Taint-based directed whitebox fuzzing

By Vijay Ganesh, T. Leek, Martin C. Rinard. 2009 IEEE 31st International Conference on Software Engineering, 2009

381 citations recorded by the source corpus.

We present a new automated white box fuzzing technique and a tool, BuzzFuzz, that implements this technique. Unlike standard fuzzing techniques, which randomly change parts of the input file with little or no information about the underlying syntactic structure of the file, BuzzFuzz uses dynamic taint tracing to automatically locate regions of original seed input files that influence values used at key program attack points (points where the program may contain an error). BuzzFuzz then automatically generates new fuzzed test input files by fuzzing these identified regions of the original seed input files. Because these new test files typically preserve the underlying syntactic structure of the original seed input files, they tend to make it past the initial input parsing components to exercise code deep within the semantic core of the computation. We have used BuzzFuzz to automatically find errors in two open-source applications: Swfdec (an Adobe Flash player) and MuPDF (a PDF viewer). Our results indicate that our new directed fuzzing technique can effectively expose errors located deep within large programs. Because the directed fuzzing technique uses taint to automatically discover and exploit information about the input file format, it is especially appropriate for testing programs that have complex, highly structured input file formats.

Subfields: Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/7c6f7a9f4a3dac4a4805d1c5b2f18212617cf8b6

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Software

1. Bihuan Chen
2. Yang Liu
3. Junjie Wang
4. Lei Wei
5. Thorsten Holz
6. Yang Xiang
7. Cornelius Aschermann
8. Peng Chen

In Signal Processing

1. Konrad Rieck
2. Bihuan Chen
3. Yang Liu
4. Peng Chen
5. Hao Chen
6. Junjie Wang
7. Lei Wei
8. Thorsten Holz

Citations in the corpus

• TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection (2010, methodology): “BuzzFuzz cannot instrument such libraries if source code is unavailable, leading to the loss of taint information.”
• A Hitchhiker's guide to statistical tests for assessing randomized algorithms in software engineering (2014, methodology): “On the other hand, if a paper focused on presenting a deter-199 ministic, novel technique, then it was included when randomized algorithms were used for comparison purposes (e.g., fuzz testing [43]).”
• Coverage-Based Greybox Fuzzing as Markov Chain (2016, methodology): “Taint-based fuzzing [16], [32] is a directed whitebox fuzzing technique.”
• The Art, Science, and Engineering of Fuzzing: A Survey (2018, methodology): “(cid:8) [73] honggfuzz[204] Mamba (cid:8) [117] AFL[231] Nightmare[129] Choronzon (cid:8) [194] go-fuzz[215] QuickFuzz (cid:8) [94] AFLFast (cid:8) [37] classfuzz (cid:8) [59] GRR[211] Skyfire (cid:8) [217] GLADE (cid:8) [30] VUzzer (cid:8) [176] AFLGo (cid:8) [36] Hawkeye (cid:8) [53] Angora (cid:8)”
• A practical guide for using statistical tests to assess randomized algorithms in software engineering (2011, background): “[18] ICSE 1 None [33] ICSE 1 None [4] SSBSE 1000 Linear regression [21] SSBSE 30/500 None [14] SSBSE 100 U-test”
• Angora: Efficient Fuzzing by Principled Search (2018, methodology): “For example, BuzzFuzz [13] used taint tracking to find which input bytes were processed by “attack point” that they defined.”
• kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels (2017, positive): “Tools like TaintScope [39], BuzzFuzz [21] and Vuzzer [35] utilize taint tracing and similar dynamic analysis techniques to uncover new paths.”
• Superion: Grammar-Aware Greybox Fuzzing (2018, positive): “BuzzFuzz [24], Vuzzer [55] and Angora [15] leverage taint analysis to identify those interesting bytes for mutation.”
• NAUTILUS: Fishing for Deep Bugs with Grammars (2019, background): “More advanced techniques are either taint-based [24], [27], [29], [43], [50], symbolic [26], or concolic [31], [32], [46] (a portmanteau of concrete and symbolic).”
• Skyfire: Data-Driven Seed Generation for Fuzzing (2017, methodology): “BuzzFuzz [8] and TaintScope [9] use taint analysis to locate the interesting byte for guiding the mutation.”
• Modeling and Discovering Vulnerabilities with Code Property Graphs (2014, methodology): “Dynamic approaches to program analysis such as fuzz testing [10, 13, 42] and dynamic taint tracking [e.”
• VUzzer: Application-aware Evolutionary Fuzzing (2017, background): “A fuzzer is directed if it generates inputs to traverse a particular set of execution paths [20]–[22], [26], [38].”
• Learning to Fuzz: Application-Independent Fuzz Testing with Probabilistic, Generative Models of Input Data (2016, methodology): “SAGE [20] and BuzzFuzz [17] are examples of whitebox fuzzing approaches.”
• Steelix: program-state based binary fuzzing (2017, background): “, [29, 30, 39]) either have access to the source code of the PUT, or rely on binary lifting [34] to translate assembly into an intermediate language.”
• Driller: Augmenting Fuzzing Through Selective Symbolic Execution (2016, methodology): “Similar to Dowser, BuzzFuzz [17] applies taint-tracking to sample input test cases to discover which input bytes are processed by 'attack-points' defined by the auditor, most often system call arguments and library code.”
• Fuzzing: A Survey for Roadmap (2022, methodology): “Fuzzers [37, 38, 67, 157, 160, 187] utilize 230:15 DTA to build relationships between input bytes and security-sensitive points (e.g., system/library calls or conditional jumps).”
• Dynamic knobs for responsive power-aware computing (2011, neutral): “PowerDial uses influence tracing [12, 20] to find the control variables for the specified configuration parameters.”