Assessment and analysis of software security flaws in virtual machines

• US 8,613,080 B2
• Filed: 06/07/2011
• Issued: 12/17/2013
• Est. Priority Date: 02/16/2007
• Status: Active Grant

• Current Assignee: Veracode Incorporated (Broadcom, Inc.)
• Original Assignee: Veracode Incorporated (Broadcom, Inc.)
• Inventors: Wysopal, Christopher J., Moynahan, Matthew P., Stevenson, Jon R.
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): TRUONG, THONG P
• Application Number:
  US13/154,576
• Publication Number:
  US 20120072968A1
• Time in Patent Office: 924 Days
• Field of Search: 726/19, 726/22
• US Class Current: 726/19
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software

Abstract

Security analysis and vulnerability testing results are “packaged” or “bound to” the actual software it describes. By linking the results to the software itself, downstream users of the software can access information about the software, make informed decisions about implementation of the software, and analyze the security risk across an entire system by accessing all (or most) of the reports associated with the executables running on the system and summarizing the risks identified in the reports.

Claims

1. A computer-implemented method of identifying vulnerabilities of a collection of software programs compiled into a virtual machine image, the method comprising the steps of:

receiving an image file representing a computer system as a virtual machine, wherein the image file comprises at least one of operating system information, an application, an application server, application data, and configuration information;

loading the image file into a computer memory;

executing the loaded image file to implement the virtual machine on a processor; and

analyzing the executing image file to obtain a listing of potential vulnerabilities, the analysis comprising;

extracting files of the virtual machine from the image file;

identifying at least one installed application within the virtual machine;

identifying and separating one or more files related to the installed application;

building a control flow model of at least one of the separated files;

building a data flow model of at least one of the separated files;

detecting one or more potential vulnerabilities of each separated file by scanning one or more of the models and using a vulnerability database; and

combining the detected potential vulnerabilities with the listing of potential vulnerabilities.

2. The method of claim 1, wherein the analyzing step further comprises inspecting an operating system configuration to detect one or more potential vulnerabilities.

3. The method of claim 1, wherein the analyzing step further comprises inspecting registry files to detect one or more potential vulnerabilities.

4. The method of claim 1, wherein the analyzing step further comprises determining if a plurality of applications are included in the virtual machine, and if so, analyzing interactions among the plurality of installed applications comprising the steps of:

building an interaction control flow model among the plurality of installed applications;

building an interaction data flow model among the plurality of installed applications; and

detecting one or more potential vulnerabilities by scanning each interaction model.

5. The method of claim 1, wherein the analyzing step comprises scanning the executing image file using one or more of a network vulnerability scanner and a host vulnerability scanner.

6. The method of claim 1, further comprising the steps of:

detecting an executing application within the virtual machine;

detecting potential vulnerabilities of the executing application using a scanner; and

combining the detected potential vulnerabilities with the listing of potential vulnerabilities.

7. The method of claim 6, wherein the detecting the potential vulnerabilities of the executing application comprises:

connecting to the executing application within the virtual machine;

providing at least one test input to the executing application; and

inspecting a response from the executing application to the at least one test input to detect one or more potential vulnerabilities.

8. The method of claim 7, further comprising providing login credentials of the executing application.

9. The method of claim 7, further comprising providing predetermined user interface navigation information associated with the executing application to the scanner for use in detecting the potential vulnerabilities of the executing application.

10. The method of claim 7, further comprising providing sample user input data associated with the executing application to the scanner for use in detecting the potential vulnerabilities of the executing application.

11. The method of claim 6, further comprising performing fuzz testing on the executing application comprising the steps of:

sending test data to the executing application through a network port; and

inspecting a response of the executing application to the test data to detect one or more potential vulnerabilities.

12. The method of claim 11, further comprising re-executing the loaded image file if the executing application does not respond to the test data.

13. The method of claim 1, further comprising:

creating a security report from the listing of potential vulnerabilities;

computing a security score from the security report; and

comparing the security score with at least one security score associated with an implementation of the computer system.

14. The method of claim 13, further comprising the steps of:

receiving a validation policy;

comparing the security report with the validation policy to derive a set of security data; and

associating the security data with the image file.

15. The method of claim 14, wherein the associating step comprises creating a unique hash of the image file.

16. The method of claim 14, wherein the associating step comprises creating a signature.