Concept

Heartbleed

Publications associées (15)

Arvin: Greybox Fuzzing Using Approximate Dynamic CFG Analysis

Fuzzing has emerged as the most broadly used testing technique to discover bugs. Effective fuzzers rely on coverage to prioritize inputs that exercise new program areas. Edge-based code coverage of the Program Under Test (PUT) is the most commonly used cov ...

ASSOC COMPUTING MACHINERY2023

ACTOR: Action-Guided Kernel Fuzzing

Mathias Josef Payer

Fuzzing reliably and efficiently finds bugs in software, including operating system kernels. In general, higher code coverage leads to the discovery of more bugs. This is why most existing kernel fuzzers adopt strategies to generate a series of inputs that ...

Usenix Assoc2023

MINERVA: Browser API Fuzzing with Dynamic Mod-Ref Analysis

Mathias Josef Payer, Yu Jiang, Chijin Zhou

Browser APIs are essential to the modern web experience. Due to their large number and complexity, they vastly expand the attack surface of browsers. To detect vulnerabilities in these APIs, fuzzers generate test cases with a large amount of random API inv ...

Assoc Computing Machinery2022

PROFACTORY: Improving IoT Security via Formalized Protocol Customization

Mathias Josef Payer, Fei Wang, Duo Xu, Xiangyu Zhang

As IoT applications gain widespread adoption, it becomes important to design and implement IoT protocols with security. Existing research in protocol security reveals that the majority of disclosed protocol vulnerabilities are caused by incorrectly impleme ...

USENIX ASSOC2022

Seed Selection for Successful Fuzzing

Mathias Josef Payer

Mutation-based greybox fuzzing-unquestionably the most widely-used fuzzing technique-relies on a set of non-crashing seed inputs (a corpus) to bootstrap the bug-finding process. When evaluating a fuzzer, common approaches for constructing this corpus inclu ...

ASSOC COMPUTING MACHINERY2021

Gramatron: Effective Grammar-Aware Fuzzing

Mathias Josef Payer

Fuzzers aware of the input grammar can explore deeper program states using grammar-aware mutations. Existing grammar-aware fuzzers are ineffective at synthesizing complex bug triggers due to: (i) grammars introducing a sampling bias during input generation ...

ASSOC COMPUTING MACHINERY2021

FuZZan: Efficient Sanitizer Metadata Design for Fuzzing

Mathias Josef Payer

Fuzzing is one of the most popular and effective techniques for finding software bugs. To detect triggered bugs, fuzzers leverage a variety of sanitizers in practice. Unfortunately, sanitizers target long running experiments-e.g., developer test suites-not ...

USENIX ASSOC2020

Load-induced dynamical transitions at graphene interfaces

Gabriel Aeppli, Ming Ma

The structural superlubricity (SSL), a state of near-zero friction between two contacted solid surfaces, has been attracting rapidly increasing research interest since itwas realized in microscale graphite in 2012. An obvious question concerns the implicat ...

National Academy of Sciences2020

Automatic generation of program execution that reaches a given failure point

George Candea, Cristian Zamfir

An execution of a target software program that causes a particular bug to manifest itself is generated. A target software program is received. A bug report generated by an execution of the target software program is received. The bug report describes a par ...

2015

Efficient State Merging in Symbolic Execution

George Candea, Johannes Kinder, Volodymyr Kuznetsov, Stefan Bucur

Symbolic execution has proven to be a practical technique for building automated test case generation and bug finding tools. Nevertheless, due to state explosion, these tools still struggle to achieve scalability. Given a program, one way to reduce the num ...

ACM2012

Efficient State Merging in Symbolic Execution

George Candea, Johannes Kinder, Volodymyr Kuznetsov, Stefan Bucur

Assoc Computing Machinery2012

Efficient Testing of Recovery Code Using Fault Injection

George Candea, Paul Dan Marinescu

A critical part of developing a reliable software system is testing its recovery code. This code is traditionally difficult to test in the lab, and, in the field, it rarely gets to run; yet, when it does run, it must execute flawlessly in order to recover ...

2011

Finding Almost-Invariants in Distributed Systems

Dejan Kostic, Marco Canini, Maysam Yabandeh

It is notoriously hard to develop dependable distributed systems. This is partly due to the difficulties in foreseeing various corner cases and failure scenarios while implementing a system that will be deployed over an asynchronous network. In contrast, r ...

2011

An Extensible Technique for High-Precision Testing of Recovery Code

George Candea, Paul Dan Marinescu, Radu Banabic

Thorough testing of software systems requires ways to productively employ fault injection. We describe a technique for automatically identifying the errors exposed by shared libraries, finding good injection targets in program binaries, and producing corre ...

2010

Flexible hardware acceleration for instruction-grain program monitoring

Babak Falsafi, Evangelos Vlachos

Instruction-grain program monitoring tools, which check and analyze executing programs at the granularity of individual instructions, are invaluable for quickly detecting bugs and security attacks and then limiting their damage (via containment and/or reco ...

2008