Upload File

phy layer vulnerabilities designing rf fuzzing tools to expose · results dump rf fuzzing // river...

  • Home
  • Documents
  • PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)
42
RF Fuzzing // River Loop Security River Loop Security River Loop Security Designing RF Fuzzing Tools to Expose PHY Layer Vulnerabilities Matt Knight GNU Radio Conference 2018

Upload: others

Post on 18-Jul-2020

3 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop Security

River Loop SecurityRiver Loop Security

Designing RF Fuzzing Tools to Expose PHY Layer Vulnerabilities

Matt Knight GNU Radio Conference 2018

Page 2: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop Securitywhois

Matt Knight• Senior Security Engineer at Cruise

Automation• RF Principal at River Loop Security• BE in EE from Dartmouth College• Software, hardware, and RF engineer• RF, SDR, and embedded systems

Ryan Speers• Co-founder at River Loop Security• Computer Science from Dartmouth College• Cryptography, embedded systems, IEEE

802.15.4, automated firmware analysis

River Loop Security

2

(here in spirit)

Page 3: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityBackground

“Making and Breaking a Wireless IDS”, Troopers14“Speaking the Local Dialect”, ACM WiSec• Ryan Speers, Sergey Bratus, Javier Vazquez, Ray Jenkins, bx, Travis Goodspeed, & David Dowd• Idiosyncrasies in PHY implementations

Mechanisms for automating:• RF fuzzing• Bug discovery• PHY FSM fingerprint generation

3

Page 4: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityAgenda

1. Overview of traditional fuzzing techniques (software and networks)> How these do and don’t easily map to RF

2. RF fuzzing overview and state of the art3. Ideal fuzzer design4. TumbleRF introduction and overview5. TumbleRF usage example

4

Page 5: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop Security

Traditional Fuzzing Techniques

5

Page 6: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityWhat is fuzzing?

Measured application of pseudorandom input to a system

Why fuzz?• Automates discovery of crashes, corner cases, bugs, etc.• Unexpected input → unexpected state

6

Page 7: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityWhat can one fuzz?

Fuzzers generally attach to system interfaces, namely I/O:• File format parsers• Network interfaces• Shared memory

7

Page 8: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecuritySoftware Fuzzing State of the Art

Abundant fully-featured software fuzzers• AFL / AFL-Unicorn• Peach• Scapy

Software is easy to instrument and hook at every level

What else can one fuzz?

8

Page 9: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop Security

Other Applications of Fuzzing

9

Page 10: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityFuzzing Hardware

Challenges:• H/W is often unique, less “standard interfaces” to measure on• May not be able to simulate well in a test harness

Some Existing Techniques:• AFL-Unicorn: simulate firmware in Unicorn to fuzz• Bus Pirate: permutes pinouts and data rates to discover digital buses• JTAGulator: permutes pinouts that could match unlocked JTAG• …

10

Page 11: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityFuzzing RF

WiFuzz● MAC-focused 802.11 protocol fuzzer

Marc Newlin’s Mousejack research● Injected fuzzed RF packets at nRF24 HID dongles while looking for

USB output

isotope:● IEEE 802.15.4 PHY fuzzer

11

Page 12: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityExisting RF Fuzzing Limitations

RF fuzzing projects are siloed / protocol-specific● COTS radio chipsets● Generally limited to MAC layer and up

RF state is hard to instrument● What constitutes a crash / bug / etc?

Layer 2 implies trust in chipset – one can only see what one’s radio tells you is happening

12

Page 13: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityTrust and Physical Layer Vulnerabilities

Not all PHY state machines are created equal!

Radio chipsets implement RF state machines differently• Differences can be fingerprinted and exploited• Initial results on 802.15.4 were profound• Specially-crafted PHYs can target certain chipsets while avoiding

others

13

Page 14: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecuritySync Words and Magic Numbers

Turns out not all sync words are created equally• 0x00000000 == 802.15.4 Preamble• 0xA7 == 802.15.4 Sync Word

The isotope research showed some chipsets correlated on “different” preambles / sync words than others

14

Page 15: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecuritySync Words and Magic Numbers

Turns out not all sync words are created equally• 0x00000000 == 802.15.4 Preamble• 0xA7 == 802.15.4 Sync Word

The isotope research showed some chipsets correlated on “different” preambles / sync words than others

strategically malformed

15

Page 16: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecuritySync Words and Magic Numbers

Turns out not all sync words are created equally• 0xXXXX0000 == 802.15.4 Preamble• 0xA7 == 802.15.4 Sync Word

The isotope research showed some chipsets correlated on “different” preambles / sync words than others

Short preamble?

strategically malformed

16

Page 17: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecuritySync Words and Magic Numbers

Turns out not all sync words are created equally• 0xXXXX0000 == 802.15.4 Preamble• 0xAF == 802.15.4 Sync Word

The isotope research showed some chipsets correlated on “different” preambles / sync words than others

Short preamble? Flipped bits in SFD?

strategically malformed

17

Page 18: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop Security

Systematic Discovery via Fuzzing

18

Page 19: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop Security

Ideal RF Fuzzer Design

19

Page 20: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityIdeal Features

Extensible: easy to hook up new radios

Flexible: modular to enable plugging and playing different engines / interfaces / test cases

Reusable: re-use designs from one protocol on another

Comprehensive: exposes PHY in addition to MAC

20

Page 21: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop Security

TumbleRF

21

Page 22: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityTumbleRF

Software framework enabling fuzzing arbitrary RF protocols

Abstracts key components for easy extension:● Radio API● Test case generation API● Harness API

22

Page 23: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityTumbleRF Architecture

Test Case Generator

TX Interface (PHY or MAC)

Harness

Test Case Management

Command Line Interface

Results Logging

23

Page 24: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityInterfaces

RF injection/sniffing functions abstracted to generic templateTo add a new radio, inherit base Interface class and redefine its functions to map to the radio driver:

[set/get]_channel()[set/get]_sfd()[set/get]_preamble()tx()rx_start()rx_stop()rx_poll()

TODO: [set/get]_symbol_rate()24

Page 25: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityGenerators

Rulesets for generating fuzzed input (pythonically)Extend to interface with software fuzzers of your choice

Implement 2 functions:yield_control_case()yield_test_case()

Three generators currently:• Preamble length (isotope)• Non-standard symbols in preamble (isotope)• Random payloads in message

25

Page 26: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityHarnesses

Monitor the device under test to evaluate test case resultsManage device state in between tests

Three handlers currently:• Received Frame Check: listen for given frames via an RF interface• SSH Process Check: check whether processes on target crashed

(beta)• Serial Check: watch for specific output via Arduino (beta)

26

Page 27: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityTest Cases

Coordinate the generator, interface, and harness. Typically very lightweight.

Extend BaseCase to implement run_test()or build upon others, e.g.:

Extend AlternatorCase to implement:does_control_case_pass()throw_test_case()

Alternates test cases with known-good control case to check for crashes / ensure interface is still up

27

Page 28: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop Security

28

Test Setup (1/2)

Page 29: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop Security

29

Test Setup (2/2)

Devices Under Test (left to right)● TI CC2420● TI CC2531● Atmel AT86RF230

Stimulus● USRP B210

Page 30: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityTumbleRF Architecture: Demo Setup

Test Case Generator

TX Interface (PHY or MAC)

Harness

Test Case Management

RX Interface

Command Line Interface

Results Logging

Comparison Logic

30

Page 31: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityGenerated Data: Preamble Length

Preamble SFD Length

0x00 0x00 0x00 0x00 0xA7 0xLL

Standard IEEE802.15.4 preamble: 0x00000000Standard 802.15.4 PHY Header == 0x00000000 + 0xA7 + 0xLL

31

Page 32: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityGenerated Data: Preamble Length

Preamble SFD Length

0x00 0x00 0x00 0x00 0xA7 0xLL

Standard IEEE802.15.4 preamble: 0x00000000Standard 802.15.4 PHY Header == 0x00000000 + 0xA7 + 0xLL

32

Page 33: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityGenerated Data: Preamble Length

Preamble SFD Length

0x00 0x00 0x00 0x00 0xA7 0xLL

Standard IEEE802.15.4 preamble: 0x00000000Standard 802.15.4 PHY Header == 0x00000000 + 0xA7 + 0xLL

33

Page 34: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityGenerated Data: Preamble Length

Preamble SFD Length

0x00 0x00 0x00 0x00 0xA7 0xLL

Standard IEEE802.15.4 preamble: 0x00000000Standard 802.15.4 PHY Header == 0x00000000 + 0xA7 + 0xLL

34

Page 35: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityGenerated Data: Preamble Length

Preamble SFD Length

0x00 0x00 0x00 0x00 0xA7 0xLL

Standard IEEE802.15.4 preamble: 0x00000000Standard 802.15.4 PHY Header == 0x00000000 + 0xA7 + 0xLL

35

Page 36: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityGenerated Data: Preamble Length

Arbitrary PHY injection via modified gr-ieee802-15-4

bypassed

Modify GNU Radio gr-ieee802-15-4 to omit PHY headerGenerate arbitrary PHY headers via TumbleRF test case generator36

Page 37: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop Security

Demo

37

Page 38: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityResults DumpTest: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

Case 0: 0 valid, 50 invalid example case: a70a230800ffff000007fba6

Case 1: 0 valid, 50 invalid example case: 70aa308220f0ff0f0070d0eafa

Case 2: 45 valid, 5 invalid example case: 00a70a230804ffff00000757b6

Case 3: 0 valid, 50 invalid example case: 0070aa308260f0ff0f007010e0fb

Case 4: 50 valid, 0 invalid example case: 0000a70a230808ffff000007a387

Case 5: 0 valid, 50 invalid example case: 000070aa3082a0f0ff0f007050fff8

Case 6: 50 valid, 0 invalid example case: 000000a70a23080cffff0000070f97

Case 7: 0 valid, 50 invalid example case: 00000070aa3082e0f0ff0f007090f5f9

Case 8: 48 valid, 2 invalid example case: 00000000a70a230810ffff0000074be4

Case 9: 0 valid, 50 invalid example case: 0000000070aa308220f1ff0f0070d0c1fe

Test: preamble_length_cc2531.json (using Dot15d4PreambleLengthGenerator)

Case 0: 0 valid, 50 invalid example case: a70a230800ffff000007fba6

Case 1: 0 valid, 50 invalid example case: 70aa308220f0ff0f0070d0eafa

Case 2: 13 valid, 37 invalid example case: 00a70a230804ffff00000757b6

Case 3: 0 valid, 50 invalid example case: 0070aa308260f0ff0f007010e0fb

Case 4: 48 valid, 2 invalid example case: 0000a70a230808ffff000007a387

Case 5: 0 valid, 50 invalid example case: 000070aa3082a0f0ff0f007050fff8

Case 6: 50 valid, 0 invalid example case: 000000a70a23080cffff0000070f97

Case 7: 0 valid, 50 invalid example case: 00000070aa3082e0f0ff0f007090f5f9

Case 8: 49 valid, 1 invalid example case: 00000000a70a230810ffff0000074be4

Case 9: 0 valid, 50 invalid example case: 0000000070aa308220f1ff0f0070d0c1fe

Test: preamble_length_rzusbstick.json (using Dot15d4PreambleLengthGenerator)

Case 0: 0 valid, 50 invalid example case: a70a230800ffff000007fba6

Case 1: 0 valid, 50 invalid example case: 70aa308230f0ff0f007060a8fa

Case 2: 0 valid, 50 invalid example case: 00a70a230805ffff0000077cb2

Case 3: 0 valid, 50 invalid example case: 0070aa308270f0ff0f0070a0a2fb

Case 4: 0 valid, 50 invalid example case: 0000a70a230809ffff0000078883

Case 5: 0 valid, 50 invalid example case: 000070aa3082b0f0ff0f0070e0bdf8

Case 6: 37 valid, 13 invalid example case: 000000a70a23080effff000007599f

Case 7: 0 valid, 50 invalid example case: 00000070aa308200f1ff0f0070b044fe

Case 8: 41 valid, 9 invalid example case: 00000000a70a230813ffff00000736e8

Case 9: 0 valid, 50 invalid example case: 0000000070aa308250f1ff0f0070c00cff

TI CC2420

TI CC2531

Atmel AT86RF230

3 transceivers2 manufacturers1 protocol

3 behaviors!38

Page 39: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop Security

Why Care?

Those results can allow for WIDS evasion and selective targeting.

39

Page 40: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop SecurityInterested? Get Involved!

Contribute something to TumbleRF:• Radio interface to fuzz your favorite protocol• Generator for some cool new fuzzing idea you have• Harness to check the state of a device you care about testing

Investigate other use cases:• Test orchestration• Applications to hardware interfaces/other types of PHYs

40

Page 41: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop Security

Thank You!GNU Radio Conference 2018

River Loop SecurityCruise Automation

River Loop Security41

https://github.com/riverloopsec/tumblerf

Page 42: PHY Layer Vulnerabilities Designing RF Fuzzing Tools to Expose · Results Dump RF Fuzzing // River Loop Security Test: preamble_length_apimote.json (using Dot15d4PreambleLengthGenerator)

RF Fuzzing // River Loop Security

Questions?@embeddedsec

[email protected]

River Loop Security42

https://github.com/riverloopsec/tumblerf


High Performance Fuzzing

Fuzzing 101 - cs.ru.nl

Fuzzing Frameworks - Exploit€¦ · Fuzzing Frameworks . Pedram Amini Introduction . There are a number of available specialized fuzzing utilities which

Evolutionary Kernel Fuzzing Black Hat USA 2017 Richard Johnsonfuzzing.io/Presentations/Evolutionary Kernel Fuzzing... · 2020-02-23 · • High performance tracing and fuzzing since

683 Slides Fuzzing

Inc0gnito fuzzing for_fun_sweetchip

Real World Fuzzing

HTTP Fuzzing: Using JBroFuzz to fuzz the web away€¦ · OWASP Alabama Chapter Presentation Overview Fuzzing in general Fuzzing in the web world HTTP Fuzzing with JBrofuzz Other

fuzzing protocol fuzzing model-based testing automated ...erikpoll/ufrj/4_SecurityTesting.pdf · Security Testing fuzzing protocol fuzzing model-based testing automated reverse engineering

0-knowledge fuzzing

Fuzzing sucks!

Fuzzing Frameworks - Black Hat | Home€¦ · Fuzzing Frameworks . Pedram Amini Introduction . There are a number of available specialized fuzzing utilities

Fuzzing 101

Smart COM Fuzzing they were for ActiveX fuzzing, not COM

Fuzzing’– WhatTheFuzz - EurOpeneuropen.cz › Proceedings › 38 › fuzzing europen.pdf · 2017-05-04 · – An Introduction to SPIKE, the Fuzzer Creation Kit. "– MSRPC Fuzzing

Realizing the Fuzzing Potential: Precision and Accuracy … · Fuzzing Specialist Codenomicon Realizing ... Realizing the Fuzzing Potential: Precision and Accuracy vs. Coverage

Directed Greybox Fuzzing - GitHub PagesDirected greybox fuzzing is effectively directed and efficiently complements symbolic execution-based directed fuzzing. Our experiments demonstrate

Fuzzing and Exploiting OSX Vulnerabilities for Fun and … · Fuzzing and Exploiting OSX Vulnerabilities for Fun and Profit Complementary Active & Passive Fuzzing

Grape generative fuzzing

Introduction to Fuzzing

Fuzzing Qa A.Komlev

Unified RF Fuzzing Under a Common API: Introducing TumbleRF · River Loop Security whois Troopers 2018 Matt Knight • Independent software, hardware, and RF engineer • Security

Fuzzing Frameworks, Fuzzing Languages?!

From Blackbox Fuzzing to Whitebox Fuzzing towards Verificationsiy117527/sil765/readings/fuzzing testing.pdf · Page 1ISSTA’2010 July 2010 From Blackbox Fuzzing to Whitebox Fuzzing

Gsm Fuzzing

Fuzzing Frameworks

Logical Fuzzing

Designing RF Fuzzing Tools to Expose PHY Layer ... CON 26/DEF CON 26...RF Fuzzing // River Loop Security River Loop Security Designing RF Fuzzing Tools to Expose PHY Layer Vulnerabilities

Fuzzing Attacks and Protection on VoIP/UCbe.security.westcon.com/documents?documentId=35682&filename=... · Impact of Fuzzing Attacks ... • Attacker gains access using fuzzing in

Biswajit Mazumder Rohit Hooda Arpan Chowdhary. What is Fuzzing? Fuzzing techniques Types of Fuzzing Fuzzing explained Case study and changes:

Php Fuzzing Auditing

Security Testing esp. Fuzzing - E. Poll, - cs.ru.nl · Overview • Testing • Abuse cases & negative tests • Fuzzing –dumb fuzzing –generational aka grammar-based fuzzing

File Format Fuzzing in Android - DeepSec · Agenda 2 •File format fuzzing in Android •Fuzzing the Stagefright media framework •Fuzzing the Android application installer •Fuzzing

Introduction to Information Security · Introduction to Information Security Fuzzing 1. Today •Introduction to fuzzing •Fuzzing principles •Useful tools and leads. What is fuzzing?

취약점 분석을 위한 퍼징(Fuzzing)codeengn.com/archive/Reverse Engineering/Fuzzing... ·  · 2014-12-08의되어 있지 않다. 영단어 “fuzzing”으로부터 애플리케이션에