Abstract:Fuzz testing has proven successful in finding security vulnerabilities in large programs. However, traditional fuzz testing tools have a well-known common drawback: they are ineffective if most generated inputs are rejected at the early stage of program running, especially when target programs employ checksum mechanisms to verify the integrity of inputs. This article presents TaintScope, an automatic fuzzing system using dynamic taint analysis and symbolic execution techniques, to tackle the above problem. TaintScope has several novel features: (1) TaintScope is a checksum-aware fuzzing tool. It can identify checksum fields in inputs, accurately locate checksum-based integrity checks by using branch profiling techniques, and bypass such checks via control flow alteration. Furthermore, it can fix checksum values in generated inputs using combined concrete and symbolic execution techniques. (2) TaintScope is a taint-based fuzzing tool working at the x86 binary level. Based on fine-grained dynamic taint tracing, TaintScope identifies the “hot bytes” in a well-formed input that are used in security-sensitive operations (e.g., invoking system/library calls), and then focuses on modifying such bytes with random or boundary values. (3) TaintScope is also a symbolic-execution-based fuzzing tool. It can symbolically evaluate a trace, reason about all possible values that can execute the trace, and then detect potential vulnerabilities on the trace. We evaluate TaintScope on a number of large real-world applications. Experimental results show that TaintScope can accurately locate the checksum checks in programs and dramatically improve the effectiveness of fuzz testing. TaintScope has already found 30 previously unknown vulnerabilities in several widely used applications, including Adobe Acrobat, Flash Player, Google Picasa, and Microsoft Paint. Most of these severe vulnerabilities have been confirmed by Secunia and oCERT, and assigned CVE identifiers (such as CVE-2009-1882, CVE-2009-2688). Vendor patches have been released or are in preparation based on our reports.

Improved Fuzzy Analysis Methods

FA-Fuzz: A Novel Scheduling Scheme Using Firefly Algorithm for Mutation-Based Fuzzing

Better Pay Attention Whilst Fuzzing.

NESTFUZZ: Enhancing Fuzzing with Comprehensive Understanding of Input Processing Logic

Research of Heuristic Fuzzing Data Generation Method in Program Frangibility

DeltaFuzz: Historical Version Information Guided Fuzz Testing

V-Fuzz: Vulnerability-Oriented Evolutionary Fuzzing

Fuzzing with Quantitative and Adaptive Hot-Bytes Identification

The research on the fuzzing

Industrial Oriented Evaluation of Fuzzing Techniques

Checksum-Aware Fuzzing Combined with Dynamic Taint Analysis and Symbolic Execution.

Investigating Coverage Guided Fuzzing with Mutation Testing

Fuzzing Based on Function Importance by Interprocedural Control Flow Graph

V-Fuzz: Vulnerability Prediction-Assisted Evolutionary Fuzzing for Binary Programs

CatchFuzz: Reliable active anti-fuzzing techniques against coverage-guided fuzzer

Semantic Sensitive Coverage-based Fuzzing

A systematic review of fuzzing based on machine learning techniques

Vulnerable Region-Aware Greybox Fuzzing.

TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection

VisFuzz: understanding and intervening fuzzing with interactive visualization

CAMFuzz: Explainable Fuzzing with Local Interpretation