Fuzzing And Oracles By: Thomas Sidoti

Overview Introduction Motivation Fuzzable Exploits Oracles Implementation Fuzzing Results

Introduction Find relationships between Oracles and Exploits/Errors. What class of errors could a particular oracles hope to find?

Motivation Fuzzers: –Generate Input –Watch for errors Without good oracles, some errors will never be found.

Fuzzable Exploits Buffer Overflow Improper Validation of Array Index Integer Overflow Incorrect Calc of Buffer Size From the CWE Top 25

Available Oracles Process Crash Output Monitoring Memory Monitoring Monitoring Services Program Flow Monitoring (PaiMei)

Fuzzable Created a program with optional exploits available. Flags –b : Heap Buffer Overflow –m : Calculated Memory Size Not Checked –s : Stack Buffer Overflow (and small version) –i : Integer Overflow (Multiplication) –a : Calculated Array Index Not Checked (and small version)

File Format 10 - Number of Lines 30 - Chars per Line 1 st Line 2 nd Line ……………… Nth Line 9 - Get the xth Line 5 - The yth character from

Analysis of Open Source Fuzzers Open Source Fuzzing Software is difficult to use. –Evolution Fuzzing System did not appear to do anything. –FileFuzz crashes when program under test crashes. –Modified FileP to make it usable. Most don’t include robust oracles. –Peach Fuzzer is the exception.

Results: Oracle-less Fuzzers FileP, FileFuzz –Random fuzzer based on a Sample File. Fuzzled –Set of factories which makes it easy for a programmer to generate input. Detects Program Crashes –All large errors

Results: Peach Fuzzer Oracles: Windows Debugger, Memory Monitor, Page Heap Debugging, etc. Page Heap debugging found small heap space address miscalculation. Memory Monitor found small excess in memory usage. (This flaw could also crash the program in Windows)

Conclusion A good portion of errors can be found even if only depending on program crash. Output monitoring may work well if tailored to your program Using more advanced debugging techniques while debugging will reveal more subtle errors.

Thanks