CYBER INDEPENDENT TESTING LABORATORY INC

In 2020 CITL completed the final stages of development on the CITL Automated Dynamic Vulnerability Discovery (CITL-ADVD) tool. CITL_ADVDprovides automated discovery of novel vulnerabilities and defects across thousands of applications and libraries per month, improving the state of the art for automated vulnerability discovery by orders of magnitude. For comparison, a skilled team using traditional fuzzing tools would likely be able to test 10-50 targets a month. Target instrumentation, harnessing, and input generation are fully automated. CITL-ADVD is designed to identify memory corruption, command injection, and other classes of vulnerabilities and defects. CITLs approach changes vulnerability hunting from bespoke targeting and identification, to sifting through 1000s of novel CITL-identified vulns for matching critera. This capability would enable teams to find and fix vulnerabilities in open source Linux software en masse. For example, over the summer, CITL fuzzed all of the Ubuntu-APT repository and reported hundreds of bugs to the relevant open source project maintainers. Open source software is used in most critical infrastructure and corporate entities, often in critical systems, so such an effort would have huge impact for public good. The data sets produced by CITL-ADVD also have great potential for use in academia and research, because it is the first time that detailed data on program behavior can be obtained in such quantities. With these potential uses in mind, CITL started working in 2020 on transitioning its toolsets to partner organizations and on open sourcing the tools, so that anyone who is interested can benefit from these massive improvements to the state of the art.