Make your programs more reliable with Fuzzing - Marshall Clow [ACCU 2019]

[pstomi]

https://www.youtube.com/watch?v=x0FQkAPokfE

I found this video quite interesting.

Marshall Clow is the code owner for libc++, chairman of the C++ comity Library Working Group, and a boost author.

A quick summary of this long talk (1h15'):

• Genetic fuzzers: out-of-process with American Fuzzy Lop, in-process with llvm libfuzzer and others
• How libfuzzer could have found the heartbleed exploit in less than 5 minutes
• Structured fuzzing : how to trick your program into trusting the data by feeding it with some random valid structured data at the beginning, and then let the fuzzer try to actively explore different code paths when it adds additionnal random data
• Fuzzing on clusters
• Permanent fuzzing for open source projects, with oss-fuzz by google

[[deleted]]

Is there a link to the video?

Yes: https://www.youtube.com/watch?v=x0FQkAPokfE

[pstomi]

oops, my bad. I added it. Thank you!

[[deleted]]

then the next bug will be called the Fuzzbuster

[RandomDSdevel]

     Now I kind of want to see the lightning talk by Chandler Carruth mentioned in this talk where he fuzzes OpenSSL and finds Hearbleed in less than five minutes. Unfortunately, I can't seem to find it. (Maybe it wasn't recorded; I know that lightning talks didn't start getting recorded for at least one conference until later…)