[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 20 Nov 2014 13:34:31 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Fuzzing project brainstorming
Hi,
Following the discussions here I feel this whole fuzzing thing could
need a project to coordinate efforts and I will probably start
something within the following days.
I wanted to lay out my rough plans / brainstorming and welcome any
feedback and especially if people have worries about such a project.
* The core of the project will be a list of free software projects that
in one way or another parse fileformats (I'll leave fuzzing network
and other input out for now). It should have rough categories (ok =
fuzzed and no unfixed issues in latest release, wip: fuzzed and issues
are being worked on or already fixed in source repo, stale: fuzzed and
issues don't seem to be worked on, unavalable = project with no
developers to contact, wontfix = developers don't feel memory access
issues and crashes need to be fixed / declare their product
unsuitable for untrusted input, unknown = no known fuzzing efforts)
I feel that it's important to make the limitation of this info
transparent (e.g. about to change rapidly, always further /different
fuzzing strategies that might turn up more issues, fuzzing is not a
good indicator for overall security etc.).
* A sharing place for stuff that might be useful for fuzzing, I think
especially about patches that disable sanity checks (CRCs etc.) that
make fuzzing harder. And maybe file collections with small example
files for various file formats.
* Some introduction tutorials that should give people with no fuzzing
experience a starter. Preferrably so easy that everyone with some
basic linux/unix knowledge can follow them. Explain zzuf, asan, afl.
* All kinds of pointers/links to further information.
Data and things like file archive should preferrably be public domain
/ cc0 to make data sharing as easy as possible.
I welcome your feedback. I also welcome all reports (preferrably with
links to public sources where this is documented - bugtrackers, mailing
list archives etc.) of fuzzing. The good ("I fuzzed this for so long
and it seems just nothing turned up") and the bad ("I found 10.000
unique crashers and reported them all upstream, nobody cares").
cu,
--
Hanno Böck
http://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: BBB51E42
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
