Practical File Format Fuzzing

Presented at DerbyCon 3.0 All in the Family (2013), Sept. 29, 2013, 8 a.m. (50 minutes).

File format fuzzing has been very fruitful at discovering exploitable vulnerabilities. Adversaries take advantage of these vulnerabilities to conduct spear-phishing attacks. This talk will cover the basics of file format fuzzing and show you how to use CERT’s fuzzing frameworks to discovery vulnerabilities in file parsers. http://www.cert.org/vuls/discovery/

Presenters:

• Jared Allar
  Jared Allar is a vulnerability analyst within the CERT Program at the Software Engineering Institute (SEI), a unit of Carnegie Mellon University in Pittsburgh, PA. Jared Allar has done large-scale vulnerability coordination work for vulnerabilities that have affected hundreds of software vendors. Most notably, he has coordinated vulnerabilities discovered by HD Moore related to VxWorks and libupnp. When not coordinating vulnerabilities, he helps test and improve CERT’s fuzzing frameworks.

Links:

• https://infocon.org/cons/DerbyCon/DerbyCon 3 2013/video/Practical File Format Fuzzing Jared Allar.mp4

Similar Presentations:

• DEF CON 15 (2007) / How smart is Intelligent Fuzzing - or - How stupid is Dumb Fuzzing?
• BruCON 0x0A (2018) / Finding security vulnerabilities with modern fuzzing techniques Workshop
• BruCON 0x0A (2018) / Finding security vulnerabilities with modern fuzzing techniques (Short Version) Workshop