Date: Thu, 20 Nov 2014 13:34:31 +0100 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: Fuzzing project brainstorming Hi, Following the discussions here I feel this whole fuzzing thing could need a project to coordinate efforts and I will probably start something within the following days. I wanted to lay out my rough plans / brainstorming and welcome any feedback and especially if people have worries about such a project. * The core of the project will be a list of free software projects that in one way or another parse fileformats (I'll leave fuzzing network and other input out for now). It should have rough categories (ok = fuzzed and no unfixed issues in latest release, wip: fuzzed and issues are being worked on or already fixed in source repo, stale: fuzzed and issues don't seem to be worked on, unavalable = project with no developers to contact, wontfix = developers don't feel memory access issues and crashes need to be fixed / declare their product unsuitable for untrusted input, unknown = no known fuzzing efforts) I feel that it's important to make the limitation of this info transparent (e.g. about to change rapidly, always further /different fuzzing strategies that might turn up more issues, fuzzing is not a good indicator for overall security etc.). * A sharing place for stuff that might be useful for fuzzing, I think especially about patches that disable sanity checks (CRCs etc.) that make fuzzing harder. And maybe file collections with small example files for various file formats. * Some introduction tutorials that should give people with no fuzzing experience a starter. Preferrably so easy that everyone with some basic linux/unix knowledge can follow them. Explain zzuf, asan, afl. * All kinds of pointers/links to further information. Data and things like file archive should preferrably be public domain / cc0 to make data sharing as easy as possible. I welcome your feedback. I also welcome all reports (preferrably with links to public sources where this is documented - bugtrackers, mailing list archives etc.) of fuzzing. The good ("I fuzzed this for so long and it seems just nothing turned up") and the bad ("I found 10.000 unique crashers and reported them all upstream, nobody cares"). cu, -- Hanno Böck http://hboeck.de/ mail/jabber: hanno@...eck.de GPG: BBB51E42 Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.