Fuzzing

Question 1

How does fuzzing work?

Answer 1

Check for software vulnerabilities through dynamic testing:

• automatically generate so-called fuzz test cases
• monitor target program for security-related bugs

Question 2

Name the three different classes of fuzzing

Answer 2

• black-box fuzzing: check if a fuzz test crashed the target program
• white-box fuzzing: use heavyweight program and runtime analysis
• grey-box fuzzing: use lightweight analysis techniques such as code coverage

Question 3

What different input generation techniques are there?

Answer 3

• Random generation
• Model-based input generation (either predefined or inferred model: specification mining)
• Mutation-based Input Generation (start with initial kernel of valid seed inputs, use mutation operators: bit-flipping, arithmetic / block-based dictionary based, crossover)

Question 4

How does execution monitoring work?

Answer 4

When does a fuzz test violate security policy?

• termination with a fatal signal
• many memory errors automatically detected by OS
• sanitizers can find more errors: address sanitizers, UB sanitizers, thread sanitizers