Docsity
Log inSign up
Docsity
Prepare for your exams
Prepare for your exams

Study with the several resources on Docsity

Earn points to download
Earn points to download

Earn points by helping other students or get them with a premium plan

Guidelines and tips
Guidelines and tips
Sell on Docsity
Sell on Docsity
Log inSign up

Prepare for your exams

Study with the several resources on Docsity

Find documents

Prepare for your exams with the study notes shared by other students like you on Docsity

Search Store documents

The best documents sold by students who completed their studies

Search through all study resources
Docsity AINEW

Summarize your documents, ask them questions, convert them into quizzes and concept maps

Explore questions

Clear up your doubts by reading the answers to questions asked by your fellow students

Earn points to download

Earn points by helping other students or get them with a premium plan

Share documents
download point icon20 Points

For each uploaded document

Answer questions
download point icon5 Points

For each given answer (max 1 per day)

All the ways to get free points
Get points immediately

Choose a premium plan with all the points you need

Study Opportunities

Choose your next study program

Get in touch with the best universities in the world. Search through thousands of universities and official partners

Community

Ask the community

Ask the community for help and clear up your study doubts

University Rankings

Discover the best universities in your country according to Docsity users

Free resources

Our save-the-student-ebooks!

Download our free guides on studying techniques, anxiety management strategies, and thesis advice from Docsity tutors

From our blog

Exams and Study
Go to the blog

Software Testing: UI Attacks and System Interface Attacks, Study notes of Computer Science

University of Alaska AnchorageComputer Science

An in-depth analysis of various ui attacks and system interface attacks for software testing. The author discusses different types of attacks, such as error message testing, default value testing, character set testing, input buffer overflow, and integration testing. The document also covers system interface attacks through the file system and operating system, including filling the file system to capacity, forcing media to be busy, damaging the media, assigning invalid file names, varying file access permissions, and corrupting file contents.

Typology: Study notes

2009/2010

Uploaded on 03/28/2010

koofers-user-t6y
koofers-user-t6y 🇺🇸

10 documents

1 / 17

Toggle sidebar

This page cannot be seen from the preview

Don't miss anything!

bg1
1
How to Break Software
by James Whittaker
CS 470
Practical Guide to Testing
• Consider the system as a whole and their
interactions
Application Under Test
File System, Operating System
API UI
Human invokes app App requests memory from OS
App interfaces with database, API, libraries
App opens, reads, and closes files
Opening powerpoint : 59 calls to 29 Windows functions upon invocation
pf3
pf4
pf5
pf8
pf9
pfa
pfd
pfe
pff

Partial preview of the text

Download Software Testing: UI Attacks and System Interface Attacks and more Study notes Computer Science in PDF only on Docsity!

How to Break Software

by James Whittaker

CS 470

Practical Guide to Testing

• Consider the system as a whole and their

interactions

Application Under Test

File System, Operating System

API UI

Human invokes app  App requests memory from OS  App interfaces with database, API, libraries  App opens, reads, and closes files

Opening powerpoint : 59 calls to 29 Windows functions upon invocation

Testing

  • Let’s examine attacks from these perspectives
  • User Interface
    • Black Box : Inputs and Outputs
    • Open Box : Explore stored data, computation and feature interaction
  • System Interface
    • File System
    • Operating System

Black Box User Interface Attack

  • Apply inputs that force error messages to occur
    • Basic test to ensure that software responds appropriately to bad input
    • Ensures developers wrote code to handle erroneous input, something that is often not in their mindset
    • How to carry out: explore input types, length, boundary values
    • Example: Word 2000. I)nsert, “Index and Tables”, change “Columns” to five, press enter. Get two error messages.

UI Attack

• Explore allowable character sets and data

types

  • Example, in an input string, try NULL

character or other characters that might be used

as delimiters

  • Unix uses ^D as text end-of-file, program might

terminate or behave unpredictably

  • In some bugs, shell command strings can be

sent

UI Attack

  • Overflow input buffers
    • Exceeding array or structure size will cause a crash
    • How: input long strings or other data beyond “normal” size
    • Example : Word 2000, find/replace. Replace a short string with one that is 255 characters long. Winword crash.
  • Such bugs are more serious in a server or other

component that could be exploited to run arbitrary

code

UI Attack

  • Find inputs that interact and test combinations of

their values

  • Check to see if integration testing has been adequately performed
  • How to carry out: identify candidate processes that are normally separate, but through some interaction may share a common data structure
  • Example: Word 2000, insert table. Max columns = 63 but Max rows = 32767. App hangs if enter 32000+ rows and 50+ for columns.

UI Attack

• Repeat the same input or series of inputs

numerous times

  • Applicable when input received within a loop.

May consume resources or cause data

initialization problems.

  • Example : memory leak, chunk of allocated

memory not released

Attack

  • Force properties of an output to change
    • Gives testers a way to think about persistent outputs; outputs that hang around on the screen or file can be updated in ways to break the software
    • How to conduct: Set properties to one value, then try changing to something else
    • Example: WordArt in Windows 2000. Enter long word art – too big to fit on the screen. This sets the width/height properties. Then edit to a single letter. The width/height properties stay the same.

UI Attack

• Force the screen to refresh

  • There are often errors with refresh events where

not everything is repainted correctly

  • How to conduct: resize, minimize, drag objects

about so they are overlapping

  • Example: Equation Editor in Word 2000 has

refresh problems as formulas are added

Open Box - UI Attack

• Apply inputs using a variety of initial

conditions

  • Search for a configuration where internal data

is incompatible with the inputs and input

sequences

• As with all open box attacks, requires

access to the source to design the attack

UI Attack

  • Force a data structure to store too many or too few

values

  • The overflow/boundary check problem for arrays or data structures
  • Even dynamic structures like lists or stacks have upper bounds
  • How to conduct : Read/write beyond size of allocated array or data structures
  • Example : Table in Word with 32767 rows and 50 columns

UI Attack

  • Force a function to call itself recursively
    • Checks if developer correctly handles the termination case and whether or not an object can interact with itself - Can manifest itself as an infinite loop
    • How to conduct: Find recursive calls and test if there are ways to invoke them
    • Example: Insert a footnote within a footnote in Word 2000; get weird behavior, should be disabled

UI Attack

  • Find features that share data or interact poorly
    • These are candidates for errors with integration, especially when we are mixing data types or creating new data structures
    • How to conduct: Look at shared features and ask if the same inputs can be applied to each feature in question
    • Example: Word 2000, resize embedded text box, picture, word art, or drawing objects that have been grouped together

System Interface Attacks

  • First let’s look at attacks through the file system
  • Inputs from the file system similar to inputs from

the user

  • But often even worse since many apps expect user input to be weird, but files often expected to be consistent with some specified format
  • Media Based Attacks: Simulate problems with the storage media, e.g. failure in the disk
  • File Based Attacks: Problems with properties of a particular file

System Attack

• Fill the file system to its capacity

  • Has the developer tested for this potential

problem?

  • A crash would be undesirable when the user

has the chance to free up some space to allow

execution to continue

  • How to conduct: Fill file system, try file

operations

System Attack

• Assign an invalid file name

  • File names often restricted by the file system,

or can exploit common standards used by the

file system (long names, weird characters, etc.)

  • Example: Saving a Word file as

startrek;starwars-8.1.2001 is saved, but the

“.doc” extension is not generated and a user

could not double-click to open it

System Attack

• Vary file access permissions

  • Can uncover subtle bugs if apps might require

most general permissions

  • Example: Web server app may not function

properly unless “all” permission set to readable,

but then this might compromise security

System Attack

  • Vary or corrupt file contents
    • Simulates data being modified intentionally (perhaps maliciously) or incidentally (e.g., during transmission). Many apps may not check for an error code.
    • Ex: With Excel, a carefully placed bad block causes the file to open, but then Excel crashes with a memory pointer error (Instruction referenced memory at address 08). Should notify user the file is bad.

Operating System Attacks

• Next, let’s look at various attacks through

the operating system (excluding the file

system)

Generating System Faults

  • Some of these system faults are difficult to

generate, e.g.

  • Out of memory
  • Locked memory
  • Out of disk space
  • CRC errors
  • Tools exist to simulate the system software
  • Tester can inject faults of choosing
  • Ex. Canned HEAT or Holodeck from Florida Institute of Technology
  • Virtual machine, e.g. VM Ware of Virtual Server

Canned Heat 3

Conclusions

  • Being a tester is like studying for a Ph.D.; the more you learn, the more you realize there is much more to know
  • Testing is not something one can master, always something new to learn - But we can learn what kind of tests to perform and what kind of bugs are common
  • Testing often not as glamorous as developing, but requires lots of creativity and often as much expertise as the developer to do well - Can be challenging and also fun to find bugs!