Security/Automation/WinterOfSecurity2014

Winter Of Security 2014

The Winter of Security is a project of several Mozilla Security Teams to mentor students during a full semester. The goal is for students to work on security related projects that are supported by Mozilla, under guidance of a professor and a mentor.

Projects are focused on tools, and students are expected to write code.

Selection process

Projects are assigned to groups of students. Groups are defined by the universities, and can be of any size between 1 and 4 students. The selection process is open to all students in undergraduate/license and graduate/master programs. A group applies to up to 3 projects by submitting an application that contains:

• the names of the projects the team is applying to
• team introduction and motivation (max 1000 characters)
• presentation of the university program (max 500 characters)
• short description of each team member (skills, interest, ...) (max 500 character for each team member)
• links to relevant resources (university website, resumes, ...)

Domains

Web Security

ScanJS: Contribute to a JavaScript source code analyzer

• mentor: Frederik Braun
• difficulty: high
• language: english

ScanJS is a JavaScript tool to analyze and test open web apps for security vulnerabilities. Contribute to our codebase and help us improve the tool's capabilities.

Conduct Security Reviews

• mentor: Frederik Braun
• difficulty: high
• language: english

The Mozilla security teams review and test a lot of Mozilla software products or new features. Help by joining one of the reviews and conduct a penetration test on open source software (details to be announced).

Forensic

Cross-platform memory scanning in Go

• mentor: Julien Vehent
• difficulty: high
• language: english or french

The Mozilla InvestiGator (MIG) project needs a way to inspect the content of the memory of a system, and detect threats. The typical approach in memory forensic is to dump the memory of a system, and perform analysis on another system, using tools like Volatility. We are looking for an approach that is less invasive, where an agent running on a target system can inspect its own memory without disrupting operations. Existing libraries, such as Volatility, are hard to ship to remote systems because of their size and dependencies. The goal of this project is to design and code a lean, cross-platform, memory inspection library in the Go language that can be integrated into MIG. This project is an opportunity for a group of students to take a close look at memory forensic across all operating systems.

Network Security

Active measurement of firewalls configuration compliance

• mentor: TBD
• difficulty: medium
• language: english

Building firewall rules is a difficulty exercise, but keeping these rules strict over several years is an even harder challenge. Products exist, such as Tufin, to facilitate the operations of firewalls at scale. In this project, we are looking for a way to actively measure compliance, by injecting traffic inside the network and parsing the results. Unlike classic port scanning, such as NMAP, which typically consist of scanning from outside-in, the idea here would be to scan from multiple network locations in parallel, and aggregate the results. One VLAN could be scanning another, without crossing datacenter boundaries. The goal is to build the scanning logic, but also the compliance validation aspect, which consist of defining in technical terms what compliance means, and checking for compliance against scan results.

Cross-platform firewall driver in Go

• mentor: Julien Vehent
• difficulty: medium
• language: english or french

The Mozilla InvestiGator (MIG) is designing to detect and respond to threats. One way of responding to an attack is to create firewall rules on the local host to block an IP, or a particular connection. The goal of this project is to create a library in the Go language that can create and delete firewall rules on Windows, MacOS and Linux (iptables and ntables). The library should also be able to retrieve a ruleset from a host in a standardized format (JSON). This project is an opportunity for a group of students to take a close look at firewall management on the major operating systems.

Cryptography

Compliance checking of TLS configuration

• mentor: Julien Vehent
• difficulty: easy
• language: english or french

Mozilla maintains guidelines for server side configurations of SSL/TLS. The goal of this project is to build a tool that verifies compliance of a configuration with our guidelines, and help the administrators improve their security. It is very similar in philosophy to project like SSL Labs, but with a stronger emphasis on explaining how to reach a better security level, and educating the administrators.

Risk Management

A playful way of teaching risk management to individuals

• mentor: TBD
• difficulty: medium
• language: english

Risk management methodologies are numerous, but often regarded by individuals outside of the security community as dull and boring. The goal of this project is to design a way to teach the Mozilla Risk Management program to individuals at Mozilla. This could take the form of a strategy game, or anything that the students think is appropriate. This project has a strong component of creativity, but must also take into account some of the particularities of Mozilla: people are technically minded, work remotely often on video, and care a lot about security and privacy. A successful training program should teach the individual the entire lifecycle of data at Mozilla.