Transforming Existing Stateful Network Protocol Applications into Effective Protocol-Specific Security Testing Tools

To discover low-level security vulnerabilities in target applications that implement stateful network protocols, security researchers usually employ manually-constructed protocol-specific testing tools. Due to the complexity and heterogeneity of network protocols, however, building such tools for every network protocol used by target programs is a challenging task. We propose a semi-automated technique for creating protocol-specific testing tools, which leverages an existing application that implements a network protocol (a source), and converts it into a testing tool that can be used for bug discovery in any target program that “speaks” the same protocol. We call our implementation of this method InSource, and, by measuring coverage gain, show that InSource can test a target just as well a manually-created protocol- specific testing tool. Furthermore, we show that InSource is effective at testing applications that use different protocols, as long as a source application for each protocol is available.M.A.S.2020-11-26 00:00:0