File and protocol attacks
Open Source Fuzzing Tools
If you're looking to play with fuzzing tools, or just generally stress test your system and software, a number of options are available (Table 1).
Some of the tools, like mangleme and QueFuzz, can be up and running in minutes. Others, like SPIKE, have a pretty steep learning curve and are aimed more at people wanting to write their own custom fuzzing tools for research purposes (they have a learning curve shaped much like the Matterhorn).
Where Does This Leave You?
The good news is that fuzzing tools have lead to direct improvements in code quality. It's hard for a developer to argue with a test case (in the form of a file or a network data stream) that causes your application to fall over or otherwise behave badly. In a best case scenario, this could even lead to developers writing more robust code that isn't as prone to bad or malformed data inputs, although if history is any indicator, this isn't likely to happen anytime soon. The bad news is that as bad guys get smarter, they to will start using fuzzing tools to find flaws that they can exploit (witness the current 0-day attacks against Adobe Acrobat and Microsoft Excel and the Conficker worm, which had reportedly infected 15 million Windows systems as of January 26, 2009).
- PDF specification: http://www.adobe.com/devnet/acrobat/pdfs/PDF32000_2008.pdf
- PROTOS: http://www.ee.oulu.fi/research/ouspg/
Buy this article as PDF
New release targets Linux professionals.
The Fedora project adds Wayland and Gnome 3.22
CeBIT 2017: Open Source Forum Call for Papers
Long-time Linux antagonist joins the revolution.
Major bug affects Debian/Ubuntu distributions.
Canonical releases the minimal edition for embedded devices, Internet of Things, and cloud deployments.
The new release features improvements across the board, from performance to security.
Two out of three of the new members are women.
More than 5,000 people attended the event.
Linux Magazine will include the best of both magazines.