|
Mu’s Published Vulnerabilities (PV) Module is a subscription update service that offers a continuously growing
list of software vulnerability triggers. The PV subscription mirrors
the latest real-world attacks found in the wild on the Internet. Mu’s
PV module is augmented on a bi-weekly basis thus providing testers with
coverage against the latest known vulnerabilities.
The PV module applies repeatable metrics to verify
the proper operation of any inline signature-based security enforcement
device, including Intrusion Prevention Systems (IPS), content-aware
security gateways, deep-inspection firewalls and Unified Threat
Management (UTM) systems.
The Mu Test Suite uses the PV module and its platform
feature set to perform automated audits on a pass-through device to
validate that vulnerability triggers are blocked. The individual
vulnerability triggers within the PV module are delivered over IPv4 or
IPv6, as well as up to 12 different kinds of evasion techniques for
IPv4, or 5 for IPv6), resulting in well over 40,000 unique test cases.
Often, a single vulnerability will allow multiple
similar but unique exploits to target the underlying weakness. Thus,
signatures for Intrusion Detection/Prevention Systems (IDP/IDS/IPS)
that are written to match traffic patterns corresponding to the
underlying vulnerability provide better coverage than more specific
signatures that only match specific exploits.
Mu uses the underlying vulnerability trigger pattern
(such as a buffer overflow sequence) to cause the vulnerability itself
to be triggered, rather than simply ‘replaying’ the traffic associated
with a particular exploit payload in its entirety. This approach,
coupled with various evasion techniques validates the signature-based
product’s ability to detect and block root causes instead of symptoms.
Remediation Toolkit
In addition to
finding issues, the Mu helps fix the issues found by providing testers
with remediation assets that can be used by engineers. These assets can
be sent to developers so that issues are replicated and fixed rapidly.
Examples of the remediation assets are packet captures, test
documentation and standalone Linux executables that replicate test
traffic.
|
