Another Review, Another Pre-Review

Amazon.com just published my five star review of Windows Forensic Analysis by Harlan Carvey. From the review:

I loved Windows Forensic Analysis (WFA). It's the first five star book from Syngress I've read since early 2006. WFA delivered just what I hoped to read in a book of its size and intended audience, and my expectations were high. If your job requires investigating compromised Windows hosts, you must read WFA.

In the mail today I received a copy of Fuzzing by ninjas Michael Sutton, Adam Greene, and Pedram Amini. H.D. Moore even wrote the foreword, for Pete's sake. However, I have some concerns about this book. I performed a technical review, mainly from the perspective of someone who wants to know more about how to do fuzzing. The drafts I read seemed to be more about how to build a fuzzer. Those of you who are jumping to hit the comment button -- I don't want to hear about "you learn how to fuzz by building a tool." Give me a chance to learn how to walk before I try to invent a new method of transportation! We'll see how the book reads in printed form when I review it.

Comments

dre said…
Ok I won't say what you specifically asked me not to say.

What questions do you have?

Allow me to summarize since I've read this book a few times.

1) Fuzz testing generates faults/errors/crashes through known metacharacter injections (defined as generation) into code inputs that use textual fields -or- usually random (but somehow predetermined) binary data (defined as mutation) into code inputs that use binary streams (often TLV's)

2) Heuristics such as protocol dissection (properly automated with a proxy fuzzer ), genetic algorithms, and bioinformatics usually make better mutation-based fuzzers. Generation-based fuzzers have good pre-programmed lists (see the OWASP testing guide v2 for a fairly basic list).

3) Fuzzer tracking takes source code, or reversed binary/bytecode complexity metrics (code and path coverage) and determines how to start fuzzing and when to stop fuzzing. These are the same metrics that QA gathers in order to show that the program's inputs have been tested, and to what percentage. As an example, Java programmers typically use EMMA or Clover to do this at build time (using ANT, similar to GNU make), and/or in their IDE (with, e.g. EclEMMA).

4) Intelligent fault detection monitors the application under test while fuzz testing occurs and checks the responses. If a crash occurs, a fuzzer stepper will detect if the crash was due to one fuzz test, or by some sort of combination of tests. In order to detect errors (any out-of-bounds exception) that do not cause a crash (such as off-by-one's) the application must be frozen in state while being attached to and checked before un-freezing. Additionally, if you check out the PaiMei crash binning routines, you'll note that they are capable of further automating and cataloging faults by referencing stack unwind information from each recorded crash into a tree list. Each
test case can then be classified by path as well as exception address.
Stack unwinding would be most useful to stack based buffer overflows, but with SBI/DBI it would be possible to look at bounds checking on the heap or possibly other areas of memory as well. Dynamic binary instrumentation would additionally allow insight into errors accumulating before a crash occurs, giving the fuzz tester a head start to finding a vulnerability.

I didn't even need the book to gather most of this information, as the authors have already written an article for DDJ entitled, Requirements for effective fuzzing"

That's all the theory you really need to know.t
7:32 AM
Anonymous said…
This comment has been removed by a blog administrator.
6:50 AM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more