Codenomicon Defensics- Fuzz Testing Software

Request for Quote: FDA-13-1120705 1. Statement of Need Software bugs (bugs) often create vulnerabilities because they cause software to behave differently than intended. The software might crash, making it unavailable, or consume all available resources, or cause other unpredictable consequences. In the worst case, an attacker might be able to trigger the bug in a special way such that he or she can run his or her own instructions. Some bugs are exposed and fixed during the testing phase of a software development process. The bugs that slip past the testing phase without being found and fixed are unknown vulnerabilities and can be triggered, sometimes with catastrophic results, after the product release. The best way to discover unknown vulnerabilities is Fuzzing, a negative software testing method that feeds a program, device or system with malformed and unexpected input data in order to find defects. Malformed, anomalous input such as overflow, underflow or repetition trigger a vulnerability in software, causing for example crashes, denial of service (DoS), security exposures or performance degradation. The test target is carefully monitored during testing to detect the failures. When software is fuzz tested proactively, vulnerabilities can be found and fixed before deployment, resulting more secure and robust, high quality software. Fuzz tested product has less critical vulnerabilities that need to be patched. This means less cost from patch development and release, and product recalls. FDA is developing a cybersecurity laboratory in which a fuzz testing capability is to be integrated. FDA is seeking commercial Fuzz testing tools and the Defensics product line from Codenomicon is one of the best on the market since it provides both ongoing support in the form of updated scripts but also because it generates a top quality output report with the results of every test outlined and the possible mitigations for the vulnerability listed. Of significant importance is the fact it is a Java application allowing FDA to run it on any operating system and in fact we intend to operate this tool suite on a laptop running Linux Centos 6.3. In this way we can protect the results of the testing from being affected by ambient threats found on some other operating systems. When needed we can operate this tool on other platforms and even inside enclaved environments. 2. Statement of Work (SOW)/Performance Work Statement (PWS) Software that can provide fuzz testing, or fuzzing, is the process of sending intentionally malformed inputs to software for the purpose of locating vulnerabilities. When failures are found, they can be fixed which makes the software more robust and more secure. 3. Period of Performance: July 25, 2013 - 24 July 2014 Item Requested: 1- 1 Seat Bluetooth Testing Tools Suite 2- 1 Seat WiFi Client WPA Testing Told Suite 3- 1 Seat HTTP Server Testing Tolls Suite 4- Bluetooth Transmitter 5- 1 802.1 1n Radio Transmitter 6- 1 Onsite Training & Implementation (3 Days) 7- 1 Additional Onsite Training & Implementation 1. Statement of Need Software bugs (bugs) often create vulnerabilities because they cause software to behave differently than intended. The software might crash, making it unavailable, or consume all available resources, or cause other unpredictable consequences. In the worst case, an attacker might be able to trigger the bug in a special way such that he or she can run his or her own instructions. Some bugs are exposed and fixed during the testing phase of a software development process. The bugs that slip past the testing phase without being found and fixed are unknown vulnerabilities and can be triggered, sometimes with catastrophic results, after the product release. The best way to discover unknown vulnerabilities is Fuzzing, a negative software testing method that feeds a program, device or system with malformed and unexpected input data in order to find defects. Malformed, anomalous input such as overflow, underflow or repetition trigger a vulnerability in software, causing for example crashes, denial of service (DoS), security exposures or performance degradation. The test target is carefully monitored during testing to detect the failures. When software is fuzz tested proactively, vulnerabilities can be found and fixed before deployment, resulting more secure and robust, high quality software. Fuzz tested product has less critical vulnerabilities that need to be patched. This means less cost from patch development and release, and product recalls. FDA is developing a cybersecurity laboratory in which a fuzz testing capability is to be integrated. FDA is seeking commercial Fuzz testing tools and the Defensics product line from Codenomicon is one of the best on the market since it provides both ongoing support in the form of updated scripts but also because it generates a top quality output report with the results of every test outlined and the possible mitigations for the vulnerability listed. Of significant importance is the fact it is a Java application allowing FDA to run it on any operating system and in fact we intend to operate this tool suite on a laptop running Linux Centos 6.3. In this way we can protect the results of the testing from being affected by ambient threats found on some other operating systems. When needed we can operate this tool on other platforms and even inside enclaved environments. 2. Statement of Work (SOW)/Performance Work Statement (PWS) Software that can provide fuzz testing, or fuzzing, is the process of sending intentionally malformed inputs to software for the purpose of locating vulnerabilities. When failures are found, they can be fixed which makes the software more robust and more secure. 3. Period of Performance: July 25, 2013 - 24 July 2014