O2 Light - Dual Scan and Code Fix Tag (2009)

Here is a PoC I wrote in 2009 (post OunceLabs IBM acquisition) of a mini tool (with drag-n-drop support) that:

• Fired up scans of Ounce 6 and AppScan Developer (the two SAST engines that IBM had at the time)
• Imported both set of scan Findings to O2
• Created consolidated list of Findings (i.e. findings that existed in both sets of results)
• Showed consolidated Findings to user (with ability to open them in Ounce 6)

As with the OunceLabs WebScan Module this O2 Light - Dual Scan and Code Fix Tag module (downloadable from here) doesn't build in VisualStudio anymore, but I was able to get a couple screenshots from VisualStudio's Control Designer.

OunceLabs WebScan Module (with 'Will It Scan' feature)

Back in the days (2008) I created a PoC for OunceLabs engine where it was possible to trigger scans via a website.

I found the files but there were a number of missing dependencies (like some JNBridge stuff which was shipped with last version of the OunceLabs product (pre IBM)).

So the best I can do is to open it in VisualStudio and show the aspx pages in design view.

Implementing S4 - Source-code Security Scanning Services - v0.5.pdf (2008)

From the OunceLabs archives here is a document I wrote back in 2008 that provides a roadmap (and template) for companies (or team) that want to implement a S4 (Source-code Security Scanning Services)

I never finished this document, but there are lots of good (and battle-proven) ideas in there :)

O2 Presentation - from Jan 2009

Here is a presentation I delivered about O2 to OunceLabs (before the acquisition).

It's pretty cool to see the position (for O2) I had back then, and how that is still very relevant today (it's a bit depressing that the industry has not moved much in the last 4 years)

F1 How To - Scanning HacmeBank WebServices v0.6 (from 2008)

Another one from the O2 Archives, here is a pdf (shown below) that I wrote in June 2008 that showed how to use F1 (what the O2 Platform used to be called before it was Open Sourced) to scan HacmeBank Website and WebServices

Check out the consolidated graphs that I was able to create at the time. Pretty cool way to visualize multiple traces in one graph :)

The 2nd part of the document, shows how F1 was used to auto-create-callbacks (i.e. tainted sources) in the OunceLabs engine (this feature has since been added to the latest version of IBM AppScan Source)

AppScan Source Findings in Ozasmt files (and O2 tools to View, Filter, Join, Stitch and Script them)

If you are using AppScan Source (previously called OunceLabs) you will find these O2 Tools really useful:

• Util - Simple Findings Viewer v1.1.exe (4.8Mb)
• Util - Simple Findings Viewer (with code viewer) v1.1.exe (4.8Mb)
• Util - Filter Findings by Source and Sink (RegEx) v1.1exe (4.8Mb)
• PoC - Join Traces (on Attributes) - very basic version v1.0.exe (4.8Mb)

Util - Cir Viewer (with C# DLL converter) v1.0

Here is an oldie one by still really effective.

I just rebuilt the O2's CirViewer (CIR = Common Intermediate Representation (from the OunceLabs days)) as an easy to consume stand-alone tool which you can get from: Util - Cir Viewer (with C# DLL converter) v1.0.exe

What is going on with you (Jul 2010) and are you at BlackHat / DefCon?

Since I have a number of similar questions on my Inbox, it will be easier to reply to them here :)

No, I'm at at BlackHat and DefCon (I'm an independent contractor now so I have no company to send the bills to and I was not able to get O2 to generate enough revenue to organize a BH/DC gathering)

Regarding what has been going on, here is a selection of blog posts that cover the last couple months:

Update on OunceLabs+IBM story and "OWASP O2 Platform is ready for you (after 6 months solid development)"

So what is happening with the OWASP O2 Platform, with me, and why am I only writing this blog post now? (7th of July 2010)

For the past 6 months I have been following an opportunity that I was given by the IBM purchase of OunceLabs and the previous Open Sourcing of my research on static analysis (originally on top of the OunceLabs engine).

Update #4 on OunceLabs/IBM Relationship

Following the previous posts on this topic (see Update on O2 & Ounce & IBM, Update #2 on O2 & IBM - 02 Sep 09 , Update #3 on O2 & IBM ) here is an update of how the first chapter was concluded.

After some internal debate, IBM decided that the time was not right for them to provide commercial support for O2, so instead of waiting around in IBM land, I made the decision to not accept the contract that I was offered (see why I said NO to IBM for now), which had the practical consequence that my contract with IBM ended on December 31 2009.

OWASP NYC Conference 2008

Just returned to London from the OWASP NYC Conference and as always it was a great experience (this was the biggest OWASP conference so far)

In addition to participating on the keynote speech, I delivered two presentations: OWASP Summit 2008 and 'Building a tool for Security consultants: A story of a customized source code'.

This last presentation was a variation of my previous two posts (OunceLabs releases my research tools under an Open Source License... , So what can I do with O2) and the questions I had after the presentation plus the multiple positive comments/conversations, tell me that the message that I wanted to pass was well understood and received (here is a blog post with a outline of the presentation and here is blog post that provide a good description of what wanted to say: OWASP NYC AppSec 2008 and NYSec Recap )

So what can I do with O2?

In my first post (http://diniscruz.blogspot.com/2008/09/ouncelabs-releases-my-research-tools.html) I explained why I created O2 and how it fits in Ounce’s world. In this post I will delve into what O2 allows me to do and how it revolutionized the way I perform source code security assessments.

It is probably better if I first explain how I approach these types of projects so that I can them show how O2 first perfectly into it.

This is the way I view these security assessments: There is a client who is paying me to review their web application for issues that might have business impact, where I am also expected to help to identify the underlying root causes of the issues discovered and provide assistance with the possible remediation paths. The client usually looks at me for guidance on what I need to do my job, and expects in return objective answers.

OunceLabs releases my research tools under an Open Source license (it’s called O2 and is hosted at CodePlex

Hello, as you probably know I have been consulting with OunceLabs (http://www.ouncelabs.com) for the past 18 Months, and on the last 9 months I have been deeply involved on an internal project which I am very excited about and is now going to be released under an Open Source license (go Ounce!!!)

One of my tasks at OunceLabs was to make their technology 'Work' from the point of view of an advanced security consultant (like me). By 'Work' I mean create a model that uses (sorry for the cliché) People + Process + Ounce Technology whereby the later (Ounce Technology) is used throughout an entire engagement (versus the current model where it is mainly used at the beginning of the engagement or to perform specific analysis).