Blog Post Archives – rescale-project.eu

RESCALE 3rd Plenary Meeting

The 3rd RESCALE plenary meeting was successfully held in Amsterdam, Netherlands, on December 6-7, 2024, hosted by Stichting VU (VUA). Over two days of engaging discussions, interactive workshops and valuable feedback, the consortium made significant strides in finalizing the first release of the RESCALE platform. Partners collaborated on the latest advancements in cybersecurity, supply chain security and tool integration, ensuring RESCALE continues to drive innovation in the field. A huge thank you to all partners for their contributions and to VUA for hosting us! Stay tuned for more updates as we move forward.

Follow us on Social Media

Blog Post

RESCALE 1st Technical Meeting

The 1st RESCALE technical meeting took place at the University of Piraeus, Athens, Greece, on December 10-11, 2024. Hosted by University of Piraeus Research Center (UPRC), the meeting focused on DSCG and SSCG generation and tool integration, bringing together technical experts to enhance supply chain security.

Stay tuned for more updates as RESCALE continues its mission to revolutionize supply chain cybersecurity!

Follow us on Social Media

Blog Post

Unveiling Security Flaws in Low-Level Components: The Tools Behind…

Securing low-level system components such as firmware, kernel modules, and system drivers is essential for modern cybersecurity. Unlike higher-level application security testing, low-level security assessments focus on identifying vulnerabilities that reside within memory management, hardware interactions, and kernel-space execution flows. Attackers increasingly exploit speculative execution flaws, kernel privilege escalation bugs, and Return-Oriented Programming (ROP) gadgets to gain control over systems at the lowest level.

To address these risks, RESCALE’s Low-Level Security Testing Module integrates a set of specialized tools that systematically analyze firmware, detect execution flaws, and assess security vulnerabilities in embedded and kernel-level components. These tools provide automated and scalable methods for identifying low-level security weaknesses, ensuring that supply chain components undergo rigorous security validation before deployment.

Detecting Exploitable Gadgets with InSpectre Gadget

One of the most critical attack vectors in modern systems is Return-Oriented Programming (ROP) exploitation, where attackers chain exploitable instruction sequences (gadgets) to execute arbitrary code without injecting new code into memory. InSpectre Gadget is a low-level security analysis tool that systematically scans kernel binaries to identify and classify potentially exploitable ROP gadgets.

The tool processes kernel targets, analyzing compiled binaries to extract instruction sequences that could be repurposed by an attacker. Once extracted, these exploitable gadgets undergo automated filtering, removing sequences that are unlikely to be useful for an exploit. The remaining filtered gadgets are then reviewed by security analysts, who assess whether they can be leveraged to bypass control defenses and craft working exploits.

The provided diagram illustrates the workflow of InSpectre Gadget. It begins by analyzing kernel binaries to extract potentially exploitable instruction sequences. The filtering stage refines these sequences, ensuring that only relevant gadgets are retained. A security analyst then evaluates the control defenses in place, selecting a final set of gadgets that can be used to develop proof-of-concept exploits. This structured process ensures that kernel vulnerabilities are identified efficiently, allowing organizations to mitigate ROP-based attack risks before they can be exploited.

Mitigating Side-Channel Attacks with SafeFetch

Modern processors are vulnerable to side-channel attacks, where attackers extract sensitive information by exploiting microarchitectural behaviors such as speculative execution, cache timing, and branch prediction. SafeFetch is a specialized security testing tool designed to detect and mitigate speculative execution vulnerabilities in syscall operations.

The tool evaluates syscall handling mechanisms, identifying cases where untrusted input can manipulate processor behavior to leak privileged information. SafeFetch achieves this by analyzing syscall execution flows, detecting unsafe speculative accesses, and ensuring that all execution paths conform to strict security policies.

The provided SafeFetch architecture diagram illustrates how the tool monitors syscall execution. When a syscall is invoked, SafeFetch first applies a transfer function that defines a sanitized search range, ensuring that speculative execution does not access unauthorized memory regions. The cache frontend checks if the syscall results can be retrieved securely from a cached entry. If a cache miss occurs, the backend allocator provisions a new entry, ensuring that speculative execution does not introduce side-channel vulnerabilities.

SafeFetch plays a crucial role in mitigating speculative execution flaws, preventing attackers from leveraging side-channel leaks to extract sensitive system data. Its integration into the Low-Level Security Testing Module ensures that firmware and kernel components are systematically tested for microarchitectural security risks, reducing the likelihood of exploits such as Spectre, Meltdown, and other transient execution attacks.

Enhancing Security Testing with FATex

FATex is another core component of the Low-Level Security Testing Module, focusing on firmware and kernel-level fault injection testing. Unlike conventional fuzzing tools, which primarily test application-layer inputs, FATex is designed to simulate fault conditions at the hardware and firmware execution levels.

By running fault injection campaigns, FATex assesses how firmware and kernel components behave under abnormal conditions, such as corrupt memory states, unexpected interrupts, and hardware failures. These tests reveal critical stability and security weaknesses, allowing developers to fortify system resilience against real-world attack scenarios.

The tool integrates with emulation frameworks such as QEMU, enabling large-scale automated firmware testing without requiring direct hardware access. By ensuring that low-level components are tested for execution robustness, FATex strengthens supply chain security validation, making it a key asset in the RESCALE security pipeline.

Generating the DSCG for Low-Level Security Assessments

As with other security testing modules in RESCALE, the results from InSpectre Gadget, SafeFetch, and FATex are aggregated into the Dynamic Supply Chain Component Guarantee (DSCG). This structured document consolidates security findings from low-level component analysis, ensuring that all vulnerabilities are properly categorized, validated, and integrated into supply chain security workflows.

The DSCG generation process aggregates findings from multiple analyzers, verifying that all tested firmware and kernel components adhere to strict security policies. The results are then processed by the CDX Validator, ensuring that vulnerabilities are reported in a standardized format. Once validated, the DSCG is fed into the RESCALE Management Module, where it becomes part of the broader security assurance framework.

By incorporating low-level security testing results into structured security assessments, the DSCG ensures that all firmware and kernel security guarantees are properly documented, helping organizations maintain high-security standards throughout the supply chain.

Conclusion

The Low-Level Security Testing Module in RESCALE is powered by a specialized set of security tools designed to analyze firmware, kernel components, and hardware interactions. InSpectre Gadget detects exploitable ROP gadgets, helping security teams identify kernel-level attack vectors before they are weaponized. SafeFetch mitigates speculative execution vulnerabilities, preventing side-channel data leaks in system calls. FATex enables firmware and kernel fault injection testing, strengthening system resilience against memory corruption and unexpected execution failures.

Together, these tools provide a comprehensive assessment of low-level security risks, ensuring that firmware, kernel modules, and embedded software undergo rigorous testing before deployment. By integrating their findings into the DSCG, the Low-Level Security Testing Module ensures that all vulnerabilities are properly validated and integrated into the broader supply chain security framework.

As cyber threats increasingly target low-level system components, automated security testing remains essential for protecting modern computing environments. The RESCALE framework ensures that all tested components receive structured security guarantees, providing a robust foundation for supply chain security.

Follow us on Social Media

Blog Post

Strengthening Supply Chain Security: The Low-Level Security Testing Module…

Modern cybersecurity threats extend beyond software vulnerabilities, affecting firmware, embedded systems, and hardware interactions. While static and dynamic analysis are effective at identifying software-based vulnerabilities, they cannot fully assess low-level system components, which often operate at the firmware, kernel, and hardware interface levels. Attackers increasingly target these areas, exploiting memory corruption bugs, side-channel vulnerabilities, and processor-level execution flaws. Within the RESCALE project, the Low-Level Security Testing Module is specifically designed to identify and mitigate risks in these critical system components, ensuring comprehensive supply chain security by applying specialized firmware security testing, binary analysis, and microarchitectural evaluations.

The Role of the Low-Level Security Testing Module

The Low-Level Security Testing Module is a core component of RESCALE’s security framework, focusing on identifying vulnerabilities in firmware, kernel modules, and embedded systems. These components are often overlooked in traditional security assessments, making them a prime target for sophisticated attacks. The module enables security teams to test system components at the lowest level, ensuring that hardware and firmware are analyzed for security weaknesses before they are deployed into supply chain environments.

Unlike higher-level software testing, which primarily examines application logic and APIs, low-level security testing focuses on memory safety, execution integrity, and system-level security mechanisms. By leveraging specialized testing techniques such as fuzzing, symbolic execution, and microarchitectural analysis, the module can detect hidden vulnerabilities that static or dynamic analysis might miss.

The architecture of the Low-Level Security Testing Module consists of several key components that work together to perform deep security analysis of low-level system elements. The module interacts with firmware repositories, kernel drivers, and embedded software, extracting binary images for analysis. The testing process is orchestrated by a central execution engine, which manages the interaction between different testing tools and aggregates their findings into structured reports.

How the Low-Level Security Testing Module Works

The testing process begins with the identification and extraction of low-level system components, such as firmware binaries, kernel modules, and system drivers. These components are loaded into the testing environment, where various security analyzers perform automated assessments. The module integrates with a custom-built execution framework, allowing it to conduct fuzz testing, binary analysis, and microarchitectural security evaluations.

Once extracted, the components undergo memory safety analysis, ensuring that they do not contain buffer overflows, use-after-free vulnerabilities, or race conditions. The module also performs execution tracing, capturing how the firmware or kernel code interacts with the underlying hardware. This process helps detect side-channel vulnerabilities, speculative execution flaws, and memory access violations, which could be exploited by attackers to extract sensitive information or execute unauthorized code.

After executing the security tests, the module aggregates findings from multiple analyzers into a structured security report. These results are then processed and validated to ensure that all detected vulnerabilities are properly categorized and documented. The final assessment is stored in the Dynamic Supply Chain Component Guarantee (DSCG), which provides a comprehensive security overview of the tested component.

Integration with the RESCALE Security Framework

The Low-Level Security Testing Module does not operate in isolation. It is integrated into the broader RESCALE security pipeline, ensuring that low-level security findings contribute to the overall supply chain security assurance process. The results generated by the module feed into the Trusted Bill of Materials (TBOM), helping organizations verify that firmware, embedded software, and kernel modules have undergone rigorous security evaluation before deployment.

By integrating with other RESCALE security components, such as the Static Code Analysis Module and the Dynamic Testing Module, the Low-Level Security Testing Module provides a complete security assessment across all system layers. This multi-layered approach ensures that supply chain security covers software, firmware, and hardware, preventing attackers from exploiting vulnerabilities in the lower levels of the technology stack.

Why Low-Level Security Testing is Critical

Attacks targeting firmware and hardware security flaws have increased significantly in recent years. Threat actors exploit low-level vulnerabilities to gain persistence, bypass traditional security measures, and launch sophisticated attacks that are difficult to detect. Unlike application-layer attacks, which can often be mitigated through patches or configuration changes, firmware and hardware vulnerabilities are much harder to fix once a system is deployed.

The Low-Level Security Testing Module in RESCALE ensures that these vulnerabilities are detected before deployment, reducing the risk of firmware backdoors, privilege escalation attacks, and supply chain compromises. By incorporating automated binary analysis, execution tracing, and hardware-assisted testing, the module helps security teams identify security weaknesses at the lowest levels of the computing environment.

Conclusion

The Low-Level Security Testing Module in RESCALE is a vital component of modern supply chain security. By analyzing firmware, kernel modules, and embedded systems, it provides deep security insights that complement traditional static and dynamic testing approaches. Through automated security analysis, execution tracing, and memory safety validation, the module helps detect hard-to-find vulnerabilities that could compromise the integrity of supply chain components.

By integrating with the broader RESCALE security framework, the module ensures that low-level security assessments contribute to the overall supply chain security process. In the next article, we will explore the specialized tools used in the Low-Level Security Testing Module, including their methodologies and contributions to firmware, embedded software, and kernel security analysis.

Follow us on Social Media

Blog Post

The Tools Powering RESCALE’s Dynamic Testing Module

Ensuring the security of modern software requires more than just static analysis. Many vulnerabilities only emerge at runtime, making dynamic testing essential for detecting issues related to input validation, execution misconfigurations, and API security flaws. The Dynamic Testing Module in RESCALE integrates multiple specialized tools that execute software in controlled environments, providing a comprehensive assessment of software security before deployment. Each tool plays a distinct role in detecting different types of vulnerabilities, allowing for a multi-layered approach to security testing.

FATex: Fault Tolerance and Resilience Testing

FATex is designed to analyze how software behaves under fault conditions, focusing on the resilience of compiled applications. It introduces simulated failures and stress conditions, identifying points where an application may crash, behave unpredictably, or expose security risks. Unlike traditional fuzzers, FATex does not focus solely on input mutation but evaluates how execution paths respond to failures. This allows security teams to assess exception handling mechanisms, error recovery strategies, and overall system stability. By identifying weak points in an application’s fault tolerance, FATex helps developers build more robust and secure software.

RAISE: API Security Testing with ML-Driven Fuzzing

RAISE is a dynamic API security testing tool that automates the evaluation of web services, ensuring that API endpoints are resistant to attacks. Many modern applications rely on RESTful APIs, making API security a crucial aspect of software assurance. RAISE integrates with RESTler, a security-focused API fuzzer that generates API test cases using a grammar-based approach. By leveraging machine learning and genetic algorithms, RAISE optimizes the fuzzing process, identifying API vulnerabilities such as authentication bypasses, unauthorized access risks, and improper input validation. The tool systematically explores API execution paths, learning from previous test results to refine its approach and improve vulnerability detection.

The provided diagram illustrates how RAISE integrates with RESTler. The system starts with an OpenAPI or Swagger specification, which is compiled into an API grammar. The RESTler engine, enhanced with machine learning, generates fuzzing test cases designed to trigger security flaws. The results are stored in a trace database, where they are categorized into bug buckets for further analysis. This structured approach ensures that API vulnerabilities are identified efficiently and that the results are documented in a way that aids remediation efforts.

EvoMaster: AI-Driven Automated Test Case Generation

EvoMaster is designed to automate test case generation using evolutionary algorithms. Traditional testing relies on manually crafted test cases, which can be time-consuming and limited in coverage. EvoMaster generates test cases dynamically by leveraging OpenAPI schemas, systematically exploring execution paths, and identifying vulnerabilities through an AI-driven mutation-based approach. This method increases the likelihood of detecting hidden security flaws, particularly in applications with complex input handling.

The EvoMaster workflow diagram demonstrates how the tool interacts with a system under test (SUT). An API schema in OpenAPI format defines the expected structure of the API. The coverage plugin monitors execution coverage, helping EvoMaster optimize its test case generation process. The tool sends test requests and analyzes responses, using data from FuzzDB, a repository of attack payloads, to detect security weaknesses. Results are parsed and aggregated, contributing to the security assessment of the tested system. The final test report is generated and incorporated into the Dynamic Supply Chain Component Guarantee (DSCG), ensuring that all findings are properly documented.

Standardizing Security Findings with DSCG

The results from FATex, RAISE, and EvoMaster are aggregated into the Dynamic Supply Chain Component Guarantee (DSCG), a structured document that consolidates security assessment findings from dynamic testing. The DSCG ensures that runtime security evaluations are standardized and traceable, providing a detailed breakdown of vulnerabilities, risk assessments, and compliance with security policies.

The DSCG structure, as shown in the provided diagram, includes metadata such as the serial number, version, and tool information. It also contains declarations specifying security targets, claims, and evidence gathered during testing. Definitions and standards are incorporated to align the findings with established security frameworks. The CDX Validator processes the DSCG, ensuring that the results conform to industry standards before they are sent to the RESCALE Management Module. This guarantees that security assessments from dynamic testing contribute directly to the broader supply chain security framework.

Conclusion

The Dynamic Testing Module in RESCALE integrates multiple specialized tools to detect vulnerabilities that only emerge at runtime. FATex ensures that applications are resilient against faults and execution failures. RAISE systematically tests API security, using machine learning-driven fuzzing to uncover authentication and authorization flaws. EvoMaster automates test case generation, leveraging evolutionary algorithms to identify security risks in software execution paths. Together, these tools provide a comprehensive runtime security assessment, strengthening the security posture of software components before deployment.

Through the DSCG, the results of these security evaluations are standardized, validated, and integrated into the RESCALE security framework. As cyber threats evolve, dynamic testing plays a critical role in securing modern applications, ensuring that vulnerabilities are detected and mitigated before they can be exploited.

Follow us on Social Media

Blog Post

Ensuring Software Security with RESCALE’s Dynamic Testing Module

Modern software supply chains face growing security challenges, with vulnerabilities potentially emerging at any stage, during development, compilation, or execution. While static analysis is effective in detecting security flaws at the code level, many threats only manifest at runtime, making them invisible to static testing. Dynamic testing addresses this challenge by executing software in controlled environments, detecting vulnerabilities that arise from interactions, input handling, memory management, and real-world execution conditions. Within the RESCALE project, the Dynamic Testing Module plays a crucial role in analyzing software and hardware components under runtime conditions, ensuring a comprehensive security evaluation before deployment.

The Dynamic Testing Module is an integral part of the RESCALE security framework, ensuring that compiled software artifacts and their runtime behavior are assessed for security risks. Unlike static analysis, which primarily works with source code, dynamic testing focuses on compiled and running software, identifying weaknesses that only appear during execution. This module automates and standardizes the process of runtime security validation, ensuring that each tested component is documented, verified, and assigned a security guarantee based on the findings.

How the Dynamic Testing Module Works

The architecture of the Dynamic Testing Module is structured to execute software securely in a controlled environment while integrating various dynamic analysis techniques. The module consists of an Orchestrator Hub, which manages dynamic testing workflows and coordinates the execution of multiple security testing tools. It interacts with a software repository, where both compiled software and its runtime twin are stored, ensuring that analysis can be performed in a manner that mimics real-world deployment.

The Orchestrator Hub directs testing across different analyzers, each specializing in distinct aspects of software and hardware security. The Dynamic Software Testing Analyzers, which include tools such as FATex, RAISE, and EvoMaster, focus on fuzz testing, API security evaluation, and behavioral analysis. These tools are particularly effective in uncovering issues such as input validation failures, memory corruption, and execution logic errors that are difficult to detect without live execution. In parallel, the Low-Level Hardware Testing Analyzers, including Inspectre and the SCA Analysis Tool, assess security vulnerabilities at the firmware, device, and embedded system levels, ensuring that hardware components are tested alongside software.

The Role of the DSCG in Dynamic Testing

A key output of the Dynamic Testing Module is the Dynamic Supply Chain Component Guarantee (DSCG), a structured security assessment that consolidates and standardizes the results of runtime security evaluations. As the various dynamic analysis tools execute their respective security tests, their findings are aggregated and processed within the module. The DSCG Generator compiles these results, ensuring that vulnerabilities, security compliance checks, and risk assessments are standardized and traceable.

To maintain consistency with supply chain security requirements, the CDX Validator ensures that all findings align with structured reporting formats, making them usable for further security assessments within RESCALE. Once validated, the DSCG is integrated into the RESCALE Management Module, where it contributes to broader security assurance processes. The data collected through dynamic testing plays a key role in informing security decisions across the software supply chain, ultimately feeding into the generation of a Trusted Bill of Materials (TBOM), which consolidates security guarantees at all stages of software development and execution.

Why Dynamic Testing is Critical for Supply Chain Security

While static analysis plays an essential role in identifying security flaws in code, it does not account for vulnerabilities that arise only during execution. Many of the most exploitable security weaknesses, such as buffer overflows, race conditions, and input validation failures, cannot be detected without executing the software under realistic conditions. Attackers often exploit runtime-specific vulnerabilities that do not exist at the source code level, making dynamic testing an essential component of a comprehensive security strategy.

Beyond software vulnerabilities, dynamic testing is particularly valuable in securing hardware and embedded systems, which are becoming increasingly important in modern supply chain security models. With the growing reliance on third-party hardware components, firmware integrations, and external dependencies, security risks extend beyond just software flaws. The Dynamic Testing Module ensures that security assessments include hardware analysis, reducing the risk of firmware-based exploits, insecure device interactions, and physical-layer vulnerabilities.

Conclusion

The Dynamic Testing Module in RESCALE is a key component in ensuring comprehensive software and hardware security. By integrating multiple dynamic analysis tools, aggregating results into the DSCG, and feeding validated security assessments into the broader RESCALE framework, this module ensures that software and hardware undergo rigorous testing before deployment. By identifying runtime vulnerabilities and assessing security risks in compiled binaries, APIs, and embedded systems, it plays a crucial role in securing the software supply chain.

In the next article, we will examine the specific tools that power this module, including FATex, RAISE, EvoMaster, and Inspectre, exploring how each contributes to enhancing dynamic security analysis in RESCALE.