SlideShare a Scribd company logo
1 of 33
Download to read offline
Fuzzing:
The New Unit Testing
C++ Russia 2017, Moscow, Feb 25
Dmitry Vyukov, dvyukov@, Google
Agenda
● What is fuzzing
● Coverage-guided fuzzing
● Small tutorial
● How to write effective fuzzers
● Fuzzing@Google
What is Fuzzing?
wikipedia.org/wiki/Fuzz_testing:
Fuzz testing or fuzzing is a software testing technique, often automated or
semi-automated, that involves providing invalid, unexpected, or random data to
the inputs of a computer program.
Who cares?
- We are not testing/checking anything!
- Random data will not trigger any bugs!
Fuzzing can find lots of bugs
- With the help of sanitizers:
- Use-after-free, buffer overflows
- Uses of uninitialized memory
- Memory leaks
- Data races, deadlocks
- Int/float overflows, bitwise shifts by invalid amount (other UB)
- Plain crashes:
- NULL dereferences, uncaught exceptions, div-by-zero
- Resource usage bugs:
- Memory exhaustion, hangs or infinite loops, infinite recursion (stack overflows)
- Logical bugs (lots of, see below)
Data is not necessary "white noise"
- There is number of tricks to generate "not so random" data
- May or may not require some human help
- If used correctly achieves very impressive code coverage
What can be fuzzed?
Anything that consumes complex inputs:
● Parsers of any kind (xml, json, asn.1, pdf, truetype, ...)
● Media codecs (audio, video, raster & vector images, etc)
● Network protocols (HTTP, RPC, SMTP, MIME...)
● Crypto (boringssl, openssl)
● Compression (zip, gzip, bzip2, brotli, ...)
● Formatted output (sprintf, template engines)
● Compilers and interpreters (Javascript, PHP, Perl, Python, Go, Clang, ...)
● Regular expression matchers (PCRE, RE2, libc’s regcomp)
● Text/UTF processing (icu)
● Databases (SQLite)
● Browsers, text editors/processors (Chrome, vim, OpenOffice)
● OS Kernels (Linux), drivers, supervisors and VMs
Must have for everything that consumes untrusted inputs, open to internet or otherwise security sensitive.
Types of Fuzzers
- Grammar-based generation
- Generate random inputs according to grammar rules
- Peach, packetdrill, csmith, gosmith, syzkaller
- Blind mutation
- Requires a corpus of representative inputs, apply random mutations to them
- ZZUF, Radamsa
- Grammar reverse-engineering
- Learn grammar from existing inputs using algorithmic approach of machine learning
- Sequitur algorithm, go-fuzz
- Symbolic execution + SAT solver
- Synthesize inputs with maximum coverage using black magic
- KLEE
- Coverage-guided fuzzers
- Genetic algorithm that strives to maximize code coverage
- libFuzzer, AFL, honggfuzz, syzkaller
- Hybrid
Coverage-guided fuzzing
Build the program with code coverage instrumentation;
Collect initial corpus of inputs (optional);
while (true) {
Choose a random input from corpus and mutate it;
Run the target program on the input, collect code coverage;
If the input gives new coverage, add mutation back to the corpus;
}
Coverage-guiding in action
if input[0] == '{' {
if input[1] == 'i' && input[2] == 'f' {
if input[3] == '(' {
input[input[4]] = input[5]; // potential OOB write
}
}
}
Requires "{if(" input to crash, ~2^32 guesses to crack when blind.
Coverage-guiding:
Guess "{" in ~2^8, add to corpus.
Guess "{i" in ~2^8, add to corpus.
Guess "{if" in ~2^8, add to corpus.
Guess "{if(" in ~2^8, add to corpus.
Total: ~2^10 guesses.
See: AFL: Pulling JPEGs out of thin air
Mutations
● erase/insert/change/shuffle bit/byte/bytes
● crossover/splice 2 inputs
● insert token from a dictionary
● insert magic numbers (2^10±1, 2^16±1, 2^31±1, 2^32±1)
● change an ASCII integer (e.g. "123" => "2465357635")
● ...
Coverage flavours
Basic blocks:
... (A)
if (...) {
... (B)
}
... (C)
-fsanitize-coverage=bb
Edges:
... (A)
if (...) {
... (B)
}
... (C)
-fsanitize-coverage=trace-pc-guard
Gives better feedback signal.
Counters:
for (...) {
... (hit N times)
}
-fsanitize-coverage=8bit-counters
Gives better feedback signal
for loops and recursion.
Cracking hashes
What about more complex cases?
if (*(uint32_t*)input == crc32(input+4, size-4)) {...}
if (*(uint64_t*)input == 0xBCEBC041BADBALL) {...}
Cracking hashes
Intercept comparison operations:
● compiler intercepts int comparisons (-fsanitize-coverage=trace-cmp)
● runtime intercepts strcmp/memcmp and friends
Several possibilities:
● extract int/string literals and insert them into inputs
● find one comparison operand in the input and replace with the other operand
● use PC^POPCNT(op1^op2) as "coverage" signal (Hamming distance)
Dictionaries
● User-provided
○ e.g. for HTTP: "HTTP/1.1", "Host", "Accept-Encoding"
● Automatically extracted from program
○ memcpy(input, "HTTP/1.1", 8)
Tutorial
"...one of the most highly regarded and expertly designed C++ library projects in the world"
boost.regex
(latest version 1.63, in boost since 1.18)
Tutorial: fuzzing function
As simple as:
int LLVMFuzzerTestOneInput(const uint8_t * Data, size_t Size) {
try {
std::string str((char*)Data, Size);
boost::regex e( str);
boost::match_results<std::string::const_iterator> what;
boost::regex_match(str, what, e, boost::match_default);
} catch (const std::exception&) {}
return 0;
}
Tutorial: building (the hard part)
1. Build boost with coverage and AddressSanitizer:
./b2 cxxflags="-fsanitize-coverage=trace-pc-guard -fsanitize=address" toolset=clang install
2. Build fuzzer with coverage, AddressSanitizer and libFuzzer:
clang++ fuzzer.cc -fsanitize-coverage=trace-pc-guard -fsanitize=address libFuzzer.a
The rest is at tutorial.libfuzzer.info
Demo
30 minutes, 13 bugs (ticket/12818):
AddressSanitizer: heap-buffer-overflow perl_matcher.hpp:132 in re_skip_past_null
AddressSanitizer: heap-buffer-overflow basic_regex_parser.hpp:2599 in parse_perl_extension
AddressSanitizer: heap-buffer-overflow perl_matcher.hpp:221 in re_is_set_member
AddressSanitizer: heap-buffer-overflow perl_matcher.hpp:166 in re_is_set_member
AddressSanitizer: heap-buffer-overflow interceptors.inc:278 in strlen
AddressSanitizer: stack-overflow basic_regex_creator.hpp:1054 in create_startmap
AddressSanitizer: SEGV on unknown address 0x0000000016e0
MemorySanitizer: use-of-uninitialized-value perl_matcher.hpp:166 in re_is_set_member
basic_regex_parser.hpp:904: runtime error: shift exponent 325804978 is too large for 32-bit type 'unsigned int'
basic_regex_parser.hpp:2599: runtime error: load of value 56794092, which is not a valid value for type 'syntax_element_type'
a.out: perl_matcher_common.hpp:606: Assertion `r.first != r.second' failed
Direct leak of 4096 byte(s) in 1 object(s) allocated in get_mem_block regex.cpp:204
ALARM: working on the last Unit for 17 seconds
Will find more when these are fixed!
Results
Finding logical bugs
Not only security/stability
- But we don't know the right result!
- Use your imagination!
Finding logical bugs
● sanity checks on results
○ uncompressesed image decoder: 100 byte input -> 100 MB output?
○ function returns both error and object, or no error and no object
○ know that some substring must present in output, but it is not
○ encrypt, check that decryption with wrong key fails
● sometimes we do know the right result
○ any sorting: check that each element is present, check that it's not descending
○ building a trie: check size, all elements are present
● asserts
○ assert(a == b)
Finding logical bugs
Round-trip:
● encode-decode
● serialize-deserialize
● compress-decompress
● encrypt-decrypt
● assemble-disassemble
Checks:
● decode-encode: check that encode don't fail
● decode-encode-decode: check that second decode don't fail
● decode-encode-decode: check that decode results are equal
● encode-decode-encode: check that encode results are equal
Very powerful technique.
Finding logical bugs
Comparing two (or more) implementations gives phenomenal results:
● check that output is equal
● or at least check that ok/fail result is the same
○ e.g. gcc and clang both accept or reject the code
But I don't want to write the second impl!
● there can be several libraries implementing the same (libxmlFoo vs libxmlBar)
● implementation in a different language (re2 vs Go's regexp)
● compare "fast but complex" with "slow but dumb" (sometimes easy to write)
● compare different functions (marshalBinary vs marshalText)
Quick Quiz: how to fuzz clang-format?
clang-format: shuffles whitespaces in a source file.
Let's imaging destiny of mankind depends on correctness of clang-format!
How would you fuzz test it?
Quick Quiz: how to fuzz clang-format?
● run with asan/msan/ubsan
● format twice, compare results (e.g. relies on unordered_map order)
● format, then format result (must be idempotent)
● strip all whitespaces, compare before/after
● check violations of max line length
● compile before/after (formatting breaks/unbreaks code)
Regression testing
Normally you run fuzzer for a long time.
But any guided fuzzer accumulates corpus of inputs with max coverage.
And that's perfect for regression testing! Just run it once on every change!
Fuzzing@Google Why?
- faster and faster development
- more and more code
- correctness is important
- stability is still important
- security is super important
- want to move fast, but keep development costs under control
Traditional testing is not enough anymore!
Fuzzing@Google How?
- Developers can write "fuzz tests"
- picked up by automatic large-scale fuzzing system
- but also work as regression unit tests
- OSS-Fuzz: continuous fuzzing for OSS
- 50+ projects, 190 fuzzers
- libFuzzer, radamsa, AFL (coming)
- 5000 cores
- ClusterFuzz: automated fuzzing for Chromium
- 350 fuzzers
- libFuzzer, radamsa, AFL, custom fuzzers
- 12000 cores
- Automatically files bugs and verifies fixes
- syzkaller: continuous fuzzing of Linux kernel
- several upstream branches + android/chromeos
- 100+ VMs + physical devices
Fuzzing@Google
~15'000bugs
GLIBC MUSL LIBC pugixml PCRE ICU Freetype ffmpeg Harfbuzz SQLite Python OpenSSL BoringSSL libxml2 BPF Capstone file Radare2 gRPC
WOFF2 LLVM Tensorflow libav FreeType2 Foxit libtiff Go Linux libexif libFLAC Little CMS Adobe Reader Adobe Flash Player Adobe DNG SDK
ESET NOD32 ClamAV BitDefender poppler ghostscript dcraw qcms libwebp libwebm libvpx gipfeli libots Snapseed Dart VM IJG libjpeg-turbo libpng
mozjpeg PHP Firefox Internet Explorer Apple Safari LibreOffice GnuTLS GnuPG OpenSSH bash tcpdump JavaScriptCore pdfium libmatroska
libarchive wireshark ImageMagick lcms libbpg lame libsndfile less lesspipe strings dpkg rcs systemd-resolved libyaml Info-Zip unzip libtasn pfctl
mandoc IDA Pro clamav nasm ctags mutt procmail fontconfig pdksh wavpack redis cmsgpack taglib privoxy perl libxmpradare2 SleuthKit X.Org
exifprobe jhead Xerces-C metacam exiv btrfs Knot DNS curl wpa_supplicant dnsmasq imlib2 libraw libwmf uudecode MuPDF libbson libsass boost
Sales pitch
● Fuzzing is complimentary to any other testing technique
● Fuzzing is mandatory for anything security-related
● Fuzzing finds LOTS of bugs
● Fuzzing is easy to use
Call to action:
● choose 1 library that uses complex inputs (important or you suspect for bugs)
● write a fuzzer
● run locally with ASAN
Thanks!
Q&A
http://tutorial.libfuzzer.info
Dmitry Vyukov, dvyukov@
References
https://en.wikipedia.org/wiki/Fuzz_testing
https://github.com/google/sanitizers
http://llvm.org/docs/LibFuzzer.html
http://tutorial.libfuzzer.info
http://lcamtuf.coredump.cx/afl/
https://github.com/google/oss-fuzz
https://github.com/google/syzkaller
https://github.com/dvyukov/go-fuzz

More Related Content

What's hot

Block I/O Layer Tracing: blktrace
Block I/O Layer Tracing: blktraceBlock I/O Layer Tracing: blktrace
Block I/O Layer Tracing: blktraceBabak Farrokhi
 
Pitfalls of Object Oriented Programming by SONY
Pitfalls of Object Oriented Programming by SONYPitfalls of Object Oriented Programming by SONY
Pitfalls of Object Oriented Programming by SONYAnaya Medias Swiss
 
Kernel Recipes 2019 - Faster IO through io_uring
Kernel Recipes 2019 - Faster IO through io_uringKernel Recipes 2019 - Faster IO through io_uring
Kernel Recipes 2019 - Faster IO through io_uringAnne Nicolas
 
Sisteme de Operare: Introducere
Sisteme de Operare: IntroducereSisteme de Operare: Introducere
Sisteme de Operare: IntroducereAlexandru Radovici
 
Best practices for MySQL High Availability
Best practices for MySQL High AvailabilityBest practices for MySQL High Availability
Best practices for MySQL High AvailabilityColin Charles
 
Linux Kernel Module - For NLKB
Linux Kernel Module - For NLKBLinux Kernel Module - For NLKB
Linux Kernel Module - For NLKBshimosawa
 
Instrumenting the real-time web: Node.js in production
Instrumenting the real-time web: Node.js in productionInstrumenting the real-time web: Node.js in production
Instrumenting the real-time web: Node.js in productionbcantrill
 
Understanding Query Optimization with ‘regular’ and ‘Exadata’ Oracle
Understanding Query Optimization with ‘regular’ and ‘Exadata’ OracleUnderstanding Query Optimization with ‘regular’ and ‘Exadata’ Oracle
Understanding Query Optimization with ‘regular’ and ‘Exadata’ OracleGuatemala User Group
 
Intrinsics: Low-level engine development with Burst - Unite Copenhagen 2019
Intrinsics: Low-level engine development with Burst - Unite Copenhagen 2019 Intrinsics: Low-level engine development with Burst - Unite Copenhagen 2019
Intrinsics: Low-level engine development with Burst - Unite Copenhagen 2019 Unity Technologies
 
DB Time, Average Active Sessions, and ASH Math - Oracle performance fundamentals
DB Time, Average Active Sessions, and ASH Math - Oracle performance fundamentalsDB Time, Average Active Sessions, and ASH Math - Oracle performance fundamentals
DB Time, Average Active Sessions, and ASH Math - Oracle performance fundamentalsJohn Beresniewicz
 
Chapt 02 ia-32 processer architecture
Chapt 02   ia-32 processer architectureChapt 02   ia-32 processer architecture
Chapt 02 ia-32 processer architecturebushrakainat214
 
Linux Kernel Booting Process (1) - For NLKB
Linux Kernel Booting Process (1) - For NLKBLinux Kernel Booting Process (1) - For NLKB
Linux Kernel Booting Process (1) - For NLKBshimosawa
 

What's hot (20)

Lecture 2 process
Lecture 2   processLecture 2   process
Lecture 2 process
 
Process management
Process managementProcess management
Process management
 
Block I/O Layer Tracing: blktrace
Block I/O Layer Tracing: blktraceBlock I/O Layer Tracing: blktrace
Block I/O Layer Tracing: blktrace
 
Pitfalls of Object Oriented Programming by SONY
Pitfalls of Object Oriented Programming by SONYPitfalls of Object Oriented Programming by SONY
Pitfalls of Object Oriented Programming by SONY
 
Kernel Recipes 2019 - Faster IO through io_uring
Kernel Recipes 2019 - Faster IO through io_uringKernel Recipes 2019 - Faster IO through io_uring
Kernel Recipes 2019 - Faster IO through io_uring
 
CPU Verification
CPU VerificationCPU Verification
CPU Verification
 
Pipelining
PipeliningPipelining
Pipelining
 
Sisteme de Operare: Introducere
Sisteme de Operare: IntroducereSisteme de Operare: Introducere
Sisteme de Operare: Introducere
 
Best practices for MySQL High Availability
Best practices for MySQL High AvailabilityBest practices for MySQL High Availability
Best practices for MySQL High Availability
 
Linux Kernel Module - For NLKB
Linux Kernel Module - For NLKBLinux Kernel Module - For NLKB
Linux Kernel Module - For NLKB
 
Timer
TimerTimer
Timer
 
Instrumenting the real-time web: Node.js in production
Instrumenting the real-time web: Node.js in productionInstrumenting the real-time web: Node.js in production
Instrumenting the real-time web: Node.js in production
 
Understanding Query Optimization with ‘regular’ and ‘Exadata’ Oracle
Understanding Query Optimization with ‘regular’ and ‘Exadata’ OracleUnderstanding Query Optimization with ‘regular’ and ‘Exadata’ Oracle
Understanding Query Optimization with ‘regular’ and ‘Exadata’ Oracle
 
Intrinsics: Low-level engine development with Burst - Unite Copenhagen 2019
Intrinsics: Low-level engine development with Burst - Unite Copenhagen 2019 Intrinsics: Low-level engine development with Burst - Unite Copenhagen 2019
Intrinsics: Low-level engine development with Burst - Unite Copenhagen 2019
 
Introduction to OpenCL
Introduction to OpenCLIntroduction to OpenCL
Introduction to OpenCL
 
DB Time, Average Active Sessions, and ASH Math - Oracle performance fundamentals
DB Time, Average Active Sessions, and ASH Math - Oracle performance fundamentalsDB Time, Average Active Sessions, and ASH Math - Oracle performance fundamentals
DB Time, Average Active Sessions, and ASH Math - Oracle performance fundamentals
 
Chapt 02 ia-32 processer architecture
Chapt 02   ia-32 processer architectureChapt 02   ia-32 processer architecture
Chapt 02 ia-32 processer architecture
 
PCI Drivers
PCI DriversPCI Drivers
PCI Drivers
 
Linux Kernel Booting Process (1) - For NLKB
Linux Kernel Booting Process (1) - For NLKBLinux Kernel Booting Process (1) - For NLKB
Linux Kernel Booting Process (1) - For NLKB
 
Write miss
Write missWrite miss
Write miss
 

Similar to Fuzzing Boost Regex

LibreOffice oss-fuzz, crashtesting, coverity
LibreOffice oss-fuzz, crashtesting, coverityLibreOffice oss-fuzz, crashtesting, coverity
LibreOffice oss-fuzz, crashtesting, coverityCaolán McNamara
 
[Kiwicon 2011] Post Memory Corruption Memory Analysis
[Kiwicon 2011] Post Memory Corruption Memory Analysis[Kiwicon 2011] Post Memory Corruption Memory Analysis
[Kiwicon 2011] Post Memory Corruption Memory AnalysisMoabi.com
 
[CCC-28c3] Post Memory Corruption Memory Analysis
[CCC-28c3] Post Memory Corruption Memory Analysis[CCC-28c3] Post Memory Corruption Memory Analysis
[CCC-28c3] Post Memory Corruption Memory AnalysisMoabi.com
 
[HITB Malaysia 2011] Exploit Automation
[HITB Malaysia 2011] Exploit Automation[HITB Malaysia 2011] Exploit Automation
[HITB Malaysia 2011] Exploit AutomationMoabi.com
 
BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...
BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...
BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...Alexandre Moneger
 
MobileConf 2021 Slides: Let's build macOS CLI Utilities using Swift
MobileConf 2021 Slides:  Let's build macOS CLI Utilities using SwiftMobileConf 2021 Slides:  Let's build macOS CLI Utilities using Swift
MobileConf 2021 Slides: Let's build macOS CLI Utilities using SwiftDiego Freniche Brito
 
Auditing the Opensource Kernels
Auditing the Opensource KernelsAuditing the Opensource Kernels
Auditing the Opensource KernelsSilvio Cesare
 
[2012 CodeEngn Conference 06] beist - Everyone has his or her own fuzzer
[2012 CodeEngn Conference 06] beist - Everyone has his or her own fuzzer[2012 CodeEngn Conference 06] beist - Everyone has his or her own fuzzer
[2012 CodeEngn Conference 06] beist - Everyone has his or her own fuzzerGangSeok Lee
 
Code quality par Simone Civetta
Code quality par Simone CivettaCode quality par Simone Civetta
Code quality par Simone CivettaCocoaHeads France
 
Protocol T50: Five months later... So what?
Protocol T50: Five months later... So what?Protocol T50: Five months later... So what?
Protocol T50: Five months later... So what?Nelson Brito
 
[Ruxcon 2011] Post Memory Corruption Memory Analysis
[Ruxcon 2011] Post Memory Corruption Memory Analysis[Ruxcon 2011] Post Memory Corruption Memory Analysis
[Ruxcon 2011] Post Memory Corruption Memory AnalysisMoabi.com
 
ooc - A hybrid language experiment
ooc - A hybrid language experimentooc - A hybrid language experiment
ooc - A hybrid language experimentAmos Wenger
 
ooc - A hybrid language experiment
ooc - A hybrid language experimentooc - A hybrid language experiment
ooc - A hybrid language experimentAmos Wenger
 
Defcon 22-paul-mcmillan-attacking-the-iot-using-timing-attac
Defcon 22-paul-mcmillan-attacking-the-iot-using-timing-attacDefcon 22-paul-mcmillan-attacking-the-iot-using-timing-attac
Defcon 22-paul-mcmillan-attacking-the-iot-using-timing-attacPriyanka Aash
 
Peddle the Pedal to the Metal
Peddle the Pedal to the MetalPeddle the Pedal to the Metal
Peddle the Pedal to the MetalC4Media
 
Property-based testing an open-source compiler, pflua (FOSDEM 2015)
Property-based testing an open-source compiler, pflua (FOSDEM 2015)Property-based testing an open-source compiler, pflua (FOSDEM 2015)
Property-based testing an open-source compiler, pflua (FOSDEM 2015)Igalia
 
Secure Programming Practices in C++ (NDC Oslo 2018)
Secure Programming Practices in C++ (NDC Oslo 2018)Secure Programming Practices in C++ (NDC Oslo 2018)
Secure Programming Practices in C++ (NDC Oslo 2018)Patricia Aas
 
Skiron - Experiments in CPU Design in D
Skiron - Experiments in CPU Design in DSkiron - Experiments in CPU Design in D
Skiron - Experiments in CPU Design in DMithun Hunsur
 
PVS-Studio and static code analysis technique
PVS-Studio and static code analysis techniquePVS-Studio and static code analysis technique
PVS-Studio and static code analysis techniqueAndrey Karpov
 
Ceph Day Melbourne - Troubleshooting Ceph
Ceph Day Melbourne - Troubleshooting Ceph Ceph Day Melbourne - Troubleshooting Ceph
Ceph Day Melbourne - Troubleshooting Ceph Ceph Community
 

Similar to Fuzzing Boost Regex (20)

LibreOffice oss-fuzz, crashtesting, coverity
LibreOffice oss-fuzz, crashtesting, coverityLibreOffice oss-fuzz, crashtesting, coverity
LibreOffice oss-fuzz, crashtesting, coverity
 
[Kiwicon 2011] Post Memory Corruption Memory Analysis
[Kiwicon 2011] Post Memory Corruption Memory Analysis[Kiwicon 2011] Post Memory Corruption Memory Analysis
[Kiwicon 2011] Post Memory Corruption Memory Analysis
 
[CCC-28c3] Post Memory Corruption Memory Analysis
[CCC-28c3] Post Memory Corruption Memory Analysis[CCC-28c3] Post Memory Corruption Memory Analysis
[CCC-28c3] Post Memory Corruption Memory Analysis
 
[HITB Malaysia 2011] Exploit Automation
[HITB Malaysia 2011] Exploit Automation[HITB Malaysia 2011] Exploit Automation
[HITB Malaysia 2011] Exploit Automation
 
BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...
BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...
BSides LV 2016 - Beyond the tip of the iceberg - fuzzing binary protocols for...
 
MobileConf 2021 Slides: Let's build macOS CLI Utilities using Swift
MobileConf 2021 Slides:  Let's build macOS CLI Utilities using SwiftMobileConf 2021 Slides:  Let's build macOS CLI Utilities using Swift
MobileConf 2021 Slides: Let's build macOS CLI Utilities using Swift
 
Auditing the Opensource Kernels
Auditing the Opensource KernelsAuditing the Opensource Kernels
Auditing the Opensource Kernels
 
[2012 CodeEngn Conference 06] beist - Everyone has his or her own fuzzer
[2012 CodeEngn Conference 06] beist - Everyone has his or her own fuzzer[2012 CodeEngn Conference 06] beist - Everyone has his or her own fuzzer
[2012 CodeEngn Conference 06] beist - Everyone has his or her own fuzzer
 
Code quality par Simone Civetta
Code quality par Simone CivettaCode quality par Simone Civetta
Code quality par Simone Civetta
 
Protocol T50: Five months later... So what?
Protocol T50: Five months later... So what?Protocol T50: Five months later... So what?
Protocol T50: Five months later... So what?
 
[Ruxcon 2011] Post Memory Corruption Memory Analysis
[Ruxcon 2011] Post Memory Corruption Memory Analysis[Ruxcon 2011] Post Memory Corruption Memory Analysis
[Ruxcon 2011] Post Memory Corruption Memory Analysis
 
ooc - A hybrid language experiment
ooc - A hybrid language experimentooc - A hybrid language experiment
ooc - A hybrid language experiment
 
ooc - A hybrid language experiment
ooc - A hybrid language experimentooc - A hybrid language experiment
ooc - A hybrid language experiment
 
Defcon 22-paul-mcmillan-attacking-the-iot-using-timing-attac
Defcon 22-paul-mcmillan-attacking-the-iot-using-timing-attacDefcon 22-paul-mcmillan-attacking-the-iot-using-timing-attac
Defcon 22-paul-mcmillan-attacking-the-iot-using-timing-attac
 
Peddle the Pedal to the Metal
Peddle the Pedal to the MetalPeddle the Pedal to the Metal
Peddle the Pedal to the Metal
 
Property-based testing an open-source compiler, pflua (FOSDEM 2015)
Property-based testing an open-source compiler, pflua (FOSDEM 2015)Property-based testing an open-source compiler, pflua (FOSDEM 2015)
Property-based testing an open-source compiler, pflua (FOSDEM 2015)
 
Secure Programming Practices in C++ (NDC Oslo 2018)
Secure Programming Practices in C++ (NDC Oslo 2018)Secure Programming Practices in C++ (NDC Oslo 2018)
Secure Programming Practices in C++ (NDC Oslo 2018)
 
Skiron - Experiments in CPU Design in D
Skiron - Experiments in CPU Design in DSkiron - Experiments in CPU Design in D
Skiron - Experiments in CPU Design in D
 
PVS-Studio and static code analysis technique
PVS-Studio and static code analysis techniquePVS-Studio and static code analysis technique
PVS-Studio and static code analysis technique
 
Ceph Day Melbourne - Troubleshooting Ceph
Ceph Day Melbourne - Troubleshooting Ceph Ceph Day Melbourne - Troubleshooting Ceph
Ceph Day Melbourne - Troubleshooting Ceph
 

Recently uploaded

High Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur Escorts
High Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur EscortsHigh Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur Escorts
High Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur EscortsCall Girls in Nagpur High Profile
 
Sheet Pile Wall Design and Construction: A Practical Guide for Civil Engineer...
Sheet Pile Wall Design and Construction: A Practical Guide for Civil Engineer...Sheet Pile Wall Design and Construction: A Practical Guide for Civil Engineer...
Sheet Pile Wall Design and Construction: A Practical Guide for Civil Engineer...Dr.Costas Sachpazis
 
Introduction to IEEE STANDARDS and its different types.pptx
Introduction to IEEE STANDARDS and its different types.pptxIntroduction to IEEE STANDARDS and its different types.pptx
Introduction to IEEE STANDARDS and its different types.pptxupamatechverse
 
Architect Hassan Khalil Portfolio for 2024
Architect Hassan Khalil Portfolio for 2024Architect Hassan Khalil Portfolio for 2024
Architect Hassan Khalil Portfolio for 2024hassan khalil
 
Introduction to Multiple Access Protocol.pptx
Introduction to Multiple Access Protocol.pptxIntroduction to Multiple Access Protocol.pptx
Introduction to Multiple Access Protocol.pptxupamatechverse
 
(RIA) Call Girls Bhosari ( 7001035870 ) HI-Fi Pune Escorts Service
(RIA) Call Girls Bhosari ( 7001035870 ) HI-Fi Pune Escorts Service(RIA) Call Girls Bhosari ( 7001035870 ) HI-Fi Pune Escorts Service
(RIA) Call Girls Bhosari ( 7001035870 ) HI-Fi Pune Escorts Serviceranjana rawat
 
Gfe Mayur Vihar Call Girls Service WhatsApp -> 9999965857 Available 24x7 ^ De...
Gfe Mayur Vihar Call Girls Service WhatsApp -> 9999965857 Available 24x7 ^ De...Gfe Mayur Vihar Call Girls Service WhatsApp -> 9999965857 Available 24x7 ^ De...
Gfe Mayur Vihar Call Girls Service WhatsApp -> 9999965857 Available 24x7 ^ De...srsj9000
 
(MEERA) Dapodi Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Escorts
(MEERA) Dapodi Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Escorts(MEERA) Dapodi Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Escorts
(MEERA) Dapodi Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Escortsranjana rawat
 
What are the advantages and disadvantages of membrane structures.pptx
What are the advantages and disadvantages of membrane structures.pptxWhat are the advantages and disadvantages of membrane structures.pptx
What are the advantages and disadvantages of membrane structures.pptxwendy cai
 
SPICE PARK APR2024 ( 6,793 SPICE Models )
SPICE PARK APR2024 ( 6,793 SPICE Models )SPICE PARK APR2024 ( 6,793 SPICE Models )
SPICE PARK APR2024 ( 6,793 SPICE Models )Tsuyoshi Horigome
 
(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...ranjana rawat
 
APPLICATIONS-AC/DC DRIVES-OPERATING CHARACTERISTICS
APPLICATIONS-AC/DC DRIVES-OPERATING CHARACTERISTICSAPPLICATIONS-AC/DC DRIVES-OPERATING CHARACTERISTICS
APPLICATIONS-AC/DC DRIVES-OPERATING CHARACTERISTICSKurinjimalarL3
 
Model Call Girl in Narela Delhi reach out to us at 🔝8264348440🔝
Model Call Girl in Narela Delhi reach out to us at 🔝8264348440🔝Model Call Girl in Narela Delhi reach out to us at 🔝8264348440🔝
Model Call Girl in Narela Delhi reach out to us at 🔝8264348440🔝soniya singh
 
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...ranjana rawat
 
High Profile Call Girls Nagpur Isha Call 7001035870 Meet With Nagpur Escorts
High Profile Call Girls Nagpur Isha Call 7001035870 Meet With Nagpur EscortsHigh Profile Call Girls Nagpur Isha Call 7001035870 Meet With Nagpur Escorts
High Profile Call Girls Nagpur Isha Call 7001035870 Meet With Nagpur Escortsranjana rawat
 
Introduction and different types of Ethernet.pptx
Introduction and different types of Ethernet.pptxIntroduction and different types of Ethernet.pptx
Introduction and different types of Ethernet.pptxupamatechverse
 

Recently uploaded (20)

High Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur Escorts
High Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur EscortsHigh Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur Escorts
High Profile Call Girls Nagpur Meera Call 7001035870 Meet With Nagpur Escorts
 
Sheet Pile Wall Design and Construction: A Practical Guide for Civil Engineer...
Sheet Pile Wall Design and Construction: A Practical Guide for Civil Engineer...Sheet Pile Wall Design and Construction: A Practical Guide for Civil Engineer...
Sheet Pile Wall Design and Construction: A Practical Guide for Civil Engineer...
 
Introduction to IEEE STANDARDS and its different types.pptx
Introduction to IEEE STANDARDS and its different types.pptxIntroduction to IEEE STANDARDS and its different types.pptx
Introduction to IEEE STANDARDS and its different types.pptx
 
Exploring_Network_Security_with_JA3_by_Rakesh Seal.pptx
Exploring_Network_Security_with_JA3_by_Rakesh Seal.pptxExploring_Network_Security_with_JA3_by_Rakesh Seal.pptx
Exploring_Network_Security_with_JA3_by_Rakesh Seal.pptx
 
Architect Hassan Khalil Portfolio for 2024
Architect Hassan Khalil Portfolio for 2024Architect Hassan Khalil Portfolio for 2024
Architect Hassan Khalil Portfolio for 2024
 
Introduction to Multiple Access Protocol.pptx
Introduction to Multiple Access Protocol.pptxIntroduction to Multiple Access Protocol.pptx
Introduction to Multiple Access Protocol.pptx
 
(RIA) Call Girls Bhosari ( 7001035870 ) HI-Fi Pune Escorts Service
(RIA) Call Girls Bhosari ( 7001035870 ) HI-Fi Pune Escorts Service(RIA) Call Girls Bhosari ( 7001035870 ) HI-Fi Pune Escorts Service
(RIA) Call Girls Bhosari ( 7001035870 ) HI-Fi Pune Escorts Service
 
Gfe Mayur Vihar Call Girls Service WhatsApp -> 9999965857 Available 24x7 ^ De...
Gfe Mayur Vihar Call Girls Service WhatsApp -> 9999965857 Available 24x7 ^ De...Gfe Mayur Vihar Call Girls Service WhatsApp -> 9999965857 Available 24x7 ^ De...
Gfe Mayur Vihar Call Girls Service WhatsApp -> 9999965857 Available 24x7 ^ De...
 
(MEERA) Dapodi Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Escorts
(MEERA) Dapodi Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Escorts(MEERA) Dapodi Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Escorts
(MEERA) Dapodi Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Escorts
 
★ CALL US 9953330565 ( HOT Young Call Girls In Badarpur delhi NCR
★ CALL US 9953330565 ( HOT Young Call Girls In Badarpur delhi NCR★ CALL US 9953330565 ( HOT Young Call Girls In Badarpur delhi NCR
★ CALL US 9953330565 ( HOT Young Call Girls In Badarpur delhi NCR
 
What are the advantages and disadvantages of membrane structures.pptx
What are the advantages and disadvantages of membrane structures.pptxWhat are the advantages and disadvantages of membrane structures.pptx
What are the advantages and disadvantages of membrane structures.pptx
 
SPICE PARK APR2024 ( 6,793 SPICE Models )
SPICE PARK APR2024 ( 6,793 SPICE Models )SPICE PARK APR2024 ( 6,793 SPICE Models )
SPICE PARK APR2024 ( 6,793 SPICE Models )
 
DJARUM4D - SLOT GACOR ONLINE | SLOT DEMO ONLINE
DJARUM4D - SLOT GACOR ONLINE | SLOT DEMO ONLINEDJARUM4D - SLOT GACOR ONLINE | SLOT DEMO ONLINE
DJARUM4D - SLOT GACOR ONLINE | SLOT DEMO ONLINE
 
(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
(ANVI) Koregaon Park Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...
 
APPLICATIONS-AC/DC DRIVES-OPERATING CHARACTERISTICS
APPLICATIONS-AC/DC DRIVES-OPERATING CHARACTERISTICSAPPLICATIONS-AC/DC DRIVES-OPERATING CHARACTERISTICS
APPLICATIONS-AC/DC DRIVES-OPERATING CHARACTERISTICS
 
Model Call Girl in Narela Delhi reach out to us at 🔝8264348440🔝
Model Call Girl in Narela Delhi reach out to us at 🔝8264348440🔝Model Call Girl in Narela Delhi reach out to us at 🔝8264348440🔝
Model Call Girl in Narela Delhi reach out to us at 🔝8264348440🔝
 
Call Us -/9953056974- Call Girls In Vikaspuri-/- Delhi NCR
Call Us -/9953056974- Call Girls In Vikaspuri-/- Delhi NCRCall Us -/9953056974- Call Girls In Vikaspuri-/- Delhi NCR
Call Us -/9953056974- Call Girls In Vikaspuri-/- Delhi NCR
 
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
(SHREYA) Chakan Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Esc...
 
High Profile Call Girls Nagpur Isha Call 7001035870 Meet With Nagpur Escorts
High Profile Call Girls Nagpur Isha Call 7001035870 Meet With Nagpur EscortsHigh Profile Call Girls Nagpur Isha Call 7001035870 Meet With Nagpur Escorts
High Profile Call Girls Nagpur Isha Call 7001035870 Meet With Nagpur Escorts
 
Introduction and different types of Ethernet.pptx
Introduction and different types of Ethernet.pptxIntroduction and different types of Ethernet.pptx
Introduction and different types of Ethernet.pptx
 

Fuzzing Boost Regex

  • 1. Fuzzing: The New Unit Testing C++ Russia 2017, Moscow, Feb 25 Dmitry Vyukov, dvyukov@, Google
  • 2. Agenda ● What is fuzzing ● Coverage-guided fuzzing ● Small tutorial ● How to write effective fuzzers ● Fuzzing@Google
  • 3. What is Fuzzing? wikipedia.org/wiki/Fuzz_testing: Fuzz testing or fuzzing is a software testing technique, often automated or semi-automated, that involves providing invalid, unexpected, or random data to the inputs of a computer program.
  • 4. Who cares? - We are not testing/checking anything! - Random data will not trigger any bugs!
  • 5. Fuzzing can find lots of bugs - With the help of sanitizers: - Use-after-free, buffer overflows - Uses of uninitialized memory - Memory leaks - Data races, deadlocks - Int/float overflows, bitwise shifts by invalid amount (other UB) - Plain crashes: - NULL dereferences, uncaught exceptions, div-by-zero - Resource usage bugs: - Memory exhaustion, hangs or infinite loops, infinite recursion (stack overflows) - Logical bugs (lots of, see below)
  • 6. Data is not necessary "white noise" - There is number of tricks to generate "not so random" data - May or may not require some human help - If used correctly achieves very impressive code coverage
  • 7. What can be fuzzed? Anything that consumes complex inputs: ● Parsers of any kind (xml, json, asn.1, pdf, truetype, ...) ● Media codecs (audio, video, raster & vector images, etc) ● Network protocols (HTTP, RPC, SMTP, MIME...) ● Crypto (boringssl, openssl) ● Compression (zip, gzip, bzip2, brotli, ...) ● Formatted output (sprintf, template engines) ● Compilers and interpreters (Javascript, PHP, Perl, Python, Go, Clang, ...) ● Regular expression matchers (PCRE, RE2, libc’s regcomp) ● Text/UTF processing (icu) ● Databases (SQLite) ● Browsers, text editors/processors (Chrome, vim, OpenOffice) ● OS Kernels (Linux), drivers, supervisors and VMs Must have for everything that consumes untrusted inputs, open to internet or otherwise security sensitive.
  • 8. Types of Fuzzers - Grammar-based generation - Generate random inputs according to grammar rules - Peach, packetdrill, csmith, gosmith, syzkaller - Blind mutation - Requires a corpus of representative inputs, apply random mutations to them - ZZUF, Radamsa - Grammar reverse-engineering - Learn grammar from existing inputs using algorithmic approach of machine learning - Sequitur algorithm, go-fuzz - Symbolic execution + SAT solver - Synthesize inputs with maximum coverage using black magic - KLEE - Coverage-guided fuzzers - Genetic algorithm that strives to maximize code coverage - libFuzzer, AFL, honggfuzz, syzkaller - Hybrid
  • 9. Coverage-guided fuzzing Build the program with code coverage instrumentation; Collect initial corpus of inputs (optional); while (true) { Choose a random input from corpus and mutate it; Run the target program on the input, collect code coverage; If the input gives new coverage, add mutation back to the corpus; }
  • 10. Coverage-guiding in action if input[0] == '{' { if input[1] == 'i' && input[2] == 'f' { if input[3] == '(' { input[input[4]] = input[5]; // potential OOB write } } } Requires "{if(" input to crash, ~2^32 guesses to crack when blind. Coverage-guiding: Guess "{" in ~2^8, add to corpus. Guess "{i" in ~2^8, add to corpus. Guess "{if" in ~2^8, add to corpus. Guess "{if(" in ~2^8, add to corpus. Total: ~2^10 guesses. See: AFL: Pulling JPEGs out of thin air
  • 11. Mutations ● erase/insert/change/shuffle bit/byte/bytes ● crossover/splice 2 inputs ● insert token from a dictionary ● insert magic numbers (2^10±1, 2^16±1, 2^31±1, 2^32±1) ● change an ASCII integer (e.g. "123" => "2465357635") ● ...
  • 12. Coverage flavours Basic blocks: ... (A) if (...) { ... (B) } ... (C) -fsanitize-coverage=bb Edges: ... (A) if (...) { ... (B) } ... (C) -fsanitize-coverage=trace-pc-guard Gives better feedback signal. Counters: for (...) { ... (hit N times) } -fsanitize-coverage=8bit-counters Gives better feedback signal for loops and recursion.
  • 13. Cracking hashes What about more complex cases? if (*(uint32_t*)input == crc32(input+4, size-4)) {...} if (*(uint64_t*)input == 0xBCEBC041BADBALL) {...}
  • 14. Cracking hashes Intercept comparison operations: ● compiler intercepts int comparisons (-fsanitize-coverage=trace-cmp) ● runtime intercepts strcmp/memcmp and friends Several possibilities: ● extract int/string literals and insert them into inputs ● find one comparison operand in the input and replace with the other operand ● use PC^POPCNT(op1^op2) as "coverage" signal (Hamming distance)
  • 15. Dictionaries ● User-provided ○ e.g. for HTTP: "HTTP/1.1", "Host", "Accept-Encoding" ● Automatically extracted from program ○ memcpy(input, "HTTP/1.1", 8)
  • 16. Tutorial "...one of the most highly regarded and expertly designed C++ library projects in the world" boost.regex (latest version 1.63, in boost since 1.18)
  • 17. Tutorial: fuzzing function As simple as: int LLVMFuzzerTestOneInput(const uint8_t * Data, size_t Size) { try { std::string str((char*)Data, Size); boost::regex e( str); boost::match_results<std::string::const_iterator> what; boost::regex_match(str, what, e, boost::match_default); } catch (const std::exception&) {} return 0; }
  • 18. Tutorial: building (the hard part) 1. Build boost with coverage and AddressSanitizer: ./b2 cxxflags="-fsanitize-coverage=trace-pc-guard -fsanitize=address" toolset=clang install 2. Build fuzzer with coverage, AddressSanitizer and libFuzzer: clang++ fuzzer.cc -fsanitize-coverage=trace-pc-guard -fsanitize=address libFuzzer.a The rest is at tutorial.libfuzzer.info
  • 19. Demo
  • 20. 30 minutes, 13 bugs (ticket/12818): AddressSanitizer: heap-buffer-overflow perl_matcher.hpp:132 in re_skip_past_null AddressSanitizer: heap-buffer-overflow basic_regex_parser.hpp:2599 in parse_perl_extension AddressSanitizer: heap-buffer-overflow perl_matcher.hpp:221 in re_is_set_member AddressSanitizer: heap-buffer-overflow perl_matcher.hpp:166 in re_is_set_member AddressSanitizer: heap-buffer-overflow interceptors.inc:278 in strlen AddressSanitizer: stack-overflow basic_regex_creator.hpp:1054 in create_startmap AddressSanitizer: SEGV on unknown address 0x0000000016e0 MemorySanitizer: use-of-uninitialized-value perl_matcher.hpp:166 in re_is_set_member basic_regex_parser.hpp:904: runtime error: shift exponent 325804978 is too large for 32-bit type 'unsigned int' basic_regex_parser.hpp:2599: runtime error: load of value 56794092, which is not a valid value for type 'syntax_element_type' a.out: perl_matcher_common.hpp:606: Assertion `r.first != r.second' failed Direct leak of 4096 byte(s) in 1 object(s) allocated in get_mem_block regex.cpp:204 ALARM: working on the last Unit for 17 seconds Will find more when these are fixed! Results
  • 21. Finding logical bugs Not only security/stability - But we don't know the right result! - Use your imagination!
  • 22. Finding logical bugs ● sanity checks on results ○ uncompressesed image decoder: 100 byte input -> 100 MB output? ○ function returns both error and object, or no error and no object ○ know that some substring must present in output, but it is not ○ encrypt, check that decryption with wrong key fails ● sometimes we do know the right result ○ any sorting: check that each element is present, check that it's not descending ○ building a trie: check size, all elements are present ● asserts ○ assert(a == b)
  • 23. Finding logical bugs Round-trip: ● encode-decode ● serialize-deserialize ● compress-decompress ● encrypt-decrypt ● assemble-disassemble Checks: ● decode-encode: check that encode don't fail ● decode-encode-decode: check that second decode don't fail ● decode-encode-decode: check that decode results are equal ● encode-decode-encode: check that encode results are equal Very powerful technique.
  • 24. Finding logical bugs Comparing two (or more) implementations gives phenomenal results: ● check that output is equal ● or at least check that ok/fail result is the same ○ e.g. gcc and clang both accept or reject the code But I don't want to write the second impl! ● there can be several libraries implementing the same (libxmlFoo vs libxmlBar) ● implementation in a different language (re2 vs Go's regexp) ● compare "fast but complex" with "slow but dumb" (sometimes easy to write) ● compare different functions (marshalBinary vs marshalText)
  • 25. Quick Quiz: how to fuzz clang-format? clang-format: shuffles whitespaces in a source file. Let's imaging destiny of mankind depends on correctness of clang-format! How would you fuzz test it?
  • 26. Quick Quiz: how to fuzz clang-format? ● run with asan/msan/ubsan ● format twice, compare results (e.g. relies on unordered_map order) ● format, then format result (must be idempotent) ● strip all whitespaces, compare before/after ● check violations of max line length ● compile before/after (formatting breaks/unbreaks code)
  • 27. Regression testing Normally you run fuzzer for a long time. But any guided fuzzer accumulates corpus of inputs with max coverage. And that's perfect for regression testing! Just run it once on every change!
  • 28. Fuzzing@Google Why? - faster and faster development - more and more code - correctness is important - stability is still important - security is super important - want to move fast, but keep development costs under control Traditional testing is not enough anymore!
  • 29. Fuzzing@Google How? - Developers can write "fuzz tests" - picked up by automatic large-scale fuzzing system - but also work as regression unit tests - OSS-Fuzz: continuous fuzzing for OSS - 50+ projects, 190 fuzzers - libFuzzer, radamsa, AFL (coming) - 5000 cores - ClusterFuzz: automated fuzzing for Chromium - 350 fuzzers - libFuzzer, radamsa, AFL, custom fuzzers - 12000 cores - Automatically files bugs and verifies fixes - syzkaller: continuous fuzzing of Linux kernel - several upstream branches + android/chromeos - 100+ VMs + physical devices
  • 30. Fuzzing@Google ~15'000bugs GLIBC MUSL LIBC pugixml PCRE ICU Freetype ffmpeg Harfbuzz SQLite Python OpenSSL BoringSSL libxml2 BPF Capstone file Radare2 gRPC WOFF2 LLVM Tensorflow libav FreeType2 Foxit libtiff Go Linux libexif libFLAC Little CMS Adobe Reader Adobe Flash Player Adobe DNG SDK ESET NOD32 ClamAV BitDefender poppler ghostscript dcraw qcms libwebp libwebm libvpx gipfeli libots Snapseed Dart VM IJG libjpeg-turbo libpng mozjpeg PHP Firefox Internet Explorer Apple Safari LibreOffice GnuTLS GnuPG OpenSSH bash tcpdump JavaScriptCore pdfium libmatroska libarchive wireshark ImageMagick lcms libbpg lame libsndfile less lesspipe strings dpkg rcs systemd-resolved libyaml Info-Zip unzip libtasn pfctl mandoc IDA Pro clamav nasm ctags mutt procmail fontconfig pdksh wavpack redis cmsgpack taglib privoxy perl libxmpradare2 SleuthKit X.Org exifprobe jhead Xerces-C metacam exiv btrfs Knot DNS curl wpa_supplicant dnsmasq imlib2 libraw libwmf uudecode MuPDF libbson libsass boost
  • 31. Sales pitch ● Fuzzing is complimentary to any other testing technique ● Fuzzing is mandatory for anything security-related ● Fuzzing finds LOTS of bugs ● Fuzzing is easy to use Call to action: ● choose 1 library that uses complex inputs (important or you suspect for bugs) ● write a fuzzer ● run locally with ASAN