Analyzing the security of communication protocols and channels for a pass-through device
A security analyzer includes a single software application that both sends test messages to a device under analysis (DUA) and receives response messages generated by the DUA in response to the test messages. In this way, synchronization of which response messages correspond to which test messages can be reduced or avoided. The software application further determines whether the DUA operated correctly by analyzing the received response messages.
1. A security analyzer device for analyzing vulnerability of a pass-through network device under analysis (DUA) to protocol abuse of a network communications protocol, the security analyzer device comprising:
at least two ports for making network connections to other devices;
a computer processor for executing computer program instructions; and
a computer-readable storage medium having executable computer program instructions for a single software application tangibly embodied thereon, the executable computer program instructions for the single software application comprising instructions for the computer processor to perform the steps of:
establishing a network connection for the sending of messages from a sender through the pass-through network DUA to a receiver, the single software application acting as both the sender and the receiver, wherein establishing the network connection comprises:
establishing a sending side of the network connection from a sending port of the security analyzer device to the pass-through network DUA, the sending port acting as a port of the sender;
establishing a receiving side of the network connection from the pass-through network DUA to a receiving port of the security analyzer device, the receiving port being a different port than the sending port and the receiving port acting as a port of the receiver; and
establishing a connection from the sending side of the network connection through the pass-through network DUA to the receiving side of the network connection;
sending multiple test messages from the sender to the receiver, the test messages probing vulnerability of the pass-through network DUA to protocol abuse of the network communications protocol, the test messages sent from the sending port to the pass-through network DUA via the sending side of the network connection;
receiving multiple response messages corresponding to the test messages, wherein the response messages are received from the pass-through network DUA at the receiving port via the receiving side of the network connection; and
determining whether the pass-through network DUA has vulnerabilities by analyzing the sent test messages and the corresponding received response messages.
2. The security analyzer device of claim 1 wherein at least some of the test messages are invalid with respect to the network communications protocol.
3. The method of claim 2 , wherein the steps further include:
mutating valid messages to create the invalid test messages.
4. The method of claim 2 , wherein at least some of the test messages are malformed test message, and the steps further include:
mutating well-formed messages to create the malformed test messages.
5. The security analyzer device of claim 1 wherein at least some of the test messages are malformed with respect to the network communications protocol.
6. The method of claim 5 , wherein the step further include:
mutating well-formed messages to create the malformed test messages.
7. The security analyzer device of claim 1 wherein at least some of the test messages are valid with respect to the network communications protocol but are inappropriate based on the pass-through network DUA's state.
8. The security analyzer device of claim 1 wherein the pass-through network DUA comprises multiple devices communicatively coupled to each other.
9. The security analyzer device of claim 1 wherein the security analyzer device is communicatively separated from the pass-through network DUA by an intervening device.
10. The security analyzer device of claim 1 wherein:
the single software application sends additional test messages before receiving response messages corresponding to previously sent test messages; and
the step of analyzing the sent test messages and the corresponding received response messages comprises:
determining which received responses messages correspond to which sent test messages; and
comparing the corresponding response messages and test messages.
11. The security analyzer device of claim 1 wherein:
establishing the sending side of the network connection further comprises:
creating a sending socket,
binding the sending socket to the sending port, and
enabling non-blocking reads/writes for the sending socket;
establishing the receiving side of the network connection further comprises:
creating a receiving socket,
binding the receiving socket to the receiving port, and
enabling non-blocking reads/writes for the receiving socket; and
establishing the connection through the pass-through network DUA further comprises:
sending a connection request from the sending socket through the pass-through network DUA to the receiving socket,
selecting the sending socket for writing activity,
selecting the receiving socket for reading activity, and
accepting the connection request by the receiving socket.
12. The security analyzer device of claim 1 wherein the executable computer program instructions for the single software application further comprises instructions for the computer processor to perform the steps of:
sending additional test messages from the receiver to the sender, the additional test messages probing vulnerability of the pass-through network DUA to protocol abuse of the network communications protocol, the additional test messages sent to the pass-through network DUA via the receiving side of the network connection;
receiving additional response messages corresponding to the additional test messages, wherein the additional response messages are received from the pass-through network DUA via the sending side of the network connection; and
determining whether the pass-through network DUA has vulnerabilities by analyzing the sent additional test messages and the corresponding received additional response messages.
13. The security analyzer of claim 1 , wherein the sending side of the network connection does not pass through the network DUA.
14. The security analyzer of claim 1 , wherein the receiving side of the network connection does not pass through the network DUA.
15. The security analyzer of claim 14 , wherein the sending side of the network connection does not pass through the network DUA.
16. A method for analyzing vulnerability of a pass-through network device under analysis (DUA) to protocol abuse of a network communications protocol, the method implemented by a security analyzer device having at least two ports and a single software application executing on the security analyzer device, the method comprising the single software application performing the steps of:
establishing a network connection for the sending of messages from a sender through the pass-through network DUA to a receiver, the single software application acting as both the sender and the receiver, wherein establishing the network connection comprises:
establishing a sending side of the network connection from a sending port of the security analyzer device to the pass-through network DUA, the sending port acting as a port of the sender;
establishing a receiving side of the network connection from the pass-through network DUA to a receiving port of the security analyzer device, the receiving port being a different port than the sending port and the receiving port acting as a port of the receiver; and
establishing a connection from the sending side of the network connection through the pass-through network DUA to the receiving side of the network connection;
sending multiple test messages from the sender to the receiver, the test messages probing vulnerability of the pass-through network DUA to protocol abuse of the network communications protocol, the test messages sent from the sending port to the pass-through network DUA via the sending side of the network connection;
receiving multiple response messages corresponding to the test messages, wherein the response messages are received from the pass-through network DUA at the receiving port via the receiving side of the network connection; and
determining whether the pass-through network DUA has vulnerabilities by analyzing the sent test messages and the corresponding received response messages.
17. The method of claim 16 wherein the at least some of the test messages are invalid with respect to the network communications protocol.
18. The method of claim 17 , further comprising:
mutating valid messages to create the invalid test messages.
19. The method of claim 16 wherein at least some of the test messages are malformed with respect to the network communications protocol.
20. The method of claim 19 , further comprising:
mutating well-formed messages to create the malformed test messages.
21. The method of claim 16 wherein at least some of the test messages are valid with respect to the network communications protocol but are inappropriate based on the pass-through network DUA's state.
22. The method of claim 16 wherein the pass-through network DUA comprises multiple devices communicatively coupled to each other.
23. The method of claim 16 wherein the security analyzer device is communicatively separated from the pass-through network DUA by an intervening device.
24. The method of claim 16 wherein:
the step of sending multiple test messages comprises sending additional test messages before receiving response messages corresponding to previously sent test messages; and
the step of analyzing the sent test messages and the corresponding received response messages comprises:
determining which received responses messages correspond to which sent test messages; and
comparing the corresponding response messages and test messages.
25. The method of claim 16 wherein:
establishing the sending side of the network connection further comprises:
creating a sending socket,
binding the sending socket to the sending port, and
enabling non-blocking reads/writes for the sending socket;
establishing the receiving side of the network connection further comprises:
creating a receiving socket,
binding the receiving socket to the receiving port, and
enabling non-blocking reads/writes for the receiving socket; and
establishing the connection through the pass-through network DUA further comprises:
sending a connection request from the sending socket through the pass-through network DUA to the receiving socket,
selecting the sending socket for writing activity,
selecting the receiving socket for reading activity, and
accepting the connection request by the receiving socket.
26. The method of claim 16 , further comprising:
sending additional test messages from the receiver to the sender, the additional test messages probing vulnerability of the pass-through network DUA to protocol abuse of the network communications protocol, the additional test messages sent to the pass-through network DUA via the receiving side of the network connection;
receiving additional response messages corresponding to the additional test messages, wherein the additional response messages are received from the pass-through network DUA via the sending side of the network connection; and
determining whether the pass-through network DUA has vulnerabilities by analyzing the sent additional test messages and the corresponding received additional response messages.
27. The method of claim 16 , wherein the sending side of the network connection does not pass through the network DUA.
28. The method of claim 16 , wherein the receiving side of the network connection does not pass through the network DUA.
29. The method of claim 28 , wherein the sending side of the network connection does not pass through the network DUA.
30. A computer-readable recording medium having executable computer program instructions for a single software application stored thereon, the executable computer program instructions comprising instructions for performing the steps of:
establishing a network connection for the sending of messages from a sender through a pass-through network DUA to a receiver, the single software application acting as both the sender and the receiver, wherein establishing the network connection comprises:
establishing a sending side of the network connection from a sending port of a security analyzer device to the pass-through network DUA, the sending port acting as a port of the sender;
establishing a receiving side of the network connection from the pass-through network DUA to a receiving port of the security analyzer device, the receiving port being a different port than the sending port and the receiving port acting as a port of the receiver; and
establishing a connection from the sending side of the network connection through the pass-through network DUA to the receiving side of the network connection;
sending multiple test messages from the sender to the receiver, the test messages probing vulnerability of the pass-through network DUA to protocol abuse of the network communications protocol, the test messages sent from the sending port to the pass-through network DUA via the sending side of the network connection;
receiving multiple response messages corresponding to the test messages, wherein the response messages are received from the pass-through network DUA at the receiving port via the receiving side of the network connection; and
determining whether the pass-through network DUA has vulnerabilities by analyzing the sent test messages and the corresponding received response messages.
31. The computer-readable recording medium of claim 30 , wherein the executable computer program instructions further comprises instructions for performing the steps of:
sending additional test messages from the receiver to the sender, the additional test messages probing vulnerability of the pass-through network DUA to protocol abuse of the network communications protocol, the additional test messages sent to the pass-through network DUA via the receiving side of the network connection;
receiving additional response messages corresponding to the additional test messages, wherein the additional response messages are received from the pass-through network DUA via the sending side of the network connection; and
determining whether the pass-through network DUA has vulnerabilities by analyzing the sent additional test messages and the corresponding received additional response messages.
32. The recording medium of claim 30 , wherein the receiving side of the network connection does not pass through the network DUA.
33. The recording medium of claim 30 , wherein the sending side of the network connection does not pass through the network DUA.
34. The recording medium of claim 33 , wherein the receiving side of the network connection does not pass through the network DUA.
35. The recording medium of claim 30 , wherein at least some of the test messages are invalid messages, and the steps further include: mutating valid messages to create the invalid test messages.