CSC 405 Introduction to Computer Security Fuzzing
|
|
|
- Sara Chase
- 6 years ago
- Views:
Transcription
1 CSC 405 Introduction to Computer Security Fuzzing Alexandros Kapravelos
2 Let s find some bugs (again) We have a potentially vulnerable program The program has some inputs which can be controlled by the attacker Can we generate automatic tests?
3 Fuzzing A form of vulnerability analysis Steps Generate random inputs and feed them to the program Monitor the application for any kinds of errors Simple technique Inefficient Input usually has a specific format, randomly generated inputs will be rejected Probability of causing a crash is very low
4 Standard HTML document <html></html> Example Randomized HTML <html>aaaaaaa</html> <html><></html> <html></html></html> <html>html</html> <html>/</<>></html>
5 Types of Fuzzers Mutation Based mutate existing data samples to create test data Generation Based define new tests based on models of the input Evolutionary Generate inputs based on response from program
6 Mutation Based Fuzzing Little or no knowledge of the structure of the inputs is assumed Anomalies are added to existing valid inputs Anomalies may be completely random or follow some heuristics Requires little to no setup time Dependent on the inputs being modified May fail for protocols with checksums, those which depend on challenge response, etc. Example Tools: Taof, GPF, ProxyFuzz, Peach Fuzzer, etc.
7 Fuzzing a pdf viewer Google for.pdf files (about 1,640,000,000 results) Crawl pages and build a pdf dataset Create a fuzzing tool that: Picks a PDF file Mutates the file Renders the PDF in the viewer Check if it crashes
8 Mutation Based Fuzzing East to setup and automate Little to no protocol knowledge required Limited to the initial dataset May fail on protocols with checksums, or other challenges
9 Generation-Based Fuzzing Generate random inputs with the input specification in mind (RFC, documentation, etc.) Add anomalies to each possible spot Knowledge of the protocol prunes inputs that would have been rejected by the application
10 Word (.doc) Binary File Format (576 pages)
11 Generation-Based Fuzzing Completeness Can deal with complex input, like checksums Input generator is labor intensive for complex protocols There has to be a specification
12 Evolutionary Fuzzing Attempts to generate inputs based on the response of the program Autodafe Fuzzing by weighting attacks with markers Open source Evolutionary Fuzzing System (EFS) Generates test cases based on code coverage metrics
13 Challenges Mutation based Enormous amount of generated inputs Can run forever Generation based Less inputs (we have more knowledge) Is it enough?
14 Code Coverage A metric of how well your code was tested Percent of code that was executed during analysis Profiling tools gcov Code coverage types: Line coverage which lines of source code have been executed Branch coverage which branches have been taken Path coverage which paths were taken
15 AddressSanitizer ClusterFuzz SyzyASAN ThreadSanitizer libfuzzer more... Fuzzing Chrome
16 Chrome s fuzzing infrastructure Automatically grab the most current Chrome LKGR (Last Known Good Revision) Hammer away at it to the tune of multi-million test cases a day Thousands of Chrome instances Hundreds of virtual machines
17 AddressSanitizer Compiler which performs instrumentation Run-time library that replaces malloc(), free(), etc custom malloc() allocates more bytes than requested and poisons the redzones around the region returned to the caller Heap buffer overrun/underrun (out-of-bounds access) Use after free Stack buffer overrun/underrun Chromium s browser_tests are about 20% slower
18 AddressSanitizer Results 10 months of testing the tool with Chromium (May 2011) 300 previously unknown bugs in the Chromium code and in third-party libraries 210 bugs were heap-use-after-free 73 were heap-buffer-overflow 8 global-buffer-overflow 7 stack-buffer-overflow 1 memcpy parameter overlap 1.73x performance penalty
19 SyzyASAN AddressSanitizer works only on Linux and Mac Different instrumenter that injects instrumentation into binaries produced by the Microsoft Visual Studio toolchain Run-time library that replaces malloc, free, et al. ~4.7x performance penalty
20 ThreadSanitizer Runtime data race detector based on binary translation Supports also compile-time instrumentation Greater speed and accuracy Data races in C++ and Go code Synchronization issues deadlocks unjoined threads destroying locked mutexes use of async-signal unsafe code in signal handlers Others ~5x-15x performance penalty
21 libfuzzer Engine for in-process, coverage-guided, whitebox fuzzing In-process don t launch a new process for every test case mutate inputs directly in memory Coverage-guided measure code coverage for every input accumulate test cases that increase overall coverage Whitebox compile-time instrumentation of the source code Fuzz individual components of Chrome don t need to generate an HTML page or network payload and launch the whole browser
22 libfuzzer ==9896==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62e at pc 0x c51 bp 0x7fffa0dc1450 sp 0x7fffa0dc0c00 WRITE of size at 0x62e thread T0 SCARINESS: 45 (multi-byte-write-heap-buffer-overflow) #0 0x499c50 in asan_memcpy #1 0x4e6b50 in Read third_party/woff2/src/buffer.h:86:7 #2 0x4e6b50 in ReconstructGlyf third_party/woff2/src/woff2_dec.cc:500 #3 0x4e6b50 in ReconstructFont third_party/woff2/src/woff2_dec.cc:917 #4 0x4e6b50 in woff2::convertwoff2tottf(unsigned char const*, unsigned long, woff2::woff2out*) third_party/woff2/src/woff2_dec.cc:1282 #5 0x4dbfd6 in LLVMFuzzerTestOneInput testing/libfuzzer/fuzzers/convert_woff2ttf_fuzzer.cc:15:3
23 Cluster Fuzzing ClusterFuzz uses the following memory debugging tools with libfuzzer-based fuzzers: AddressSanitizer (ASan): 500 GCE VMs MemorySanitizer (MSan): 100 GCE VMs UndefinedBehaviorSanitizer (UBSan): 100 GCE VMs
24 July 2016 (30 days of fuzzing) 14,366,371,459,772 unique test inputs 112 bugs filed
25 Analysis of the bugs found so far Source:
26 Chrome s Vulnerability Reward Program Submit your fuzzer Google will run it with ClusterFuzz Automatically nominate bugs they find for reward payments
27 Your Security Zen
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 16: Building Secure Software Department of Computer Science and Engineering University at Buffalo 1 Review A large number of software vulnerabilities various
CSE484/CSE584 BLACK BOX TESTING AND FUZZING. Dr. Benjamin Livshits
CSE484/CSE584 BLACK BOX TESTING AND FUZZING Dr. Benjamin Livshits Approaches to Finding Security Bugs 2 Runtime Monitoring Black-box Testing Static Analysis Fuzzing Basics 3 A form of vulnerability analysis
Copyright 2015 MathEmbedded Ltd.r. Finding security vulnerabilities by fuzzing and dynamic code analysis
Finding security vulnerabilities by fuzzing and dynamic code analysis Security Vulnerabilities Top code security vulnerabilities don t change much: Security Vulnerabilities Top code security vulnerabilities
Software Security IV: Fuzzing
1 Software Security IV: Fuzzing Chengyu Song Slides modified from Dawn Song 2 Administrivia Homework1 Due: Friday Oct 27 11:59pm Questions regarding reading materials Talk Security R&D in a Security Company:
Fast dynamic program analysis Race detection. Konstantin Serebryany May
Fast dynamic program analysis Race detection Konstantin Serebryany May 20 2011 Agenda Dynamic program analysis Race detection: theory ThreadSanitizer: race detector Making ThreadSanitizer
New features in AddressSanitizer. LLVM developer meeting Nov 7, 2013 Alexey Samsonov, Kostya Serebryany
New features in AddressSanitizer LLVM developer meeting Nov 7, 2013 Alexey Samsonov, Kostya Serebryany Agenda AddressSanitizer (ASan): a quick reminder New features: Initialization-order-fiasco Stack-use-after-scope
Fuzzing AOSP. AOSP for the Masses. Attack Android Right Out of the Box Dan Austin, Google. Dan Austin Google Android SDL Research Team
Fuzzing AOSP For the Masses AOSP for the Masses Attack Android Right Out of the Box Dan Austin, Google Dan Austin Google Android SDL Research Team Exploitation: Find the Needle Needles are Interesting
Dynamic code analysis tools
Dynamic code analysis tools Stewart Martin-Haugh (STFC RAL) Berkeley Software Technical Interchange meeting Stewart Martin-Haugh (STFC RAL) Dynamic code analysis tools 1 / 16 Overview Introduction Sanitizer
Automatic program generation for detecting vulnerabilities and errors in compilers and interpreters
Automatic program generation for detecting vulnerabilities and errors in compilers and interpreters 0368-3500 Nurit Dor Shir Landau-Feibish Noam Rinetzky Preliminaries Students will group in teams of 2-3
CS 161 Computer Security
Popa & Wagner Spring 2016 CS 161 Computer Security Homework 2 Due: Monday, February 22nd, at 11:59pm Instructions. This homework is due Monday, February 22nd, at 11:59pm. It must be submitted electronically
Browser Bug Hunting and Mobile
Hunting and Mobile About us COSEINC Formerly Red Hat Product Security Fedora Security Team ios Mobile Security OSS Security COSEINC Focused on Linux Kernel radare2 evangelist r2pipe node mantainer Whiskey
libfuzzer Kostya Serebryany May 2016
libfuzzer Kostya Serebryany May 2016 Dynamic Tools @ Google Sanitizers (dynamic bug detectors) AddressSanitizer (ASan) + LeakSanitizer (LSan) ThreadSanitizer (TSan) MemorySanitizer (MSan)
logistics: ROP assignment
bug-finding 1 logistics: ROP assignment 2 2013 memory safety landscape 3 2013 memory safety landscape 4 different design points memory safety most extreme disallow out of bounds usually even making out-of-bounds
Identifying Memory Corruption Bugs with Compiler Instrumentations. 이병영 ( 조지아공과대학교
Identifying Memory Corruption Bugs with Compiler Instrumentations 이병영 ( 조지아공과대학교 ) blee@gatech.edu @POC2014 How to find bugs Source code auditing Fuzzing Source Code Auditing Focusing on specific vulnerability
Fuzzing. compass-security.com 1
Fuzzing compass-security.com 1 Fuzzing Finding bugs by bombarding target with nonconform data Think: Flip a few bits in a PDF, then start Acrobat with that PDF Just more automated Steps: Create input corpus
WESTFÄLISCHE WILHELMS-UNIVERSITÄT MÜNSTER. Debugging C++ living knowledge WWU Münster
MÜNSTER Debugging C++ René Milk 15th October 2014 Debugging Stages MÜNSTER Debugging C++ 2 /19 Coding Testing Instrumentation Tools Bug prevention? MÜNSTER Debugging C++ 3 /19 defensive coding compile
CSC 591 Systems Attacks and Defenses Stack Canaries & ASLR
CSC 591 Systems Attacks and Defenses Stack Canaries & ASLR Alexandros Kapravelos akaprav@ncsu.edu How can we prevent a buffer overflow? Check bounds Programmer Language Stack canaries [...more ] Buffer
Applications. Cloud. See voting example (DC Internet voting pilot) Select * from userinfo WHERE id = %%% (variable)
Software Security Requirements General Methodologies Hardware Firmware Software Protocols Procedure s Applications OS Cloud Attack Trees is one of the inside requirement 1. Attacks 2. Evaluation 3. Mitigation
Overcoming Stagefright Integer Overflow Protections in Android
Overcoming Stagefright Integer Overflow Protections in Android Dan Austin (oblivion@google.com) May 2016 Agenda $ whoami Stagefright Sanitizers Sanitizers in Practice The Future $ whoami $ whoami Dan Austin
Juwei Lin. - Joined TrendMicro Since Windows Kernel/Rootkit/Bootkit - Ransomware Decryption - ios/android/mac Vulnerability Hunting
Juwei Lin - @panicaii - Joined TrendMicro Since 2013 - Windows Kernel/Rootkit/Bootkit - Ransomware Decryption - ios/android/mac Vulnerability Hunting Lilang Wu - @Lilang_Wu - Joined Trend Micro Since 2016
Black Hat Webcast Series. C/C++ AppSec in 2014
Black Hat Webcast Series C/C++ AppSec in 2014 Who Am I Chris Rohlf Leaf SR (Security Research) - Founder / Consultant BlackHat Speaker { 2009, 2011, 2012 } BlackHat Review Board Member http://leafsr.com
Enhancing Memory Error Detection for Large-Scale Applications and Fuzz testing
Enhancing Memory Error Detection for Large-Scale Applications and Fuzz testing Wookhyun Han, Byunggil Joe, Byoungyoung Lee *, Chengyu Song, Insik Shin KAIST, * Purdue, UCR 1 Memory error Heartbleed Shellshock
Taintscope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection
: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection Tielei Wang Tao Wei Guofei Gu Wei Zou March 12, 2014 is: A Fuzzing tool Checksum-Aware Directed Why a new fuzzing
Cs 645: Lecture 3 Software Security Defenses. Rachel Greenstadt April 18, 2012
Cs 645: Lecture 3 Software Security Defenses Rachel Greenstadt April 18, 2012 Reminders Project 1 due today (11:59 pm) Please send me your project 2 / research groups by the end of this week Project 2
Cs 475: Lecture 4 Software Security Defenses. Rachel Greenstadt April 21, 2015
Cs 475: Lecture 4 Software Security Defenses Rachel Greenstadt April 21, 2015 Reminders Don t forget to work on project 1 How are people doing? Midterm on May 5 Risk Analysis for Software Assets? Adversaries?
Low level security. Andrew Ruef
Low level security Andrew Ruef What s going on Stuff is getting hacked all the time We re writing tons of software Often with little regard to reliability let alone security The regulatory environment
Software Vulnerability
Software Vulnerability Refers to a weakness in a system allowing an attacker to violate the integrity, confidentiality, access control, availability, consistency or audit mechanism of the system or the
NEZHA: Efficient Domain-Independent Differential Testing
NEZHA: Efficient Domain-Independent Differential Testing Theofilos Petsios, Adrian Tang, Salvatore Stolfo, Angelos D. Keromytis and Suman Jana Department of Computer Science Columbia University, New York,
Computer Security Course. Midterm Review
Computer Security Course. Dawn Song Midterm Review In class: Logistics On time: 4:10-5:30pm Wed 1 8x11 page cheat sheet allowed Special requirements: see TA Part I, II, III Scope Software Security Secure
Security Testing. Ulf Kargén Department of Computer and Information Science (IDA) Division for Database and Information Techniques (ADIT)
Security Testing TDDC90 Software Security Ulf Kargén Department of Computer and Information Science (IDA) Division for Database and Information Techniques (ADIT) Security testing vs regular testing Regular
Beyond Stack Smashing: Recent Advances in Exploiting. Jonathan Pincus(MSR) and Brandon Baker (MS)
Beyond Stack Smashing: Recent Advances in Exploiting Buffer Overruns Jonathan Pincus(MSR) and Brandon Baker (MS) Buffer Overflows and How they Occur Buffer is a contiguous segment of memory of a fixed
Buffer Overflow Attacks
Buffer Overflow Attacks 1. Smashing the Stack 2. Other Buffer Overflow Attacks 3. Work on Preventing Buffer Overflow Attacks Smashing the Stack An Evil Function void func(char* inp){ } char buffer[16];
Computer Systems A Programmer s Perspective 1 (Beta Draft)
Computer Systems A Programmer s Perspective 1 (Beta Draft) Randal E. Bryant David R. O Hallaron August 1, 2001 1 Copyright c 2001, R. E. Bryant, D. R. O Hallaron. All rights reserved. 2 Contents Preface
KLEE Workshop Feeding the Fuzzers. with KLEE. Marek Zmysłowski MOBILE SECURITY TEAM R&D INSTITUTE POLAND
Feeding the Fuzzers with KLEE Marek Zmysłowski MOBILE SECURITY TEAM R&D INSTITUTE POLAND This presentation was created with help and commitment of the Samsung R&D Poland Mobile Security team. KLEE and
DEBUGGING: DYNAMIC PROGRAM ANALYSIS
DEBUGGING: DYNAMIC PROGRAM ANALYSIS WS 2017/2018 Martina Seidl Institute for Formal Models and Verification System Invariants properties of a program must hold over the entire run: integrity of data no
Improving Linux Development with better tools. Andi Kleen. Oct 2013 Intel Corporation
Improving Linux Development with better tools Andi Kleen Oct 2013 Intel Corporation ak@linux.intel.com Linux complexity growing Source lines in Linux kernel All source code 16.5 16 15.5 M-LOC 15 14.5 14
Praktische Aspekte der Informatik
Praktische Aspekte der Informatik Moritz Mühlhausen Prof. Marcus Magnor Optimization valgrind, gprof, and callgrind Further Reading Warning! The following slides are meant to give you a very superficial
Inject malicious code Call any library functions Modify the original code
Inject malicious code Call any library functions Modify the original code 2 Sadeghi, Davi TU Darmstadt 2012 Secure, Trusted, and Trustworthy Computing Chapter 6: Runtime Attacks 2 3 Sadeghi, Davi TU Darmstadt
Improving Linux development with better tools
Improving Linux development with better tools Andi Kleen Oct 2013 Intel Corporation ak@linux.intel.com Linux complexity growing Source lines in Linux kernel All source code 16.5 16 15.5 M-LOC 15 14.5 14
Verification & Validation of Open Source
Verification & Validation of Open Source 2011 WORKSHOP ON SPACECRAFT FLIGHT SOFTWARE Gordon Uchenick Coverity, Inc Open Source is Ubiquitous Most commercial and proprietary software systems have some open
Agenda. Introduction Why are we fuzzing? Types of existing fuzzers Fuzzing, process Adoption Risks Fuzzing costs Pulling it all together
Michael Eddington Agenda Introduction Why are we fuzzing? Types of existing fuzzers Fuzzing, process Adoption Risks Fuzzing costs Pulling it all together Why are we fuzzing? ROI^2! All about the bugs!
Dynamic Race Detection with LLVM Compiler
Dynamic Race Detection with LLVM Compiler Compile-time instrumentation for ThreadSanitizer Konstantin Serebryany, Alexander Potapenko, Timur Iskhodzhanov, and Dmitriy Vyukov OOO Google, 7 Balchug st.,
Bruce Merry. IOI Training Dec 2013
IOI Training Dec 2013 Outline 1 2 Outline 1 2 What is GDB? Tool that peeks inside your program Helps examine what is happening Helps trace crashes Integrated into Eclipse, some other IDEs GDB vs debug
Modeling and Discovering Vulnerabilities with Code Property Graphs
Modeling and Discovering Vulnerabilities with Code Property Graphs Fabian Yamaguchi, Nico Golde (Qualcomm), Daniel Arp, and Konrad Rieck Security & Privacy 2014 GEORG-AUGUST-UNIVERSITÄT GÖTTINGEN Implementation
CSE 509: Computer Security
CSE 509: Computer Security Date: 2.16.2009 BUFFER OVERFLOWS: input data Server running a daemon Attacker Code The attacker sends data to the daemon process running at the server side and could thus trigger
CAP6135: Programming Project 2 (Spring 2010)
CAP6135: Programming Project 2 (Spring 2010) This project is modified from the programming project 2 in Dr. Dawn Song s course CS161: computer security in Fall 2008: http://inst.eecs.berkeley.edu/~cs161/fa08/
Homework 3 CS161 Computer Security, Fall 2008 Assigned 10/07/08 Due 10/13/08
Homework 3 CS161 Computer Security, Fall 2008 Assigned 10/07/08 Due 10/13/08 For your solutions you should submit a hard copy; either hand written pages stapled together or a print out of a typeset document
Advanced Debugging and the Address Sanitizer
Developer Tools #WWDC15 Advanced Debugging and the Address Sanitizer Finding your undocumented features Session 413 Mike Swingler Xcode UI Infrastructure Anna Zaks LLVM Program Analysis 2015 Apple Inc.
finding vulnerabilities
cs6 42 computer security finding vulnerabilities adam everspaugh ace@cs.wisc.edu hw1 Homework 1 will be posted after class today Due: Feb 22 Should be fun! TAs can help with setup Use Piazza as first step
Introduction to Concurrent Software Systems. CSCI 5828: Foundations of Software Engineering Lecture 08 09/17/2015
Introduction to Concurrent Software Systems CSCI 5828: Foundations of Software Engineering Lecture 08 09/17/2015 1 Goals Present an overview of concurrency in software systems Review the benefits and challenges
Simple Overflow. #include <stdio.h> int main(void){ unsigned int num = 0xffffffff;
Simple Overflow 1 #include int main(void){ unsigned int num = 0xffffffff; printf("num is %d bits long\n", sizeof(num) * 8); printf("num = 0x%x\n", num); printf("num + 1 = 0x%x\n", num + 1); }
Enhancing Memory Error Detection for Larg e-scale Applications and Fuzz testing
Enhancing Memory Error Detection for Larg e-scale Applications and Fuzz testing Wookhyun Han, Byunggil Joe, Byoungyoung Lee *, C hengyu Song, Insik Shin KAIST, * Purdue, UCR 1 Memory error Heartbleed Shellshock
Lecture Notes: Unleashing MAYHEM on Binary Code
Lecture Notes: Unleashing MAYHEM on Binary Code Rui Zhang February 22, 2017 1 Finding Exploitable Bugs 1.1 Main Challenge in Exploit Generation Exploring enough of the state space of an application to
Preventing Use-after-free with Dangling Pointers Nullification
Preventing Use-after-free with Dangling Pointers Nullification Byoungyoung Lee, Chengyu Song, Yeongjin Jang Tielei Wang, Taesoo Kim, Long Lu, Wenke Lee Georgia Institute of Technology Stony Brook University
CNIT 127: Exploit Development. Ch 18: Source Code Auditing. Updated
CNIT 127: Exploit Development Ch 18: Source Code Auditing Updated 4-10-17 Why Audit Source Code? Best way to discover vulnerabilities Can be done with just source code and grep Specialized tools make it
ROBUST AND SECURE APPLICATION CODE THROUGH ANALYSIS. Dr. Benjamin Livshits
ROBUST AND SECURE APPLICATION CODE THROUGH ANALYSIS Dr. Benjamin Livshits 2 Cost of Fixing a Defect 3 How Do We Find Bugs? 4 Static Analysis Static code analysis toos Coverity Tools from Microsoft like
ECS 153 Discussion Section. April 6, 2015
ECS 153 Discussion Section April 6, 2015 1 What We ll Cover Goal: To discuss buffer overflows in detail Stack- based buffer overflows Smashing the stack : execution from the stack ARC (or return- to- libc)
Software Vulnerabilities August 31, 2011 / CS261 Computer Security
Software Vulnerabilities August 31, 2011 / CS261 Computer Security Software Vulnerabilities...1 Review paper discussion...2 Trampolining...2 Heap smashing...2 malloc/free...2 Double freeing...4 Defenses...5
Introduction to Concurrent Software Systems. CSCI 5828: Foundations of Software Engineering Lecture 12 09/29/2016
Introduction to Concurrent Software Systems CSCI 5828: Foundations of Software Engineering Lecture 12 09/29/2016 1 Goals Present an overview of concurrency in software systems Review the benefits and challenges
Structure-aware fuzzing
Structure-aware fuzzing for real-world projects Réka Kovács Eötvös Loránd University, Hungary rekanikolett@gmail.com 1 Overview tutorial, no groundbreaking discoveries Motivation growing code size -> growing
2 Sadeghi, Davi TU Darmstadt 2012 Secure, Trusted, and Trustworthy Computing Chapter 6: Runtime Attacks
Runtime attacks are major threats to today's applications Control-flow of an application is compromised at runtime Typically, runtime attacks include injection of malicious code Reasons for runtime attacks
Using Intel VTune Amplifier XE and Inspector XE in.net environment
Using Intel VTune Amplifier XE and Inspector XE in.net environment Levent Akyil Technical Computing, Analyzers and Runtime Software and Services group 1 Refresher - Intel VTune Amplifier XE Intel Inspector
ECE 471 Embedded Systems Lecture 22
ECE 471 Embedded Systems Lecture 22 Vince Weaver http://www.eece.maine.edu/~vweaver vincent.weaver@maine.edu 31 October 2018 Don t forget HW#7 Announcements 1 Computer Security and why it matters for embedded
Buffer overflow background
and heap buffer background Comp Sci 3600 Security Heap Outline and heap buffer Heap 1 and heap 2 3 buffer 4 5 Heap Outline and heap buffer Heap 1 and heap 2 3 buffer 4 5 Heap Address Space and heap buffer
Introduction into browser hacking. Andrey Kovalev
Introduction into browser hacking Andrey Kovalev (@L1kvID) Who am I Security Engineer at Yandex Browser security enthusiast Public speaker (every ZeroNights since 2015) Author of @br0wsec channel (https://t.me/br0wsec)!3
Static Analysis in Practice
in Practice 15-313: Foundations of Software Engineering Jonathan Aldrich 1 Outline: in Practice Case study: Analysis at ebay Case study: Analysis at Microsoft Analysis Results and Process Example: Standard
Scientific Programming in C IX. Debugging
Scientific Programming in C IX. Debugging Susi Lehtola 13 November 2012 Debugging Quite often you spend an hour to write a code, and then two hours debugging why it doesn t work properly. Scientific Programming
Static Analysis and Bugfinding
Static Analysis and Bugfinding Alex Kantchelian 09/12/2011 Last week we talked about runtime checking methods: tools for detecting vulnerabilities being exploited in deployment. So far, these tools have
typedef void (*type_fp)(void); int a(char *s) { type_fp hf = (type_fp)(&happy_function); char buf[16]; strncpy(buf, s, 18); (*hf)(); return 0; }
![typedef void (*type_fp)(void); int a(char *s) { type_fp hf = (type_fp)(&happy_function); char buf[16]; strncpy(buf, s, 18); (*hf)(); return 0; }](/thumbs/82/86078968.jpg "typedef void (*type_fp)(void); int a(char *s) { type_fp hf = (type_fp)(&happy_function); char buf[16]; strncpy(buf, s, 18); (*hf)(); return 0; }")
Dawn Song Fall 2012 CS 161 Computer Security Practice Questions 1. (6 points) Control Hijacking Indicate whether the statement is always valid. Indicate true or false, and give a one sentence explanation.
Overview AEG Conclusion CS 6V Automatic Exploit Generation (AEG) Matthew Stephen. Department of Computer Science University of Texas at Dallas
CS 6V81.005 Automatic Exploit Generation (AEG) Matthew Stephen Department of Computer Science University of Texas at Dallas February 20 th, 2012 Outline 1 Overview Introduction Considerations 2 AEG Challenges
Analysis/Bug-finding/Verification for Security
Analysis/Bug-finding/Verification for Security VIJAY GANESH University of Waterloo Winter 2013 Analysis/Test/Verify for Security Instrument code for testing Heap memory: Purify Perl tainting (information
Runtime Defenses against Memory Corruption
CS 380S Runtime Defenses against Memory Corruption Vitaly Shmatikov slide 1 Reading Assignment Cowan et al. Buffer overflows: Attacks and defenses for the vulnerability of the decade (DISCEX 2000). Avijit,
Introduction to Computer Systems
CS-213 Introduction to Computer Systems Yan Chen Topics: Staff, text, and policies Lecture topics and assignments Lab rationale CS 213 F 06 Teaching staff Instructor TA Prof. Yan Chen (Thu 2-4pm, Tech
Honours/Master/PhD Thesis Projects Supervised by Dr. Yulei Sui
Honours/Master/PhD Thesis Projects Supervised by Dr. Yulei Sui Projects 1 Information flow analysis for mobile applications 2 2 Machine-learning-guide typestate analysis for UAF vulnerabilities 3 3 Preventing
Enterprise Architect. User Guide Series. Profiling
Enterprise Architect User Guide Series Profiling Investigating application performance? The Sparx Systems Enterprise Architect Profiler finds the actions and their functions that are consuming the application,
Enterprise Architect. User Guide Series. Profiling. Author: Sparx Systems. Date: 10/05/2018. Version: 1.0 CREATED WITH
Enterprise Architect User Guide Series Profiling Author: Sparx Systems Date: 10/05/2018 Version: 1.0 CREATED WITH Table of Contents Profiling 3 System Requirements 8 Getting Started 9 Call Graph 11 Stack
Programming in C. Lecture 9: Tooling. Dr Neel Krishnaswami. Michaelmas Term
Programming in C Lecture 9: Tooling Dr Neel Krishnaswami Michaelmas Term 2017-2018 1 / 24 Undefined and Unspecified Behaviour 2 / 24 Undefined and Unspecified Behaviour We have seen that C is an unsafe
Infecting the Embedded Supply Chain
SESSION ID: PDAC-F01 Infecting the Embedded Supply Chain Zach Miller Security Researcher in8 Solutions (Formerly Somerset Recon) @bit_twidd1er Inspiration Inspiration Countless embedded devices exist Each
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 15: Software Security II Department of Computer Science and Engineering University at Buffalo 1 Software Vulnerabilities Buffer overflow vulnerabilities account
CPSC 213. Introduction to Computer Systems. Procedures and the Stack. Unit 1e
CPSC 213 Introduction to Computer Systems Unit 1e Procedures and the Stack 1 Readings for Next 3 Lectures Textbook Procedures - 3.7 Out-of-Bounds Memory References and Buffer Overflow - 3.12 2 Local Variables
Reverse Engineering. Class 6. Fuzzing. Reverse Engineering Class 6 Martin Balao martin.uy/reverse v1.0 EN CC BY-SA
Reverse Engineering Class 6 Fuzzing 1 Fuzzing Grey box testing May be guided by reverse engineering Send, in an automatized way, valid and invalid inputs to an application with the goal of triggering bad
CPSC 213. Introduction to Computer Systems. Procedures and the Stack. Unit 1e
CPSC 213 Introduction to Computer Systems Unit 1e Procedures and the Stack 1 Reading Companion 2.8 Textbook Procedures, Out-of-Bounds Memory References and Buffer Overflows 3.7, 3.12 2 Local Variables
CPSC 213. Introduction to Computer Systems. Procedures and the Stack. Unit 1e
CPSC 213 Introduction to Computer Systems Unit 1e Procedures and the Stack Readings for Next 3 Lectures Textbook Procedures - 3.7 Out-of-Bounds Memory References and Buffer Overflow - 3.12 Local Variables
SmartHeap for Multi-Core
SmartHeap for Multi-Core Getting Started and Platform Guide for Linux Version 11.2 SmartHeap and HeapAgent are trademarks of Compuware Corporation. All other trademarks are the property of their respective
Finding media bugs in Android using file format fuzzing. Costel Maxim Intel OTC Security
Finding media bugs in Android using file format fuzzing Costel Maxim Intel OTC Security 1 Agenda File format fuzzing Generate high-quality corpus of files Fuzzing the Stagefright Framework Logging & Triage
In-Memory Fuzzing in JAVA
Your texte here. In-Memory Fuzzing in JAVA 2012.12.17 Xavier ROUSSEL Summary I. What is Fuzzing? Your texte here. Introduction Fuzzing process Targets Inputs vectors Data generation Target monitoring Advantages
It was a dark and stormy night. Seriously. There was a rain storm in Wisconsin, and the line noise dialing into the Unix machines was bad enough to
1 2 It was a dark and stormy night. Seriously. There was a rain storm in Wisconsin, and the line noise dialing into the Unix machines was bad enough to keep putting garbage characters into the command
C/C++ toolchain. Static and dynamic code analysis. Karel Kubíček. Masaryk University. Brno, Czech Republic
C/C++ toolchain Static and dynamic code analysis Karel Kubíček Masaryk University Brno, Czech Republic April 20, 2018 Questions Who uses C/C++? Karel Kubíček C/C++ toolchain April 20, 2018 2 / 12 Questions
CIS 551 / TCOM 401 Computer and Network Security. Spring 2007 Lecture 2
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 2 Announcements First project is on the web Due: Feb. 1st at midnight Form groups of 2 or 3 people If you need help finding a group,
How to implement SDL and don t turn gray. Andrey Kovalev, Security Engineer
How to implement SDL and don t turn gray Andrey Kovalev, Security Engineer Agenda SDL 101 Yandex approach SAST, DAST, FSR: drawbacks and solutions Summary 3 How to implement SDL and don t turn gray SDL
Automatically Finding Patches Using Genetic Programming. Westley Weimer, Claire Le Goues, ThanVu Nguyen, Stephanie Forrest
Automatically Finding Patches Using Genetic Programming Westley Weimer, Claire Le Goues, ThanVu Nguyen, Stephanie Forrest Motivation Software Quality remains a key problem Over one half of 1 percent of
Software security, secure programming
Software security, secure programming Fuzzing and Dynamic Analysis Master on Cybersecurity Master MoSiG Academic Year 2017-2018 Outline Fuzzing (or how to cheaply produce useful program inputs) A concrete
HexType: Efficient Detection of Type Confusion Errors for C++ Yuseok Jeon Priyam Biswas Scott A. Carr Byoungyoung Lee Mathias Payer
HexType: Efficient Detection of Type Confusion Errors for C++ Yuseok Jeon Priyam Biswas Scott A. Carr Byoungyoung Lee Mathias Payer Motivation C++ is a popular programming language Google Chrome, Firefox,
Finding Bugs Using Xcode Runtime Tools
Session Developer Tools #WWDC17 Finding Bugs Using Xcode Runtime Tools 406 Kuba Mracek, Program Analysis Engineer Vedant Kumar, Compiler Engineer 2017 Apple Inc. All rights reserved. Redistribution or
PostgreSQL as a benchmarking tool
PostgreSQL as a benchmarking tool How it was used to check and improve the scalability of the DragonFly operating system François Tigeot ftigeot@wolfpond.org 1/21 About Me Independent consultant, sysadmin
Automatizing vulnerability research
Innova&on & Research Symposium Cisco and Ecole Polytechnique 8-9 April 2018 CEDRIC TESSIER INSTRUMENTATION TEAM LEADER / ctessier@quarkslab.com Automatizing vulnerability research to better face new software
Security Testing. John Slankas
Security Testing John Slankas jbslanka@ncsu.edu Course Slides adapted from OWASP Testing Guide v4 CSC 515 Software Security What is Security Testing? Validate security controls operate as expected What
How to Sandbox IIS Automatically without 0 False Positive and Negative
How to Sandbox IIS Automatically without 0 False Positive and Negative Professor Tzi-cker Chiueh Computer Science Department Stony Brook University chiueh@cs.sunysb.edu 1/10/06 Blackhat Federal 2006 1
Sandboxing. CS-576 Systems Security Instructor: Georgios Portokalidis Spring 2018
Sandboxing CS-576 Systems Security Instructor: Georgios Portokalidis Sandboxing Means Isolation Why? Software has bugs Defenses slip Untrusted code Compartmentalization limits interference and damage!
Advanced Systems Security: New Threats
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security: