Testing Tips

Following are some tips on how you can use analytical observation or reverse engineering to aid your testing:

• Compare small changes in input (files, network traffic, etc.) to better understand the input format. As discussed in the Word file example, by including slightly different data in input and comparing the input format, the format can be more easily understood .

• Modify a programs binary or memory to allow for easier testing of malicious input scenarios. It can be difficult to quickly craft malicious input that is formatted correctly enough to pass sanity checks by the target application; for example, if the data is encoded or digitally signed by the client and sent to the server. By modifying the programs binary or memory, you can include data in your input that isnt normally allowed by the application, but still format it correctly.

• Unless necessary, dont make debug symbols available. In many situations, it is useful for customers to have access to symbols. For example, the symbols for the Windows operating system are publicly available so that developers can more easily debug software that is built on top of it. Unless there is a legitimate need, dont blindly give access to your products symbols. Information included in symbols helps attackers analyze the software.

• Copy protection routines require testing without using source code. To assess how easy it is to bypass a programs copy protection scheme without access to the original source code, attempt to bypass it using debuggers , decompilers , and disassemblers.

• Realize that if you are trying to hide information, youre fighting a losing battle. Although information included in binaries and memory that an attacker can control can be obfuscated or hidden, a dedicated attacker can uncover this information.

• Fix the root cause. If an API contains a security problem, fix the API instead of just adding a validation routine before calling the API. Validation routines might solve the cases that you are aware of but may also alert attackers to the root cause. Attackers will eagerly seek out all callers of the API in the hope that some dont perform validation. Some of these callers might be in other applications you ship.

• Use decompilers and disassemblers for components missing source code. If you dont have the source code to a component you ship, decompilers and disassemblers can help you better understand the component. The knowledge you gain can aid your security testing.