metzmanj

6 ms·

1.
by metzmanj 2y ago
Very interesting, this will really change the dynamics of bug bounty and webapp security more broadly
2.
by metzmanj 2y ago
This is interesting, but do you think this would have aroused enough suspicion to find the backdoor (after every Ubuntu user was owned by it)? I don't see why this is the case. It wasn't a secret that ifuncs were being used in XZ.
3.
by metzmanj 2y ago
I work on oss-fuzz. I don't think it's plausible OSS-Fuzz could have found this. The backdoor required a build configuration that was not used in OSS-Fuzz. I'm guessing "Jia Tan" knew this and made changes to XZ&#x2
4.
by metzmanj 2y ago
That's what people are saying though I haven't had the chance to look into this myself. Fuzzing isn't really the best tool for catching bugs the maintainer intentionally inserted though.
5.
by metzmanj 2y ago
>Woha, is this legit or some sort of scam on Google in some way?: I work on OSS-Fuzz. As far as I can tell, the author's PRs do not compromise OSS-Fuzz in any way. OSS-Fuzz doesn't trust user code for this very reason.
6.
by metzmanj 4y ago
No projects yet, but I bet we'll have some by next week.
7.
Fuzzing beyond memory corruption: Finding more classes of bugs automatically(security.googleblog.com)
3 points by metzmanj 4y ago|0 comments
8.
ClusterFuzzLite: Continuous Fuzzing for All(security.googleblog.com)
15 points by metzmanj 5y ago|3 comments
9.
FuzzBench: Fuzzer Benchmarking as a Service(security.googleblog.com)
4 points by metzmanj 7y ago|0 comments
10.
by metzmanj 7y ago
I don't think we have plans to build this for now. I find it a really cool idea, but for now, running fuzzers natively on Google Cloud with ClusterFuzz ( https://github.com/google/clusterfuzz ) suits our needs. One
11.
by metzmanj 7y ago
Right I think WASM offers some nice advantages over native for distributed fuzzing. It's also worth pointing out that Mozilla made a (non-WASM) distributed fuzzing project, virgo: https://github.com/MozillaSecurity&#x2F
12.
by metzmanj 7y ago
I haven't done a comprehensive study of this but in general I find that fuzzing programs in different environments (e.g. CPU architectures, OSes) tends to find some bugs that won't be found by fuzzing in just one environment. But
13.
by metzmanj 8y ago
It uses AFL. ClusterFuzz is infrastructure for running fuzzers, so we use it to run AFL, libFuzzer, and other domain specific fuzzers we've written. Using it to run AFL gives us a lot of nice things over using AFL on someone's des
14.
by metzmanj 8y ago
The other possibility for completely on-prem use right now is running it using the dev server: https://google.github.io/clusterfuzz/getting-started/local-i...
15.
by metzmanj 8y ago
Thanks Tanin!
16.
by metzmanj 8y ago
Great post Guido! Guido's bignum fuzzer which tests the correctness of math operations in crypto libraries is one of the most interesting fuzzers we run on ClusterFuzz.
17.
by metzmanj 8y ago
We would like to support this use case. For now, you can actually do the fuzzing on prem while communicating with app engine. We do this for our OS X bots since GCE doesn't offer OS X.
18.
by metzmanj 8y ago
There are tools for fuzzing go: https://github.com/dvyukov/go-fuzz But I think the kinds of bugs found by fuzzing aren't generally security issues in go (I don't know much about go) as they are in C/C++.
19.
by metzmanj 8y ago
+1 I can speak a little bit about what motivated us. We saw from OSS-Fuzz ( https://github.com/google/oss-fuzz ) that this sort of thing could be widely useful and wanted non-open source code to benefit from making fuzzi
20.
by metzmanj 8y ago
I don't think so. But solidity was recently added to OSS-Fuzz: https://github.com/google/oss-fuzz/tree/master/projects/soli...
21.
by metzmanj 8y ago
>So before I go too much further, would it be possible to use this for web apps or unity games? Web apps, almost certainly no. ClusterFuzz (and fuzzing generally) is most useful for finding bugs in C/C++ code so maybe it could work
22.
by metzmanj 8y ago
btw, ClusterFuzz, the infrastructure behind OSS-Fuzz was open sourced today: https://news.ycombinator.com/item?id=19106771
23.
by metzmanj 8y ago
I work on this. Happy to answer questions if people have any.