Accelerating Modern Gre ybox Fuzzers
Computer scientist Elia Geretto optimised an important tool that helps secure software.
Program mes have vulnerabilities that can be used by an attacker to gain cont rol over the computers they run on. These are often simple mistakes t hat programmers have made when writing code. To eliminate them, secur ity experts review and test code to find and fix vulnerabilities. Exp erts often use tools that can partially automate this process, allowi ng them to explore more code with less effort.
Fuzzers<
/strong>
Computer scientist Elia Geretto's research focuses on i
mproving fuzzers, one such tool. Specifically, it makes them faster.
The core principle of a fuzzer is to give random input to a program a
nd see how it behaves. The speed of such a fuzzer is a very important
property, since a faster fuzzer can generate more random input and t
hus test the program more thoroughly.
The main conclusion Ge
retto can draw from his research is that the optimisations he propose
s for three specific types of fuzzers, namely snapshot fuzzers, hybri
d fuzzers and targeted fuzzers, increase their speed. Furthermore, he
has shown that the achieved speed increases result in fuzzers that c
an explore programmes more thoroughly. Finally, he shows that buildin
g fast fuzzers also helps to draw appropriate conclusions when evalua
ting other optimisations, because their effect varies with speed.
Phones and laptops
Geretto's research is impo
rtant for security researchers. His optimisations are all publicly av
ailable online and can be integrated into existing fuzzers to make th
em faster. These improved fuzzers will help security researchers to e
valuate code more thoroughly and thus reduce the number of vulnerabil
ities in released software.
Furthermore, fewer vulnerabilities in software means that the findings also have an impact on general us ers. Both the devices we use every day, such as phones and laptops, a nd the servers in the cloud that manage our data will become more sec ure.
Geretto's research can be roughly divided into four steps: first, he designed an optimisation that he thought could improve the speed of an existing fuzzer. Next, he implemented the optimisation b y writing code to modify that existing fuzzer. Then, he performed exp eriments to compare the performance of the fuzzer with and without th e optimisation. Finally, he analysed the collected data using statist ical methods to prove that his optimization did indeed improve the pe rformance of the fuzzer.
More information on the
DESCRIPTION: Computer scientist Elia Geretto optimised an impo rtant tool that helps secure software. Programmes have vulne rabilities that can be used by an attacker to gain control over the c omputers they run on. These are often simple mistakes that programmer s have made when writing code. To eliminate them, security experts re view and test code to find and fix vulnerabilities. Experts often use tools that can partially automate this process, allowing them to exp lore more code with less effort. Fuzzers