Abstract:SSL and TLS are two secure protocols for creating secure connections over the Internet. X.509 certificate validation is important for security and needs to be performed before an SSL/TLS connection is established. However, state-of-the-art testing techniques, such as frankencert and mucert, have revealed, through randomly mutating Internet accessible certificates, that there exist unexpected, sometimes critical, validation differences among different SSL/TLS implementations. Despite these strong efforts, certificate validation is still not thoroughly tested and more effective techniques are needed as this work shows. To this end, this paper introduces transcert, a novel approach for effectively guiding fuzzing to perform deep testing of X.509 certificate validation. The goal of transcert is to generate certificates that trigger diverse executions; it achieves this goal by introducing the concept of a coverage transfer graph to efficiently, precisely abstract program executions. In particular, it records the execution of how a given certificate is validated by a reference SSL/TLS implementation. It then constructs a coverage transfer graph to model the coverage transfer from a test certificate (seed) to its mutated certificates (mutants), and explores the coverage transfer graph by iteratively sampling and mutating certificates. We have implemented transcert and evaluated it against frankencert and mucert on four state-of-the-art SSL/TLS implementations. The evaluation results clearly show the strengths of transcert- during 10,000 iterations, transcert has revealed 3,469 validation differences, 8× as many as those revealed by frankencert and mucert. We have identified 11 root causes of validation differences, all of which have been confirmed and five have never been reported previously. We also found that the primary goal of certificate chain validation is stated ambiguously in the widely-adopted PKI standard RFC 5280.

sec-certs: Examining the security certification practice for better vulnerability mitigation

Chain of trust: Unraveling references among Common Criteria certified products

Fine-grained Commit-level Vulnerability Type Prediction by CWE Tree Structure.

Vulnerability Assessment of Sensor Systems

Defining Security Requirements with the Common Criteria: Applications, Adoptions, and Challenges

Automated CVE Analysis for Threat Prioritization and Impact Prediction

Software Vulnerability Analysis Using CPE and CVE

System Security Assurance: A Systematic Literature Review

Analysis and implementation of semi-automatic model for vulnerability exploitations of threat agents in NIST databases

Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting

Linking Common Vulnerabilities and Exposures to the MITRE ATT&CK Framework: A Self-Distillation Approach

Evaluating C/C++ Vulnerability Detectability of Query-Based Static Application Security Testing Tools

Unintentional Security Flaws in Code: Automated Defense via Root Cause Analysis

Analysis of Relationships between Non-conformities, Process Maturity and Continual Improvement in Information Security Management Systems

Unveiling Hidden Links Between Unseen Security Entities

A Relevance Model for Threat-Centric Ranking of Cybersecurity Vulnerabilities

Guided, Deep Testing of X.509 Certificate Validation Via Coverage Transfer Graphs

QualSec: An Automated Quality-Driven Approach for Security Risk Identification in Cyber-Physical Production Systems

Déjà Vu: Side-Channel Analysis of Mozilla's NSS

Uncovering CWE-CVE-CPE Relations with Threat Knowledge Graphs

Development of a System Vulnerability Analysis Tool for Assessment of Complex Mission Critical Systems