Fuzzing, Search Warnings Released

A couple of warnings have been issued by Secure Computing. One warning involves Fuzzing and the other regarding Google's hidden malware search capabilities.

Fuzzing is an automated methodology for testing applications for bugs by checking allowed input for a given application and trying to force abnormal responses to see if unexpected results (bugs) can be generated. Once a bug is found, further research can determine if the bug can be exploited as a vulnerability and then be packaged as an exploit.

The increase in application vulnerabilities that have recently been reported are thought to be a direct result of the use of Fuzzing tools. To further demonstrate the power of Fuzzing the vulnerability researchers at the Metasploit Project are releasing a new vulnerability for Internet Explorer every day for the month of July.

"Fuzzing will clearly accelerate the ability for hackers to discover new vulnerabilities in software applications," said Secure Computing's Paul Henry.

Secure Computing also issued a warning about the previously hidden malware search capabilities within Google that were heralded as a tool reserved only for Anti Virus and Security Research firms just weeks ago.

According to Secure Computing, these previously hidden search capabilities have already fallen into the hands of intruders. The key to finding malware in Google lies in having the signature for the specific malware program. Intruders are now sharing these signatures openly on the Internet, making it easy to search Google for the signature of a specific piece of malware. Web sites now catalog these signatures and allow users to simply enter the malware program name and they return the signature for the malware from their database. Users of these signature catalogs are encouraged to submit new malware so the site owners can quickly generate a signature for the malware for their community of users.

"Why bother creating a new virus, worm or Trojan when you can simply find one and download it using Google," said Henry. "Unskilled hackers can use this previously unknown capability of Google to download malware and release it on the Internet in targeted attacks as if they wrote it themselves to try to impress their peers with their skills."

Posted by Jon Erickson at 09:19 AM  Permalink