Software vulnerabilities are a grave threat to the security of computer systems. They often go undetected for years until it is too late and the consequences are irreversible. In order to find these weaknesses, software security testers and developers often have to manually test the entire codebase and determine if any vulnerabilities exist. However, this can take months or even years of work due to the scale of modern software projects.
One way of handling all this is with fuzzing. The fuzzing process throws random input at code or software, looking for bugs that might not have been found with traditional testing techniques. In recent years, approaches like neural fuzzing have emerged to make application security testing faster and more accurate.
What is Fuzzing?
Fuzzing is a technique used to discover the presence of bugs in software or computerized systems. The purpose of using fuzzing techniques is not only to create an effective way of testing but also to identify any vulnerabilities in the code and address them before they become a serious problem for a company’s network security.
Barton Miller developed the concept of fuzzing in the late 1980s for a graduate-level university operating system class, and this has since gained rapid popularity among security researchers and those conducting application security evaluations.
Generally, fuzzing works by providing an invalid input such as random data, malformed data or any combination thereof and attempts to force the program into generating errors. This is to see how it responds and then identify potential bugs. Fuzzing can be done manually or automatically, with the latter being the most common method.
Fuzzing Methods
Fuzzing is broadly classified into three categories: Blackbox fuzzing, Whitebox fuzzing, and Greybox fuzzing.
- Blackbox Fuzzing: Blackbox fuzzing is a type of testing that involves brute force and random data input. In this case, the tester knows nothing about the internal structure of the target software.
- Whitebox Fuzzing: Testing that relies on knowledge of the application’s methods. It can be done through binary modification and code instrumentation. Here, the person has some knowledge of the internals and can use that knowledge to create more effective inputs.
- Greybox Fuzzing: Greybox Fuzzing is quite similar to Blackbox Fuzzing. The testers have no knowledge of the target program’s structure, but they employ a feedback loop to direct their search based on observed behavior from past runs. It also involves limited source code evaluation, such as calculating code coverage with the use of lightweight code instrumentation. Greybox fuzzing strategies based on random mutations have resulted in fuzzers such as AFL (American Fuzzy Lop), which has been successful in detecting a large number of real-world problems in complex programs.
How Does a Fuzzer Work?
A fuzzer is a program that automatically injects data (be it random or mutated data) into a program to find problems. It is often begun with a set of seed input files that are continuously modified to generate malicious inputs via random mutations or constraint-solving.
Because malicious input formats can be quite complex, generating malicious inputs often necessitates millions of mutations. As a result, the fuzzing process can be viewed as a massive search problem to find a good set of mutations that will result in higher code coverage and more crashes.
The Limits of Traditional Fuzzing
Traditional fuzz testing has numerous obstacles, which include how to successfully alter input seed files, boost code coverage, and avoid format verification, all while testing thousands of lines of code.
This has prompted the need to develop an accurate and efficient fuzzing technique to replace traditional fuzzers. To address these issues, machine learning techniques have been proposed as a new method in fuzz testing.
Enter Neural fuzzing.
What is Neural Fuzzing?
Neural fuzzing is a new approach to testing software security that does not rely on black-box techniques. It instead relies on machine learning and neural networks.
For example, with artificial Intelligence rapidly gaining popularity, Microsoft researchers have been able to improve fuzzing techniques using deep neural networks and machine learning to detect bugs better by learning from previous experience. The neural models develop a function to anticipate favorable (and bad) positions in input files so that they can perform fuzzing mutations based on previous mutations and relevant data.
Neural fuzzing is very similar to the more traditional process of fuzzing where developers write test data to find bugs. The difference is that neural fuzzing uses machine-learning techniques to generate the data so there is less need for human input.
Neural fuzzing is a process that invokes neural networks to generate random input data to find vulnerabilities in software. It is a method for automated security testing of software. It makes use of artificial neural networks to mutate program instructions and then examines the crash reports for an indication of a potential vulnerability.
Neural fuzzing is a relatively new concept that has been gaining traction with the introduction of deep neural networks, opening possibilities for developing methods to identify vulnerabilities in software and networks using machine learning techniques to generate inputs that trigger bugs.
Neural fuzzing will identify some errors that would have been impossible to find with more traditional methods because the errors only happen when the input data sent to the program is not what was expected.
Pros and Cons of Neural Fuzzing
Neural Fuzzing is an innovative way of finding bugs in a program’s code. It is especially useful when it comes to finding exploitable bugs that are not found by traditional fuzz testing methods.
A major advantage of neural fuzzing is that it can explore different parts of the system, including paths where the testers may not have explored. In this way, neural fuzzing can find bugs that humans may have missed and increase the efficiency and accuracy of the testing process.
This technique can quickly find many problems with a piece of software’s code, but it can also cause instability due to the constant crashing and reopening of applications, resulting in data loss and security vulnerabilities.
Developers can benefit greatly from neural fuzzing as it not only identifies the issue, but also reveals the source and how an attacker might interact with it in a real-world attack. It establishes the existence of a vulnerability, allowing for the detection of issues without having to go through false positives.
A test version would let them know if they have overlooked any other vulnerabilities, making it easier to create an accurate model for the software they are trying to fuzz, and avoid the potential instability of working on a live application.
Open Source Neural Fuzzing Tools
Cybersecurity vendors have yet to do much with neural fuzzing, but there are a number of automated and open source fuzzing tools. These include:
- OneFuzz: OneFuzz is an open source self-hosted developer platform currently being developed by Microsoft, replacing the previous MSRD (The Microsoft Security Risk Detection) Fuzzing service.
- ClusterFuzz: This open source fuzzing infrastructure from Google automates the entire process, from bug discovery to triage (correct deduplication, bisection), bug reporting, and automatic bug report closure.
- Fuzzbuzz: This is an automated intelligent platform that makes fuzzing developer friendly, as it doesn’t require code-testing.
- Defensics: This is a comprehensive, adaptable, and automated black box fuzzer that helps enterprises find and fix security flaws in software quickly and effectively.
- Gitlab Protocol Fuzzer: Formerly known as Peach Fuzzer, this fuzzer recently acquired by Gitlab provides a platform to use protocol fuzz testing to discover vulnerabilities and bugs a lot of other tools will not.
- Other tools include libFuzzer and honggfuzz.
Further reading:
Top Code Debugging and Code Security Tools
FBI, CISA Reveal Most Exploited Vulnerabilities
