mozillasecurity / virgo

Crowdsourced fuzzing cluster. 🚀

Crowdsourced fuzzing cluster. 🚀

Overview

• What is Virgo?
• How does it work?
• Usage
• Issues
• Contributing
• Screenshots

🤔What is Virgo?

Virgo is a concept for creating a cluster of fuzzers made by users who are willing to trade and contribute their CPU resources of their workstations to a greater good.

Use Cases

• Intracompany fuzz testing by using office workstations after-hours without additional spending on cloud providers.
• Software developers can point Virgo to their own Task Definition Server and quickly test among colleagues newly developed features.
• Bug bounty hunters and open source supporters creating a collective supercluster in testing features more quickly and more intensively, and potentially get rewarded for providing their CPU time.

Virgo can theoretically be used for any arbitrary work task defined in a container. However, Virgo was built as a fuzzing solution in mind.

💡How does it work?

Virgo's infrastructure is based on Docker. Virgo fetches routinely a remote server for new tasks by downloading a Task Definition File which contains information on how to run a task and which host preferences are required. If the required hosts preferences meet the constraints for a certain task, Virgo will download the image, create a container and run that container until a user action intervenes or run "indefinitely". An intervention can be pause, stop, a scheduler, observed system or network activity. If a crash is found during a run, it immediately is sent to our backend for further analyzation and in case of a security issue, you will be informed by the provided contact email address.

🚀Usage

Virgo is in its beta stage, obscure bugs may occur. We urge you to file these in our GitHub issue tracker along with any suggestions or feature requests you might have.

You need to have the Docker engine installed and running on your computer. If you do not have it installed, here are some quick steps to get ready quickly.

Preparation

MacOS

brew cask install docker

Alternatively: https://download.docker.com/mac/stable/Docker.dmg

Windows

choco install docker-desktop

Alternatively: https://download.docker.com/win/stable/Docker%20for%20Windows%20Installer.exe

Make sure that in Settings -> Shared Drives the Volume is enabled on which you installed Virgo.

Linux

./scripts/install_docker.sh

Do not forget to log out/in after this step.

To make sure Docker is setup and running, you can run the following command: docker run hello-world. If you see the "Hello from Docker!" message after some seconds, you are good to go.

Launch

You can now launch Virgo which you downloaded for your platform from the release page.

Note: If you are on Linux run chmod a+x virgo*.AppImage before you try to launch it.

If you want to get notified about found security issues discovered by your machine, provide your email address in the Preferences. This step is optional but if your workstation has found a security related issue we will add you to the Bugzilla report to get notified.

Issues

In case of abnormal behaviour of the application you can reset Virgo to factory default settings.

Common

MacOS

rm ~/Library/Application\ Support/virgo/config.json

Windows

rm ~\AppData\Roaming\virgo\config.json

Linux

rm ~/.config/virgo

If a task was still running before you closed Virgo, then you can find the task in the Activity tab, where you can manually stop and delete it.

Debugging

If you want to take a glimpse in what is happening under the hood, go to the Activity tab and copy the container id of the running task. You can then in the Terminal run: docker logs <id> --follow to see what is happening.

Contributing

Launch Virgo

git clone https://github.com/mozillasecurity/virgo && cd virgo && npm -s install
npm start

Developer extensions are enabled in non-production builds, except Devtron for analyzing IPC traffic. You can enable it by entering require('devtron').install() in the Developer Console.

To produce a production build run first npm run build and optionally npm run release <platform>. Where platform can be macos64, windows64, linux64 or '' to create a release for all platforms.

For a detailed list of commands run npm run

Launch Task Definition Server

cd heroku && npm -s install && npm start

You will need to point Virgo to your custom Task Definition Server in the Preferences.

See Wiki for detailed setup instructions including Minio for testing in-app updates, Sentry.io for in-app crashes and FuzzManager as custom crash collector backend.

Screenshots

Author

👤 Christoph Diehl <[email protected]>

• Twitter: @posidron
• Github: @posidron

virgo's Issues

Restrict permission of JSON server to GET

• Setup the current testing server at AWS/GCE and set permissions to be GET only.

Add History tab to Activity

• Add History tab to Activity
  • Add id, name, duration to docker.history state
  • Add Clear button which triggers HISTORY_RESET action

Hook up internal crashReporter to Sentry

• Add steps from https://electronjs.org/docs/api/crash-reporter#crashreporter

Easier to integrate until Beta release. Features 1 User, 5k crashes per month, history of 30 days for free. Let's see how that goes for now before spending time on developing a NodeJS integration into FuzzManager.

Improve CSS for Content, Statusbar and Activity

• Statusbar should have a little grid to place multiple status information inside.
• Content area should be scrollable, not the entire Window.
• Activity table columns need to be more dense .. should happen automatically.
• Activity tabs need to resize automatically to the max Content area minus Statusbar. If the pagination switches from 10 to 25 it places the pagination footer below the Statusbar.

Timer code is off when running for more than 2h

• Version: 0.2.2
• Platform: Linux

Codesign the Windows version for update process

• Add steps from https://www.electron.build/code-signing

Pause / Resume task state based on internet connectivity

To prevent crashes from being submitted only run or resume the container if an internet connection exists and pause the container if it does not.

Add emailAddress field to Docker preferences

• The field will be passed as ENV to the container run and added to either client or meta field information.

Add app restart option to ErrorDialog

This needs to happen in ErrorDialog and in the Sentry.showReportDialog, or
redirect to safe place i.e window.location = /crashpage/.

Add actions to Activity table

• Delete action for Docker images
• Delete action for Docker containers
• Search box filtering state by id or name

Codesign the MacOS version for update process

• Needs Apple Developer account (can use private or must use corporate account?)
• Add steps from https://www.electron.build/code-signing

Copy stats file out of container for advanced information

Idea:

• docker cp /home/worker/stats:<electron_dir>
• parse into object or array
• display as foldable view into Dashboard component

Example:

execs_done       : 312466
execs_per_sec    : 59
rss_mb           : 11426
corpus_size      : 4152
next_auto_reduce : 4774
crashes          : 0
timeouts         : 0
ooms             : 0
last_new         : 1561052444
last_new_pc      : 1561049863

Virgo crashes on startup win10

• Version: 0.2.1
• Platform: Windows 10 version 1903 (OS Build 18362.207)

Launching yields a crash dialog:

After clicking OK, the dashboard comes up, but nothing seems to happen there. In Task Manager, 3 processes are running:

Note: I do have Docker configured to expose the daemon on tcp://localhost:2375 without tls, so that I can use it from WSL.

Image sort by date appears to sort dates as strings

• Version: 0.2.2
• Platform: Win10

In the Virgo dashboard, sorting the docker images by date shows the dates are treated as strings, not dates. That'd be fine if the dates were displayed per RFC-3339, but they aren't (even though that is the format I've configured Windows to use):