Mediaspace scheduled maintenance: Aug 25, 2026 07:00 - 12:00 AM. During this time, videos will be temporarily unavailable. Check status updates.

Concept

Fuzzing

Publications associées (29)

To Infinity, and Beyond (Coverage)

Ahmad Hazimeh

The pursuit of software security and reliability hinges on the identification and elimination of software vulnerabilities, a challenge compounded by the vast and evolving complexity of modern systems. Fuzzing has emerged as an indispensable technique for b ...

EPFL2024

FISHFUZZ: Catch Deeper Bugs by Throwing Larger Nets

Mathias Josef Payer, Flavio Toffalini, Han Zheng

Fuzzers effectively explore programs to discover bugs. Greybox fuzzers mutate seed inputs and observe their execution. Whenever a seed reaches new behavior (e.g., new code or higher execution frequency), it is stored for further mutation. Greybox fuzzers d ...

Usenix Assoc2023

Arvin: Greybox Fuzzing Using Approximate Dynamic CFG Analysis

Mathias Josef Payer

Fuzzing has emerged as the most broadly used testing technique to discover bugs. Effective fuzzers rely on coverage to prioritize inputs that exercise new program areas. Edge-based code coverage of the Program Under Test (PUT) is the most commonly used cov ...

ASSOC COMPUTING MACHINERY2023

GLeeFuzz: FuzzingWebGL Through Error Message Guided Mutation

Mathias Josef Payer

WebGL is a set of standardized JavaScript APIs for GPU accelerated graphics. Security of the WebGL interface is paramount because it exposes remote and unsandboxed access to the underlying graphics stack (including the native GL libraries and GPU drivers) ...

Usenix Assoc2023

DatAFLow: Toward a Data-Flow-Guided Fuzzer

Mathias Josef Payer

Coverage-guided greybox fuzzers rely on control-flow coverage feedback to explore a target program and uncover bugs. Compared to control-flow coverage, data-flow coverage offers a more fine-grained approximation of program behavior. Data-flow coverage capt ...

2023

TEEzz: Fuzzing Trusted Applications on COTS Android Devices

Mathias Josef Payer, Marcel Busch

Security and privacy-sensitive smartphone applications use trusted execution environments (TEEs) to protect sensitive operations from malicious code. By design, TEEs have privileged access to the entire system but expose little to no insight into their inn ...

IEEE COMPUTER SOC2023

AIFORE: Smart Fuzzing Based on Automatic Input Format Reverse Engineering

Mathias Josef Payer, Chunmin Zhang, Zhiyao Feng

Knowledge of a program's input format is essential for effective input generation in fuzzing. Automated input format reverse engineering represents an attractive but challenging approach to learning the format. In this paper, we address several challenges ...

Usenix Assoc2023

ACTOR: Action-Guided Kernel Fuzzing

Mathias Josef Payer

Fuzzing reliably and efficiently finds bugs in software, including operating system kernels. In general, higher code coverage leads to the discovery of more bugs. This is why most existing kernel fuzzers adopt strategies to generate a series of inputs that ...

Usenix Assoc2023

MINERVA: Browser API Fuzzing with Dynamic Mod-Ref Analysis

Mathias Josef Payer

Browser APIs are essential to the modern web experience. Due to their large number and complexity, they vastly expand the attack surface of browsers. To detect vulnerabilities in these APIs, fuzzers generate test cases with a large amount of random API inv ...

Assoc Computing Machinery2022

Seed Selection for Successful Fuzzing

Mathias Josef Payer

Mutation-based greybox fuzzing-unquestionably the most widely-used fuzzing technique-relies on a set of non-crashing seed inputs (a corpus) to bootstrap the bug-finding process. When evaluating a fuzzer, common approaches for constructing this corpus inclu ...

ASSOC COMPUTING MACHINERY2021

Gramatron: Effective Grammar-Aware Fuzzing

Mathias Josef Payer

Fuzzers aware of the input grammar can explore deeper program states using grammar-aware mutations. Existing grammar-aware fuzzers are ineffective at synthesizing complex bug triggers due to: (i) grammars introducing a sampling bias during input generation ...

ASSOC COMPUTING MACHINERY2021

New Reliability Assessment of MEMS Components under Accumulative Testing for Space Applications

Maxime Auchlin

This dissertation proposes a novel accumulative test method for MEMS-based, commercial off-the-shelves inertial measure units (IMUs) from the automotive field. The need for clarification and augmentation of the corpus of knowledge on MEMS reliability for s ...

EPFL2021

FuzzGen: Automatic Fuzzer Generation

Mathias Josef Payer

Fuzzing is a testing technique to discover unknown vulnerabilities in software. When applying fuzzing to libraries, the core idea of supplying random input remains unchanged, yet it is non-trivial to achieve good code coverage. Libraries cannot run as stan ...

USENIX ASSOC2020

FuZZan: Efficient Sanitizer Metadata Design for Fuzzing

Mathias Josef Payer

Fuzzing is one of the most popular and effective techniques for finding software bugs. To detect triggered bugs, fuzzers leverage a variety of sanitizers in practice. Unfortunately, sanitizers target long running experiments-e.g., developer test suites-not ...

USENIX ASSOC2020

USBFuzz: A Framework for Fuzzing USB Drivers by Device Emulation

Mathias Josef Payer

The Universal Serial Bus (USB) connects external devices to a host. This interface exposes the OS kernels and device drivers to attacks by malicious devices. Unfortunately, kernels and drivers were developed under a security model that implicitly trusts co ...

USENIX ASSOC2020

RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization

Mathias Josef Payer

Analyzing the security of closed source binaries is currently impractical for end-users, or even developers who rely on third-party libraries. Such analysis relies on automatic vulnerability discovery techniques, most notably fuzzing with sanitizers enable ...

IEEE COMPUTER SOC2020

Discover deeper bugs with dynamic symbolic execution and coverage-based fuzz testing

George Candea, Vitaly Chipounov

Coverage-based fuzz testing and dynamic symbolic execution are both popular program testing techniques. However, on their own, both techniques suffer from scalability problems when considering the complexity of modern software. Hybrid testing methods attem ...

INST ENGINEERING TECHNOLOGY-IET2018

Elastic Program Transformations : Automatically Optimizing the Reliability/Performance Trade-off in Systems Software

Jonas Benedict Wagner

Performance and reliability are important yet conflicting properties of systems software. Software today often crashes, has security vulnerabilities and data loss, while many techniques that could address such issues remain unused due to performance concer ...

EPFL2017

Improving systems software security through program analysis and instrumentation

Volodymyr Kuznetsov

Security and reliability bugs are prevalent in systems software. Systems code is often written in low-level languages like C/C++, which offer many benefits but also delegate memory management and type safety to programmers. This invites bugs that cause cra ...

EPFL2016

Improving Scalability of Symbolic Execution for Software with Complex Environment Interfaces

Stefan Bucur

Manual software testing is laborious and prone to human error. Yet, among practitioners, it is the most popular method for quality assurance. Automating the test case generation promises better effectiveness, especially for exposing corner-case bugs. Symbo ...

EPFL2015

Publications associées (29)