Keynote by @halvarflake at #FUZZING'24 reflecting on the Reasons for the Unreasonable Success of Fuzzing. 
Hacking culture in the 90's had very strong values. It had a value system outside of and different from normal society. Fuzzing was for the dumb kids.
"No one can argue with a root shell". Fuzzing was done via Perl scripts and pretty much manually. Bugs where super abundant. Even the CNN website run on a server you could find vulns in within 2 days.
OpenSSH CRC32 compensation CVE-2001-0144.
Michal Zalewski (!) piped random data into OpenSSL for fun and found a crash. Probably the only remotely exploitable OpenSSL bug found via fuzzing.
Michal Zalewski (!) piped random data into OpenSSL for fun and found a crash. Probably the only remotely exploitable OpenSSL bug found via fuzzing.
Going from a fuzzer bug in Acrobat Reader to an actual working exploit took way longer than finding the bug, but I learned so much that I wrote the weird machine paper 6 years later as a consequence.
Programs get more complex, human auditors must get "smarter" but fuzzing doesn't get much slower or less effective.
Fuzzing is embarrassingly parallel that it can exploit Moore's law for horizontal scalability.
Fuzzing is always a winner in the hardware lottery. Program analysis is in software while fuzzing is perf in hardware.
Lack of false positives. This is huge in industry! More important even than "absence of bugs".
AFL had outside impact because it harnessed these strengths. Designed to just work. Smart design decisions better than a dumb strategy.
Also, fuzzers are really simple to implement. Anyone can do it.
Also, fuzzers are really simple to implement. Anyone can do it.
Perhaps fuzzing is "the bitter lesson", but applied to program analysis, not ML.
The AI community are all-in on compute now. This seems to be the same in program.analysis. "The two methods that scale arbitrarily are search and fuzzing".
Fuzzing community should look into research in RL. Novelty search.
We should work on our reward functions. Coverage is blind to the state machine. Similar to the RL game-playing issue?
We should work on our reward functions. Coverage is blind to the state machine. Similar to the RL game-playing issue?
But maybe we need to be faster rather than smarter? Let's look at fuzzer performance bottlenecks. Let's look at dedicated hardware.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
