File and protocol attacks
Open Source Fuzzing Tools
If you're looking to play with fuzzing tools, or just generally stress test your system and software, a number of options are available (Table 1).
Some of the tools, like mangleme and QueFuzz, can be up and running in minutes. Others, like SPIKE, have a pretty steep learning curve and are aimed more at people wanting to write their own custom fuzzing tools for research purposes (they have a learning curve shaped much like the Matterhorn).
Where Does This Leave You?
The good news is that fuzzing tools have lead to direct improvements in code quality. It's hard for a developer to argue with a test case (in the form of a file or a network data stream) that causes your application to fall over or otherwise behave badly. In a best case scenario, this could even lead to developers writing more robust code that isn't as prone to bad or malformed data inputs, although if history is any indicator, this isn't likely to happen anytime soon. The bad news is that as bad guys get smarter, they to will start using fuzzing tools to find flaws that they can exploit (witness the current 0-day attacks against Adobe Acrobat and Microsoft Excel and the Conficker worm, which had reportedly infected 15 million Windows systems as of January 26, 2009).
- PDF specification: http://www.adobe.com/devnet/acrobat/pdfs/PDF32000_2008.pdf
- PROTOS: http://www.ee.oulu.fi/research/ouspg/
Buy this article as PDF
New flaw in an old encryption scheme leaves the experts scrambling to disable SSL 3
Lennart Poettering wants to change the way Linux developers talk to each other.
Enterprise giant frees itself from ink and home PCs (and visa versa).
Mozilla’s product think tank sinks silently into history.
TODO group will focus on open source tools in large-scale environments.
New tool will look like GParted but support a wider range of storage technologies.
New public key pinning feature will help prevent man-in-the-middle attacks.
Carnegie Mellon researchers say 3 million pages could fall down the phishing hole in the next year.
The US government rolls new best-practice rules for protecting SSH.