Fuzzing FIX (Financial Information eXchange)

Home → Aon’s Cyber Labs → Fuzzing FIX (Financial Information eXchange)
Tuesday, September 24, 2013 At 8:19AM

FIX (Financial Information eXchange) is a transaction protocol we come across quite often when assessing trading systems, especially those which span multiple organizations. Having come across these systems a number of times, Aon’s Cyber Labs opted to create a FIX specific assessment tool to enable us to more efficiently assess FIX based solutions. The main idea was to create a tool which can be extended with new tests in order assess a variety of implementations. After cleaning up the code somewhat, we are now choosing to release this tool to the public. Although it only includes a relatively small number of the checks we perform on such an engagement, it should help provide a starting point for testing a wide variety of FIX receivers.

When we get an opportunity, we will provide a more detailed walkthrough of using and extending the tool, however to leverage the tool in the meantime, record a FIX conversation between a client and receiver using a packet capture utility such as Wireshark or TCPDump.  Feed this capture file in to the tool, and the messages and a login request will be extracted to serve as a baseline for fuzzing.  The tool will issue a new login request for every message in order to help prevent one session from clouding another.  It also has the ability to keep track of (and automatically update) sequence numbers and respond to resend requests.  The source code can be found on our public Github page.

 

Author: Michael Hanchak
©Aon plc 2023

Gotham Digital Science, LLC (GDS), is a wholly owned subsidiary of Aon, PLC
This material has been prepared for informational purposes only and should not be relied on for any other purpose. You should consult with your own professional advisors or IT specialists before implementing any recommendation or following the guidance provided herein. Further, the information provided and the statements expressed are not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information and use sources that we consider reliable, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. The examples provided in this article are not based upon an actual Stroz/Aon client, but was provided for illustrative purposes only.
About Cyber Solutions
Cyber security services are offered by Stroz Friedberg Inc., its subsidiaries and affiliates. Stroz Friedberg is part of Aon’s Cyber Solutions which offers holistic cyber risk management, unsurpassed investigative skills, and proprietary technologies to help clients uncover and quantify cyber risks, protect critical assets, and recover from cyber incidents.


Cyber security services offered by Stroz Friedberg Inc. and its affiliates. Insurance products and services offered by Aon Risk Insurance Services West, Inc., Aon Risk Services Central, Inc., Aon Risk Services Northeast, Inc., Aon Risk Services Southwest, Inc., and Aon Risk Services, Inc. of Florida and their licensed affiliates. Aon UK Limited is authorised and regulated by the Financial Conduct Authority in respect of insurance distribution services. FP.AGRC.238.JJ The following products or services are not regulated by the Financial Conduct Authority:
• Cyber risk services provided by Aon UK Limited and its affiliates
• Cyber security services provided by Stroz Friedberg Limited and its affiliates.


Copyright 2021 Aon plc. All Rights Reserved.


Copyright 2021 Aon plc. All Rights Reserved.
Cyber security services offered by Stroz Friedberg Inc. and its affiliates. Insurance products and services offered by Aon Risk Insurance Services West, Inc., Aon Risk Services Central, Inc., Aon Risk Services Northeast, Inc., Aon Risk Services Southwest, Inc., and Aon Risk Services, Inc. of Florida and their licensed affiliates. Aon UK Limited is authorised and regulated by the Financial Conduct Authority in respect of insurance distribution services. FP.AGRC.238.JJ The following products or services are not regulated by the Financial Conduct Authority:
• Cyber risk services provided by Aon UK Limited and its affiliates
• Cyber security services provided by Stroz Friedberg Limited and its affiliates.