140 and a vulnerability verifying module 150.

0015The target function selecting module 110 selects a function to be intensively fuzzed from among all functions of the inspected software. The comparison file generating module 120 generates a first file including the selected function and a second file not including the selected function.

0016The binary pattern comparing module 130 detects binary patterns which are different from one another by comparing binary values of the first and second files. Here, a binary pattern refers to as a set of values comprising a series of binary values. The difference between the binary patterns of the first and second files depends on whether or not to include a specific function, so an address of the binary pattern different from one another means an address of the file data corresponding to the specific function. The test case generating module 140 generates a test case to perform fuzzing based on a part detected by the binary pattern comparing module 130. The vulnerability verifying module 150 executes the inspected software using the test case generated by the test case generating module 140, generates and outputs a vulnerability inspection result based on whether or not there is a malfunction occurring during execution of the software.

0017<figref idref="f0002">FIG. 2</figref> is a flowchart illustrating a method of inspecting software for vulnerabilities according to an exemplary embodiment of the present invention.

0018Referring to <figref idref="f0002">FIG. 2</figref>, a function selecting module selects a function of software to be inspected (S210). In one embodiment, the target function selecting module may select a function to be inspected according to a user's input through a user interface, or according to a predefined selection algorithm without a user's input.

0019A comparison file generating module generates a first file including the selected function to be inspected, and a second file not having the selected function to be compared with the first file (S220). In one embodiment, the second file may be an initialized file generated by the software, such as an empty document of a word processor.

0020A binary pattern comparing module detects a changed or added binary pattern by comparing binary values of the first and second files (S230). The binary pattern comparing module may transmit location information including an address of the part of the first file which has been detected by the comparison to a test case generating module.

0021The test case generating module generates a test case for performing fuzzing by inputting random data to the address of the detected part (S240). Generally, a binary value composed of two digits of hexadecimal may be input to one address. Therefore, 255 random data made by subtracting an original data value from 256 (16x16) data may be input to one address. Accordingly, when a total of N addresses are found to not match, Nx255 number of test cases may be generated. In one embodiment, the test case generating module may generate test cases by sequentially substituting binary values other than the original binary value at the address of the detected part.

0022A vulnerability verifying module executes the inspected software using the generated test case as input data, and outputs a vulnerability inspection result based on whether or not there is a malfunction of the software during execution (S260).

0023<figref idref="f0003 f0004 f0005">FIGS. 3A to 3C</figref> are diagrams illustrating operations of modules included in a software vulnerability inspecting device according to an exemplary embodiment of the present invention.

0024Referring to <figref idref="f0003">FIG. 3A</figref>, when a user requests a function selecting module to inspect a table drawing function of Microsoft Word for vulnerabilities, a comparison file generating module may generate a document file containing a table and an empty document file as first and second files, respectively.

0025A binary pattern comparing module 310 may detect changed or added binary values by sequentially comparing binary values of the empty document file and document file containing a table. For example, when the binary value of the empty document file is "<i>D0 CF FF FF FF CC D1 F9 D3 GG 33 DS 91</i>", and the binary value of the document file containing a table is "<i>D0 CF 2A B0 67 CC D1 F9 D3 GG 33 DS 91 ES FF FF FF B1 E2</i>," at 0x01 and 0x02, the two binary values match, but at 0x03 to 0x05, the two values do not match. Further, at 0x06 to 0x13, the binary values of both the files match, but at 0x14 to 0x19, only the document file containing a table has binary values. Accordingly, the binary pattern comparing module may generate location information including 0x03 to 0x05 and 0x14 to 0x19, which are addresses where the binary values of the files do not match, and transmit the information to a test case generating module 320.

0026Referring to <figref idref="f0004">FIG. 3B</figref>, the test case generating module 320 receives the location information on the addresses having unmatched binary values from the binary pattern comparing module, and inputs random data based on the received location information. For example, when 0x03 to 0x05 and 0x14 to 0x19 are transmitted to the test case generating module 320 as addresses having unmatched binary values, since 255 random data can be input to one address, the test case generating module 320 may generate 9x255=2295 number of document files as test cases and then transmit them to a vulnerability verifying module 330.

0027Referring to <figref idref="f0005">FIG. 3C</figref>, the vulnerability verifying module 330 may execute the document files generated as the test cases in Microsoft Word to verify errors probably occurring during execution, and output vulnerability inspection results. When buffer overflow occurs during execution of the document file which is generated by substituting 2A, the binary value of 0x03, for AA, the vulnerability verifying module 330 may output a vulnerability inspection result message "Buffer overflow vulnerability is found when a table drawing function of Microsoft Word is added and the binary value of 0x03 is changed into AA."

0028The present invention may find vulnerabilities relevant to function of software and improve fuzzing efficiency by intensively fuzzing a part of the software changed or added according to the function of the software.

0029While the invention has been shown and described with reference to certain exemplary embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the scope of the invention as defined by the appended claims.