Codenomicon
Encyclopedia
Codenomicon is a private company founded in late 2001, and develops robustness testing
tools (also called fuzzing tools) for manufacturers, service providers, government/defense and enterprise customers. The company has raised Venture money mid 2000's and and has been profitable since 2008, with more than 40% growth in sales each year. In 2011, the company acquired Clarified Networks
, a situation awareness company.
Codenomicon is based in Oulu
, Finland
(Europe
), and has offices in Saratoga, California
(US
), Hong Kong
(Asia
/Pacific) and Singapore
(Asia
/Pacific).
Codenomicon is also known for having t-shirts that say "GO HACK YOURSELF", which they usually have at their booth during security conferences. This comes from the goal of Codenomicon to enable testers and system administrators to find their own zero-day vulnerabilities, instead of depending on external security consultants, and special hacker skills.
These tools have roots in the research done at the University of Oulu
in the Secure Programming Group (OUSPG). Whereas since 1999 the PROTOS project produced free software for testing about 10 protocols, Codenomicon has added support for much wider test coverage for about 200+ protocols, and is providing those tools under commercial licensing. PROTOS tools are still widely used. PROTOS and Codenomicon testing approach, called robustness testing
, is based around the idea of proactive protocol testing by injecting unexpected anomalies into the protocol message sequences, structures and data types; in essence, fuzzing with some intelligence behind the generated test data.
DEFENSICS includes test suites for 200+ protocols industry standard networks protocols such as SMTP, SNMP
, BGP, IPv6
, SSH
and SIP
. In addition there are also test suites for various Bluetooth
profiles and Wireless LAN
. Codenomicon has also built nearly 100 customer proprietary fuzzers for special interfaces such as device API's and complex banking systems.
, an extension of syntax testing, that systematically will explore the input space defined by various communication interfaces or data formats, and will generate intelligent test cases that find crash-level flaws and other failures in software. The technique was first described in a University of Oulu white paper on robustness testing published in 2000, by Kaksonen et al., and Licentiate Thesis by Kaksonen, published in 2001. Fault injection and specification mutations were other names they used for the same approach.
Codenomicon's Defensics Product line is also known as a "Fuzzer that does not fuzz" - means - it uses smart anomalies instead of random Fuzzing structures. This enables fast test execution, extensive test documentation and better test coverage. Defensics tools address all fields in the protocols with all effective combinations of anomalies. Traditional fuzzing lacks this capability as with random inputs that would take too much time to be effective in fast paced test cycles.
The first ideas for the engine were based on ideas the founders had while working at OUSPG, where systematic fuzzing was first used to break ASCII/MIME contents in email clients and web services. Later, the same technique was applied to ASN.1 structures in such protocols as SNMP, LDAP and X.509.
After Codenomicon was founded in 2001, its DEFENSICS product line has grown to cover over 200 industry-standard network protocols and file formats, including wireless interfaces such as Bluetooth and WLAN. DEFENSICS for XML provides an added capability for testing common XML-based protocols and file formats more efficiently than before.
After founding Codenomicon, also PROTOS Test-Suites disclose they are running on top of Codenomicon engine. The research side span out into PROTOS Genome.
Robustness testing
Robustness testing is any quality assurance methodology focused on testing the robustness of software. Robustness testing has also been used to describe the process of verifying the robustness Robustness testing is any quality assurance methodology focused on testing the robustness of software....
tools (also called fuzzing tools) for manufacturers, service providers, government/defense and enterprise customers. The company has raised Venture money mid 2000's and and has been profitable since 2008, with more than 40% growth in sales each year. In 2011, the company acquired Clarified Networks
Clarified Networks
Clarified Networks is a company that is headquartered in Oulu, Finland. The company was acquired by Codenomicon in 2011, but continues to operate as a separate company under the Codenomicon Group....
, a situation awareness company.
Codenomicon is based in Oulu
Oulu
Oulu is a city and municipality of inhabitants in the region of Northern Ostrobothnia, in Finland. It is the most populous city in Northern Finland and the sixth most populous city in the country. It is one of the northernmost larger cities in the world....
, Finland
Finland
Finland , officially the Republic of Finland, is a Nordic country situated in the Fennoscandian region of Northern Europe. It is bordered by Sweden in the west, Norway in the north and Russia in the east, while Estonia lies to its south across the Gulf of Finland.Around 5.4 million people reside...
(Europe
Europe
Europe is, by convention, one of the world's seven continents. Comprising the westernmost peninsula of Eurasia, Europe is generally 'divided' from Asia to its east by the watershed divides of the Ural and Caucasus Mountains, the Ural River, the Caspian and Black Seas, and the waterways connecting...
), and has offices in Saratoga, California
Saratoga, California
Saratoga is a city in Santa Clara County, California, USA. It is located on the west side of the Santa Clara Valley, directly west of San Jose, in the San Francisco Bay area. The population was 29,926 at the 2010 census....
(US
United States
The United States of America is a federal constitutional republic comprising fifty states and a federal district...
), Hong Kong
Hong Kong
Hong Kong is one of two Special Administrative Regions of the People's Republic of China , the other being Macau. A city-state situated on China's south coast and enclosed by the Pearl River Delta and South China Sea, it is renowned for its expansive skyline and deep natural harbour...
(Asia
Asia
Asia is the world's largest and most populous continent, located primarily in the eastern and northern hemispheres. It covers 8.7% of the Earth's total surface area and with approximately 3.879 billion people, it hosts 60% of the world's current human population...
/Pacific) and Singapore
Singapore
Singapore , officially the Republic of Singapore, is a Southeast Asian city-state off the southern tip of the Malay Peninsula, north of the equator. An island country made up of 63 islands, it is separated from Malaysia by the Straits of Johor to its north and from Indonesia's Riau Islands by the...
(Asia
Asia
Asia is the world's largest and most populous continent, located primarily in the eastern and northern hemispheres. It covers 8.7% of the Earth's total surface area and with approximately 3.879 billion people, it hosts 60% of the world's current human population...
/Pacific).
Codenomicon is also known for having t-shirts that say "GO HACK YOURSELF", which they usually have at their booth during security conferences. This comes from the goal of Codenomicon to enable testers and system administrators to find their own zero-day vulnerabilities, instead of depending on external security consultants, and special hacker skills.
Products
The product line of Codenomicon consists of a suite of 200+ independent network protocol testing solutions called DEFENSICS. Each protocol fuzzer can be licensed separately, or as a suite of protocols related to a specific technology such as IPTV, VoIP, Routing, Bluetooth, and several other communication domains.These tools have roots in the research done at the University of Oulu
University of Oulu
The University of Oulu is one of the largest universities in Finland, located in the city of Oulu. It was founded on July 8, 1958. The university has around 16,000 students and 3,000 staff...
in the Secure Programming Group (OUSPG). Whereas since 1999 the PROTOS project produced free software for testing about 10 protocols, Codenomicon has added support for much wider test coverage for about 200+ protocols, and is providing those tools under commercial licensing. PROTOS tools are still widely used. PROTOS and Codenomicon testing approach, called robustness testing
Robustness testing
Robustness testing is any quality assurance methodology focused on testing the robustness of software. Robustness testing has also been used to describe the process of verifying the robustness Robustness testing is any quality assurance methodology focused on testing the robustness of software....
, is based around the idea of proactive protocol testing by injecting unexpected anomalies into the protocol message sequences, structures and data types; in essence, fuzzing with some intelligence behind the generated test data.
DEFENSICS includes test suites for 200+ protocols industry standard networks protocols such as SMTP, SNMP
Simple Network Management Protocol
Simple Network Management Protocol is an "Internet-standard protocol for managing devices on IP networks. Devices that typically support SNMP include routers, switches, servers, workstations, printers, modem racks, and more." It is used mostly in network management systems to monitor...
, BGP, IPv6
IPv6
Internet Protocol version 6 is a version of the Internet Protocol . It is designed to succeed the Internet Protocol version 4...
, SSH
Secure Shell
Secure Shell is a network protocol for secure data communication, remote shell services or command execution and other secure network services between two networked computers that it connects via a secure channel over an insecure network: a server and a client...
and SIP
Session Initiation Protocol
The Session Initiation Protocol is an IETF-defined signaling protocol widely used for controlling communication sessions such as voice and video calls over Internet Protocol . The protocol can be used for creating, modifying and terminating two-party or multiparty sessions...
. In addition there are also test suites for various Bluetooth
Bluetooth
Bluetooth is a proprietary open wireless technology standard for exchanging data over short distances from fixed and mobile devices, creating personal area networks with high levels of security...
profiles and Wireless LAN
Wireless LAN
A wireless local area network links two or more devices using some wireless distribution method , and usually providing a connection through an access point to the wider internet. This gives users the mobility to move around within a local coverage area and still be connected to the network...
. Codenomicon has also built nearly 100 customer proprietary fuzzers for special interfaces such as device API's and complex banking systems.
Robustness testing
Robustness testing is a model based fuzzing technique and over all Black box testingBlack box testing
Black-box testing is a method of software testing that tests the functionality of an application as opposed to its internal structures or workings . Specific knowledge of the application's code/internal structure and programming knowledge in general is not required...
, an extension of syntax testing, that systematically will explore the input space defined by various communication interfaces or data formats, and will generate intelligent test cases that find crash-level flaws and other failures in software. The technique was first described in a University of Oulu white paper on robustness testing published in 2000, by Kaksonen et al., and Licentiate Thesis by Kaksonen, published in 2001. Fault injection and specification mutations were other names they used for the same approach.
Codenomicon's Defensics Product line is also known as a "Fuzzer that does not fuzz" - means - it uses smart anomalies instead of random Fuzzing structures. This enables fast test execution, extensive test documentation and better test coverage. Defensics tools address all fields in the protocols with all effective combinations of anomalies. Traditional fuzzing lacks this capability as with random inputs that would take too much time to be effective in fast paced test cycles.
History
Codenomicon and its founders have been developing fuzzing tools since 1996.The first ideas for the engine were based on ideas the founders had while working at OUSPG, where systematic fuzzing was first used to break ASCII/MIME contents in email clients and web services. Later, the same technique was applied to ASN.1 structures in such protocols as SNMP, LDAP and X.509.
After Codenomicon was founded in 2001, its DEFENSICS product line has grown to cover over 200 industry-standard network protocols and file formats, including wireless interfaces such as Bluetooth and WLAN. DEFENSICS for XML provides an added capability for testing common XML-based protocols and file formats more efficiently than before.
After founding Codenomicon, also PROTOS Test-Suites disclose they are running on top of Codenomicon engine. The research side span out into PROTOS Genome.
External links
- AlwaysOn as an 100 Top Private Company Award Winner
- eSecurity DEFEND THEN DEPLOY.
- Codenomicon Introduces DEFENSICS for WLAN
- Codenomicon Offers Preemptive Security and Quality Testing
- CODENOMICON DEFENDS AGAINST NETWORK DATA STORAGE THREATS
- Jolt Productivity Award 2008
- Dr. Dobbs interview with Ari Takanen: Fuzzing, Model-based Testing, and Security http://www.drdobbs.com/security/207000941
- Dr. Dobbs article on Automated Penetration Testing Toolkit Released (based on Codenomcion press release) http://www.drdobbs.com/security/224600546
Security advisory links
- Codenomicon Advisories
- CERT-FI Advisory on XML libraries
- CERT-FI Vulnerability Advisory on GnuTLS
- CVE-2004-0786
- CVE-2004-0081