Updates on mir-swamp.org

Posted on by Leave a comment

The following updates are now available in the SWAMP at mir-swamp.org! New

  • The SWAMP now supports the upload and assessment of .NET packages that can be built using msbuild on Linux. SWAMP automatically reviews Solution and .NET project files and determines which can be built using a framework that does not require Windows. Users can then select which of those .NET projects to assess.
  • We added three tools for the assessment of .NET packages on a Linux platform: Code Cracker v1.1.0, devskim 0.1.10, and Security Code Scan 2.7.1.
  • GitHub Webhooks can now be configured to update SWAMP packages. When the GitHub Webhook is triggered, a new package version will be added to an existing SWAMP package. Package parameters are copied from the previous package version and used with a new archive of package code cloned from GitHub. Users can edit package information to get the Payload URL and set the Secret Token needed to configure a GitHub Webhook to the SWAMP.
  • A new schedule is now available for use in all projects. This schedule, “On Push,” runs assessments whenever a new push to a GitHub repository triggers a GitHub Webhook to generate a new Package Version in the SWAMP. This schedule works with an assessment for the “latest” version of a package that is configured to update based on a GitHub Webhook trigger.
  • SWAMP packages can now be generated via an External URL that points to a downloadable archive.
  • When a new SWAMP user account is created, a default project called “MyProject” is created automatically. “MyProject” is now viewable in the SWAMP user interface. Users are not able to edit or invite additional members to their “MyProject” projects. All packages users upload to the SWAMP are automatically shared with their “MyProject” project.
  • For users who are owners or members of multiple projects, the associated project is now displayed for records on the Package, Assessments, Assessment Results, and Scheduled Assessment Runs pages. Additionally, users can specifically set the project to use when adding new assessments.
  • The Build Script for a package version is now displayed on a separate pop-up, accessed by clicking the Show Build Script button. This applies to the Build page for adding new packages, adding a new package version to existing packages, and viewing and editing an existing package version.
  • When adding a package or package version for C/C++ or Java Source Code without a build system, users can now specify a “build path” (relative to the package path) that specifies the (non-recursive) directory containing the compilable files to assess. SWAMP now does a better job of informing users about the files that are selected to compile and assess.
  • SWAMP now does a better job of informing users about the files that are selected to assess for Ruby, Python, and Web Scripting packages with a build system of “none.”
  • The SWAMP Native Results Viewer now correctly displays the primary bug location instead of the first bug located for weaknesses reported by tools that include multiple bug locations.
  • The SWAMP discontinued support for the Ubuntu 10.04 assessment platform.
  • SWAMP-in-a-Box v1.34 is available.
  • General enhancements and bug fixes.

Let us know if you have any questions at support@continuousassurance.org.

GrammaTech Adds Real World Benchmarks to SWAMP

Posted on by Leave a comment

FOR IMMEDIATE RELEASE:
January 31, 2019

GrammaTech Adds Real World Benchmarks to SWAMP

MADISON, WI – (January 31, 2019) – Software development and quality managers that are looking to measure the benefit of static analysis now have a platform to do just that. GrammaTech, under contract for the Department of Homeland Security (DHS) Science and Technology Directorate (S&T), has created independent real-world benchmarks that are now available in the Software Assurance Marketplace (SWAMP).

Several different synthetic benchmarks exist that can be used to measure how well static analysis tools perform in detecting bugs. However, many of these have limitations with the code paths typically being too simple. GrammaTech, under contract for DHS S&T, has created BugInjector, a tool that can inject Common Weakness Enumeration (CWE) based bug patterns into existing code bases, thus delivering real-world benchmarks. The BugInjector tool is available directly from GrammaTech to inject bugs into private code bases for training purposes. Additionally, four different real-world code bases (nginx, grep, sqlite, lighttpd) have been injected with bugs and are available through the Software Assurance Marketplace, enabling users to easily benchmark how well their static analysis tools are able to find these bugs in realistic code paths.

“There is an urgent need for benchmarks, such as those from GrammaTech, to allow software developers to evaluate static analysis tools in a comprehensive and real-world setting,” says Barton Miller, Professor of Computer Sciences at the University of Wisconsin – Madison and Chief Scientist of SWAMP. “Also, developers of static analysis tools now have the ability to enhance their tools or benchmark new static analysis technologies with realistic test cases. Integrating these benchmarks into the SWAMP platform increases their effectiveness and availability.”

“GrammaTech CodeSonar® has always focused on highest recall,” says Paul Anderson, VP of Engineering at GrammaTech, Inc. “Many tools claim that they can catch a particular CWE, but there has never been a way to measure how well tools perform if this CWE is hidden deep inside a code path. BugInjector provides an automated way to objectively measure static analysis tool recall; interested parties can now evaluate CodeSonar®’s market leading recall against other tools easily.”

The Software Assurance Marketplace’s static analysis capabilities are available for use in the cloud or on-premise at no cost. Interested parties can sign up to use the SWAMP at mir-swamp.org and find the BugInjector test cases on the Resources page under Packages. After selecting a package and version containing a CWE of interest, users can run an assessment of the chosen “bug injected” software using one or more software assurance tools. GrammaTech CodeSonar® is one of the commercial tools that is integrated into the SWAMP, along with many other open source static analysis tools. Users can also download BugInjector test cases to run against tools they are developing.

ABOUT GRAMMATECH

GrammaTech’s advanced static analysis tools are used by software developers worldwide, spanning a myriad of embedded software industries including avionics, government, medical, military, industrial control, and other applications where reliability and security are paramount. Originally developed within Cornell University, GrammaTech is now a leading research center for software security and a commercial vendor of software-assurance tools and advanced cyber-security solutions. With both static and dynamic analysis tools that analyze source code as well as binary executables, GrammaTech continues to advance the science of superior software analysis, providing technology for developers to produce safer software. For more information, visit www.grammatech.com or follow us on LinkedIn.

ABOUT THE SWAMP

The Software Assurance Marketplace is a joint effort of four research institutions – The Morgridge Institute for Research, Indiana University, the University of Illinois at Urbana-Champaign, and the University of Wisconsin-Madison – to advance the capabilities and to increase the adoption of software assurance technologies through open continuous assurance capabilities and a shared facility. The SWAMP project is funded by the Department of Homeland Security Science & Technology Directorate. Services include access to high throughput computing capacity, over 30 software assurance tools, and a library of more than 500 open-source code samples with known vulnerabilities to help developers improve the quality of their static and dynamic testing tools. For more information, visit https://continuousassurance.org.

###

https://www.prnewswire.com/news-releases/grammatech-adds-real-world-benchmarks-to-swamp-300787603.html
http://news.grammatech.com/grammatech-adds-real-world-benchmarks-to-swamp

SWAMP-in-a-Box v1.33.4 Compatibility Issue

Posted on by Leave a comment

SWAMP-in-a-Box version 1.33.4 and previous versions are not compatible with the latest version of guestfish (libguestfs 1.38.2), which is included in CentOS 7.6.

Specifically, assessments will not run and results cannot be viewed in Code Dx. When running an assessment, the status “htcondor submit aborted – uuid queued” or “failed to launch” is displayed on the Assessment Results page. When attempting to view results in Code Dx, “Unable to Start VM” is displayed on the Preparing Results page.

Performing a ‘yum update’ on an existing SWAMP-in-a-Box installation on CentOS 7 will install guestfish 1.38.2. Likewise, running the ‘install-all.bash’ script to install required dependencies for a new SWAMP-in-a-Box installation on CentOS 7 will install guestfish 1.38.2.

 

To determine which version of guestfish is installed, run the following command:
# guestfish –version

 

To downgrade to a version of guestfish that is compatible with SWAMP-in-a-Box version 1.34.4, do the following:

1. Download these files and move them to your SWAMP-in-a-Box:

http://vault.centos.org/7.5.1804/updates/x86_64/Packages/libguestfs-1.36.10-6.el7_5.2.x86_64.rpm
http://vault.centos.org/7.5.1804/updates/x86_64/Packages/libguestfs-tools-1.36.10-6.el7_5.2.noarch.rpm
http://vault.centos.org/7.5.1804/updates/x86_64/Packages/libguestfs-tools-c-1.36.10-6.el7_5.2.x86_64.rpm
http://vault.centos.org/7.5.1804/updates/x86_64/Packages/perl-Sys-Guestfs-1.36.10-6.el7_5.2.x86_64.rpm

2. ‘cd’ to the directory containing the files downloaded above

3. Downgrade the guestfish packages to 1.36.10 (may require ‘sudo’)
# yum downgrade ./libguestfs* ./perl-Sys-Guestfs*

4. Update permission on the platforms directory (may require ‘sudo’)
# chmod 755 /swamp/platforms/images

 

This issue does not affect a SWAMP-in-a-Box install on CentOS 6. The version of guestfish available for CentOS 6.10 is currently version 1.20.11.

Let us know if you have any questions at support@continuousassurance.org.

SWAMP Instructional Videos

Posted on by Leave a comment

SWAMP Chief Scientist and PI, Bart Miller, along with his colleague, Elisa Heymann, from the University of Wisconsin-Madison’s Computer Sciences department created an educational guide to using the SWAMP: https://vimeo.com/255608773. Be sure to check out their video and links to all of the other SWAMP recordings, webinars, etc. on our website: https://continuousassurance.org/about-us/video-tutorials/.

Software Assurance Conference 2018

Posted on by Leave a comment

The SWAMP will be presenting and demonstrating at Software Assurance Conference 2018! SwACon is a software assurance (SwA) conference dedicated to advancing the state of the art in software assurance disciplines. The theme of this year’s event is open source tools and techniques that are available for SwA activities. The event is hosted by the Software Engineering Institute (SEI) in collaboration with the DoD Joint Federated Assurance Center (JFAC).

SwACon 2018 will be held on Tuesday, November 27 at the NRECA Conference Center (4301 Wilson Blvd. Arlington, VA – 1st floor). There will be presentations all day, roughly from 9am to 5pm Eastern, and you may attend only selected presentations, if needed. The event is free of charge but does require advance registration. Remote participation will also be available. To register, email swamp@continuousassurance.org for details before November 18.

 

Agenda:

SwACon 2018
November 27th, 2018
NRECA Conference Center (1st floor)
Arlington, VA

8:45AM to 9:30AM    Check-in and Registration; Light breakfast items to be served

9:30AM to 10:45AM   Getting Started with ROSE Compiler Infrastructure – Dan Quinlan

ROSE is an open source compiler infrastructure to build source-to-source program transformation and analysis tools for large-scale C (C89 and C98), C++ (C++98 and C++11), UPC, Fortran (77/95/2003), OpenMP, Java, Python, and PHP applications. ROSE is developed at Lawrence Livermore National Laboratory (LLNL). Presented by Dr. Dan Quinlan, LLNL.

10:45AM to 11:00AM  Morning beverage break

11:00AM to 12:00PM  Introduction to Binary Analysis with Pharos – Cory Cohen

The SEI’s Pharos project is an open-source static binary analysis framework that is primarily targeted at malware analysis but can also be used for software assurance tasks. Presented by Cory Cohen, SEI.

12:00PM to 1:00PM   Lunch break – participants on their own for lunch

1:00PM to 2:30PM    Introduction to Software Assurance Marketplace (SWAMP) - Von Welch & Brian Aydemir

Join us to learn about the Software Assurance Marketplace (SWAMP) – a Continuous Software Assurance Platform. During this presentation, we will introduce the SWAMP project and team, describe SWAMP’s capabilities, present a live demo, and explain how you can start using the SWAMP. Presented by Von Welch, Director of Indiana University – Center for Applied Cybersecurity Research (CACR) & Brian Aydemir, Systems Integration Developer, Morgridge Institute for Research/SWAMP.

2:30PM to 2:45PM    Afternoon break; Light snacks to be served

2:45PM to 3:45PM    Securing Software with Trail of Bits – Peter Goodman & Trent Brunson

3:45PM to 3:55PM    Short transition break

3:55PM to 4:55PM    Introduction to Source Code Analysis Laboratory (SCALe)  - Lori Flynn

SWAMP-in-a-Box Update v1.33.4

Posted on by Leave a comment

SWAMP-in-a-Box version 1.33.4 is now available from GitHub or the SWAMP-in-a-Box download server.

Noteworthy changes include:New

  • An updated version of the Ubuntu Linux version 16.04 platform is now available and will be automatically installed with SWAMP-in-a-Box 1.33.4.
  • SWAMP-in-a-Box now automatically re-tries (up to three additional times) assessments that finish with an error related to networking. This includes assessments for which a VM does not have network connectivity or for which OS dependencies cannot be installed. In many cases, these assessments succeed on the first retry.
  • SWAMP-in-a-Box administrators can now configure which viewer is initially selected on the Assessment Results page. When SWAMP-in-a-Box 1.33.4 is installed, this configuration is set to use the Native Viewer. Note that this is only applicable if a third-party viewer has been added to SWAMP-in-a-Box.
  • Parasoft C/C++test versions 10.3.4 and 10.4.0 can now be added to a SWAMP-in-a-Box installation. You must license Parasoft C/C++test and obtain either the 32-bit or 64-bit tool archive files separately from Parasoft.
  • Parasoft Jtest versions 10.3.4 and 10.4.0 can now be added to a SWAMP-in-a-Box installation. You must license Parasoft Jtest and obtain the 64-bit tool archive files separately from Parasoft. 
  • General enhancements and bug fixes.

Let us know if you have any questions at support@continuousassurance.org.

« Older Entries Recent Entries »