Google Released an Open Source Pentesting Tool Called Project Wycheproof

Google this week announced the availability of Project Wycheproof, an open source tool designed for finding known vulnerabilities in popular cryptographic software libraries.

Developed in Java due to its common cryptographic interface, Project Wycheproof includes tests for the most popular crypto algorithms, including AES-EAX, AES-GCM, DH, DHIES, DSA, ECDH, ECDSA, ECIES and RSA. The more than 80 test cases developed by Google experts have led to the discovery of over 40 bugs in RSA, DSA, ECDH and DH.

Google has pointed out that Project Wycheproof is not complete as crypto experts regularly discover new weaknesses in protocols. However, the search giant believes the tool can be useful for developers and users considering that the secure implementation of cryptographic algorithms is not an easy task.

“The main motivation for the project is to have an achievable goal. That’s why we’ve named it after the Mount Wycheproof, the smallest mountain in the world. The smaller the mountain the easier it is to climb it!” Daniel Bleichenbacher and Thai Duong, Google security engineers and Project Wycheproof maintainers, said in a blog post.

While the tool is developed and maintained by members of the Google Security Team, Project Wycheproof is not an official Google product. Contributions are welcome, but those who want to take part in the project have been advised to report the vulnerabilities they find directly to the maintainers of the affected libraries and submit the tests only after the bug has been fixed or acknowledged.

Some of the flaws discovered by Google have yet to be made public as they are still being patched by vendors.

Google also pointed out that some open-source products are covered by its bug bounty program and vulnerabilities found with Project Wycheproof tests could qualify for a reward.

Project Wycheproof is not the only security tool released this year by Google. The company also made available the OSS-Fuzz open source fuzzing service, a Vendor Security Assessment Questionnaire framework, the binary comparison tool BinDiff, and the XSS prevention tools CSP Evaluator and CSP Mitigator.

Original Post: https://latesthackingnews.com/2016/12/21/google-released-open-source-pentesting-tool/

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Up ↑

%d bloggers like this: