A new product from Beyond Security automatically tests billions of attack combinations in network-enabled software applications to uncover unknown vulnerabilities during the development cycle, before applications are complete.

The product, called beSTORM, “can thoroughly go through virtually every valid combination of a network protocol such as HTTP, SMTP, SIP, etc.,” explains Aviram Jenik, Beyond Security’s CEO. “Since the entire protocol space is covered, beSTORM will find vulnerabilities that are still unknown.”

The product can run simultaneously on multiple machines and goes through two stages. First, in a matter of hours, it finds the most easily detectable flaws. Second, it expands the search space to find “the ‘weird’ bugs – the very unlikely test cases that barely resemble a valid request, but this is where the more clever attacks tend to hide,” Jenik notes. This second part of the scan can take days or even weeks.

beSTORM looks for various anomalies, including such things as access to restricted memory, throwing a memory-related exception, etc. It also checks the application’s responses to find misbehaviors and weaknesses.

The product tends to find buffer overflow, format string and off-by-one vulnerabilities. “Those account for over 95 percent of the security holes found, including the flaws that led to the notorious Blaster, Slammer and Code Red worms,” Jenik points out. “The fact that beSTORM searches for vulnerabilities by behavior rather than signatures means that unknown security holes will be found,” he adds.

Although the product does not fix vulnerabilities, much of the problem in fixing them is finding them. beSTORM takes the guesswork out of that by pinpointing the problems it detects. It features a client/server-type architecture in which the client, a testing component, performs the attacks. The server is a monitoring component. When a flaw is detected, the monitoring component informs the testing component.

“Knowing the exact sequence that triggered the vulnerability enables full reproduction of the problem and generates a complete bug report that is fed into the development process,” Jenik says. The development team can refer to the report to fix the problem. Similarly, the testers can use the report to ensure that the problem is fixed.

The product not only detects flaws and weaknesses in products being developed, but can also be used to test third-party products. In this way, organizations “can be sure what they are using is secure, and if it is not, to find the weaknesses and fix them quickly,” Jenik notes.

Pricing starts at $15,000 for a single testing module.

For more information, go to: www.beyondsecurity.com