[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALx_OUBFvik8Yyvs9kj=S2JLVKHem7aD9Ttg7pw7GWSydadC9A@mail.gmail.com>
Date: Tue, 7 Apr 2015 13:27:40 -0700
From: Michal Zalewski <lcamtuf@...edump.cx>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: Hanno Boeck found Heartbleed using afl + ASan!
You know... on some level, I'm happy - but on another, I'm always
trying to be skeptical when such claims are made for other projects.
It's only fair not to treat this case differently.
It's worth remembering that the authors of several static analysis or
symbolic execution frameworks have also claimed that their products
would have found Heartbleed. IIRC, their experiments were far more
convoluted than Hanno's, but the bottom line is that when you're
trying to "discover" a bug you already know about, it's almost
impossible to avoid subconsciously optimizing for the expected
outcome.
So, I always urge people to ask a simple question: would someone think
of running the tool this particular way and on this particular code
before we knew about the bug? And if yes, why haven't they?=)
The answer I've always heard from commercial software vendors is that
"they had no time to work on open source projects", but that's about
as unconvincing as it gets. I bet they would love to be credited for
this or any comparably serious find. Today, I'm asking myself the same
question about AFL. Was it too counterintuitive to set this up? Were
there other barriers to entry? Can I fix this now?
Cheers,
/mz
On Tue, Apr 7, 2015 at 1:00 PM, David A. Wheeler <dwheeler@...eeler.com> wrote:
> FYI:
> Hanno Boeck found Heartbleed using american fuzzy lop combined with Address Sanitizer (ASan):
> https://blog.hboeck.de/archives/868-How-Heartbleed-couldve-been-found.html
>
> I've posted a few additional comments here:
> http://www.dwheeler.com/blog/2015/04/07/#heartbleed-afl-asan
>
> --- David A. Wheeler
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
