Oulu University Secure Programming Group

Last updated

The Oulu University Secure Programming Group (OUSPG) is a research group at the University of Oulu that studies, evaluates and develops methods of implementing and testing application and system software in order to prevent, discover and eliminate implementation level security vulnerabilities in a pro-active fashion. The focus is on implementation level security issues and software security testing.

Contents

History

OUSPG has been active as an independent academic research group in the Computer Engineering Laboratory in the Department of Electrical and Information Engineering in the University of Oulu since summer 1996.

OUSPG is most known for its participation in protocol implementation security testing, which they called robustness testing, using the PROTOS mini-simulation method. [1]

The PROTOS was co-operated project with VTT and number of industrial partners. The project developed different approaches of testing implementations of protocols using black-box (i.e. functional) testing methods. The goal was to support pro-active elimination of faults with information security implications, promote awareness in these issues and develop methods to support customer driven evaluation and acceptance testing of implementations. Improving the security robustness of products was attempted through supporting the development process.

The most notable result of the PROTOS project was the result of the c06-snmp test suite, which discovered multiple vulnerabilities in SNMP.

The work done in PROTOS is continued in PROTOS-GENOME, which applies automatic structure inference combined with domain specific reasoning capabilities to enable automated black-box program robustness testing tools without having prior knowledge of the protocol grammar. This work has resulted in a large number of vulnerabilities being found in archive file and antivirus products.

Commercial spin-offs

The group has produced two spin-off companies, Codenomicon continues the work of the PROTOS and Clarified Networks the work in FRONTIER.

Related Research Articles

<span class="mw-page-title-main">Paul Vixie</span> American internet pioneer

Paul Vixie is an American computer scientist whose technical contributions include Domain Name System (DNS) protocol design and procedure, mechanisms to achieve operational robustness of DNS implementations, and significant contributions to open source software principles and methodology. He also created and launched the first successful commercial anti-spam service. He authored the standard UNIX system programs SENDS, proxynet, rtty and Vixie cron. At one point he ran his own consulting business, Vixie Enterprises.

The Secure Shell Protocol (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. Its most notable applications are remote login and command-line execution.

Simple Network Management Protocol (SNMP) is an Internet Standard protocol for collecting and organizing information about managed devices on IP networks and for modifying that information to change device behaviour. Devices that typically support SNMP include cable modems, routers, switches, servers, workstations, printers, and more.

In computing, Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts packets of data to provide secure encrypted communication between two computers over an Internet Protocol network. It is used in virtual private networks (VPNs).

<span class="mw-page-title-main">Sendmail</span> Open-source mail transfer agent

Sendmail is a general purpose internetwork email routing facility that supports many kinds of mail-transfer and delivery methods, including the Simple Mail Transfer Protocol (SMTP) used for email transport over the Internet.

Jarkko Oikarinen is a Finnish IT professional and the inventor of the first Internet chat network, called Internet Relay Chat (IRC), where he is known as WiZ.

<span class="mw-page-title-main">Naukowa i Akademicka Sieć Komputerowa</span>

Naukowa i Akademicka Sieć Komputerowa or NASK is a Polish research and development organization and data networks operator.

<span class="mw-page-title-main">Fuzzing</span> Automated software testing technique

In programming and software development, fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks. Typically, fuzzers are used to test programs that take structured inputs. This structure is specified, e.g., in a file format or protocol and distinguishes valid from invalid input. An effective fuzzer generates semi-valid inputs that are "valid enough" in that they are not directly rejected by the parser, but do create unexpected behaviors deeper in the program and are "invalid enough" to expose corner cases that have not been properly dealt with.

Mutation testing is used to design new software tests and evaluate the quality of existing software tests. Mutation testing involves modifying a program in small ways. Each mutated version is called a mutant and tests detect and reject mutants by causing the behaviour of the original version to differ from the mutant. This is called killing the mutant. Test suites are measured by the percentage of mutants that they kill. New tests can be designed to kill additional mutants. Mutants are based on well-defined mutation operators that either mimic typical programming errors or force the creation of valuable tests. The purpose is to help the tester develop effective tests or locate weaknesses in the test data used for the program or in sections of the code that are seldom or never accessed during execution. Mutation testing is a form of white-box testing.

<span class="mw-page-title-main">NETCONF</span>

The Network Configuration Protocol (NETCONF) is a network management protocol developed and standardized by the IETF. It was developed in the NETCONF working group and published in December 2006 as RFC 4741 and later revised in June 2011 and published as RFC 6241. The NETCONF protocol specification is an Internet Standards Track document.

The change request management process in systems engineering is the process of requesting, determining attainability, planning, implementing, and evaluating of changes to a system. Its main goals are to support the processing and traceability of changes to an interconnected set of factors.

<span class="mw-page-title-main">Robert C. Seacord</span> American computer security expert

Robert C. Seacord is an American computer security specialist and writer. He is the author of books on computer security, legacy system modernization, and component-based software engineering.

In computer science, fault injection is a testing technique for understanding how computing systems behave when stressed in unusual ways. This can be achieved using physical- or software-based means, or using a hybrid approach. Widely studied physical fault injections include the application of high voltages, extreme temperatures and electromagnetic pulses on electronic components, such as computer memory and central processing units. By exposing components to conditions beyond their intended operating limits, computing systems can be coerced into mis-executing instructions and corrupting critical data.

<span class="mw-page-title-main">VTT Technical Research Centre of Finland</span> Research and technology company in Finland

VTT Technical Research Centre of Finland Ltd is a state-owned and controlled non-profit limited liability company. VTT is the largest research and technology company and research centre conducting applied research in Finland. It provides research and innovation services and information for domestic and international customers and partners, both in private and public sectors.

Robustness testing is any quality assurance methodology focused on testing the robustness of software. Robustness testing has also been used to describe the process of verifying the robustness of test cases in a test process. ANSI and IEEE have defined robustness as the degree to which a system or component can function correctly in the presence of invalid inputs or stressful environmental conditions.

AbuseHelper is an open-source project initiated by the computer emergency response teams (CERTs) of Finland and Estonia with ClarifiedNetworks to automatically process incidents notifications.

<span class="mw-page-title-main">InterWorking Labs</span>

InterWorking Labs is a privately owned company in Scotts Valley, California, in the business of optimizing application performance for applications and embedded systems. Founded in 1993 by Chris Wellens and Marshall Rose, it was the first company formed specifically to test network protocol compliance. Its products and tests allow computer devices from many different companies to communicate over networks.

The following outline is provided as an overview of and topical guide to computer security:

<span class="mw-page-title-main">KRACK</span> Attack on the Wi-Fi Protected Access protocol

KRACK is a replay attack on the Wi-Fi Protected Access protocol that secures Wi-Fi connections. It was discovered in 2016 by the Belgian researchers Mathy Vanhoef and Frank Piessens of the University of Leuven. Vanhoef's research group published details of the attack in October 2017. By repeatedly resetting the nonce transmitted in the third step of the WPA2 handshake, an attacker can gradually match encrypted packets seen before and learn the full keychain used to encrypt the traffic.

<span class="mw-page-title-main">Kenneth Holmberg</span> Finnish engineer

Kenneth Gösta Holmberg is a Finnish professor emeritus in Mechanical Engineering, especially Tribology,

References

  1. Kaksonen, Rauli (2001). A Functional Method for Assessing Protocol Implementation Security (PDF) (Licentiate thesis). VTT Publications 448. Espoo: Technical Research Centre of Finland. 128 p. + app. 15 p. ISBN   951-38-5874-X . Retrieved 12 September 2013.

As of 12:21, 30 July 2009 (UTC), this article is derived in whole or in part from University of Oulu. The copyright holder has licensed the content in a manner that permits reuse under CC BY-SA 3.0 and GFDL. All relevant terms must be followed.The original text was at "Oulu University Secure Programming Group"