Fuzzing, or fuzz testing, is an automated software testing technique that supplies invalid, unexpected, or random data (fuzz) to a computer program to detect vulnerabilities like crashes, code assertion failures, or memory leaks. It's particularly useful for testing programs that process structured inputs, such as file formats or network protocols, by generating semi-valid inputs that are accepted by the parser but can cause unexpected behavior in the program, revealing unhandled corner cases.

The concept of fuzzing originated from a 1988 class project led by Prof. Barton Miller at the University of Wisconsin. The project aimed to test the reliability of UNIX utilities by feeding them random inputs. This early form of fuzzing, which generated inputs without any knowledge about the program's structure, is now referred to as black box, generational, or dumb fuzzing.

Over the years, fuzzing has evolved and can be categorized based on its knowledge of the program's input structure (smart vs. dumb) and its awareness of the program's internal structure (white, grey, or black-box). Smart fuzzers generate inputs based on models of valid input formats, while dumb fuzzers generate inputs without such knowledge. White-box fuzzers analyze the program's source code to generate inputs, grey-box fuzzers use some form of instrumentation to observe program behavior, and black-box fuzzers operate without any knowledge of the program's internals.

Fuzzing has been instrumental in identifying vulnerabilities in critical software components, including widely used protocols and applications. Notable examples include the discovery of the Heartbleed vulnerability in OpenSSL and numerous bugs in web browsers through projects like Google's ClusterFuzz. It has also been used in high-profile security competitions, such as the DARPA Cyber Grand Challenge, to automatically find and patch vulnerabilities in software.

The development of fuzzing tools and services, such as Google's OSS-Fuzz, Microsoft's Project Springfield, and the open-source AFL (American Fuzzy Lop), has made fuzzing accessible to a wider audience of security researchers and developers. These tools automate the generation of inputs and the detection, triage, and minimization of failures, making it easier to identify and fix vulnerabilities in software.

Fuzzing is now a standard part of the security testing toolkit, used primarily to find vulnerabilities in software before they can be exploited by attackers. However, it's also used more broadly in quality assurance to identify bugs, demonstrating that while fuzzing can prove the presence of defects, it cannot prove their absence.

Fuzzed Out

Edge Of Chaos

Edge Case Crash

"The Fuzzer's Lament" is an alt-rock anthem that delves into the world of software testing, specifically fuzzing. The song uses metaphors and vivid imagery to describe the process of fuzzing, where invalid and unexpected data is used to test the limits of a program's capabilities.

The first verse sets the stage in a realm of code and bits, where worlds are created and shaped. Here, fuzzing is introduced as a technique, a testing art that keeps the flaws uncharted. It's described as a dance with chaos in harmony, highlighting the controlled yet unpredictable nature of the process.

The chorus is a rallying cry to 'Fuzz it up, Shake it down'. It encourages the testing process, acknowledging that it may cause the program to stumble and fall, but it's through this chaos that vulnerabilities are revealed. The lyrics 'Crashes, Leaks, Assertions breaking' underscore the potential outcomes of fuzzing, revealing the hidden truth of the program's stability.

The second verse goes deeper into the technical aspects of fuzzing. It talks about structured inputs, rules, and bounds, and how the fuzzer pushes and prods through these to uncover any façade. The use of semi-valid or halfway there inputs is described as enticing the parser with deceit, further emphasizing the strategic nature of fuzzing.

Overall, "The Fuzzer's Lament" is a unique blend of technology and music, creating an engaging narrative around a complex technical process. It's a song that celebrates the importance of testing, the discovery of vulnerabilities, and the role of chaos in creating robust software.

The Fuzzer's Lament

Join hosts Joel Moses, Oscar Spencer, and Matt Yacobucci as they dive deep into the world of formal verification with special guest Chris Fallin. In this episode of WebAssembly Unleashed, the team discusses the importance of formal verification in software development, particularly for WebAssembly. Chris, a co-author of the Cranelift compiler and Mozilla alum, explains the concept of formal verification, its significance, and how it can be applied to ensure software correctness and security. The conversation covers a range of topics including type safety, the use of SMT solvers, the challenges in formally verifying compilers, and the potential role of AI in generating formally verified code. Don't miss this insightful discussion if you're keen to learn about cutting-edge techniques to make software more reliable and secure.

00:00 Welcome to WebAssembly Unleashed
00:57 Community Updates
01:41 Guest Introduction: Chris Fallin
02:18 What is formal verification and why is it important?
03:10 Formal Verification in WebAssembly
06:28 Challenges and Real-World Applications
07:52 Tools and Techniques for Verification
20:22 Future Directions and Broader Implications
28:21 AI and Formal Verification
30:44 Lack of Formal Verification Consequences

Did you miss the WebAssembly Unleashed episode 16 with Bruce Gain? Check it out here: https://youtu.be/Gjd8l1Sz9qY?si=QGixwObXJgvex9DS

For more from F5's Office of the CTO visit the following sites: 
Blogs -  https://www.f5.com/company/octo
Reports -  https://www.f5.com/services/resources/reports

Meet Your Hosts: 
Joel Moses | https://www.linkedin.com/in/joelmoses/ | https://community.f5.com/users/joel_moses/398372 
Oscar Spencer | https://twitter.com/oscar_spen | https://www.linkedin.com/in/oscarspen/ 
Matthew Yacobucci | https://www.linkedin.com/in/matthew-yacobucci-323b4b2/

Unlocking the Secrets of Formal Verification in WebAssembly | Ep 19 | WebAssembly Unleashed

DevCentral is F5's online Community of Technical Peers dedicated to learning, exchanging ideas, and solving problems – Together.

We host audio podcasts created by our Community, for our Community.

principal vulnerability researcher
artist. coder. writer. musician.

New tracks tagged #fuzzing