Viewing profile — fhenneke

While I agree with most of what you are saying (let's hope that 2021 will finally be "the year of memory-safe languages"), remote code execution issues also affect Java. https://se…

With minor changes to the default exclude list for coverage instrumentation, you can use Jazzer to fuzz the Java standard library (at least the parts that are implemented in Java).…

That depends on the language you want to fuzz. A good general introduction and hands-on "course" for C/C++ is https://github.com/Dor1s/libfuzzer-workshop . If you prefer Java and j…

One of the authors of Jazzer here. Feel free to ask any questions regarding Jazzer ( https://github.com/CodeIntelligenceTesting/jazzer ) or how to integrate Java/JVM projects into …

The FuzzedDataProvider (docs at https://codeintelligencetesting.github.io/jazzer-api/com/cod... ) offers many of the functions you would need to write such a generator. If there is…

Thanks for the link, I wasn't aware of this new feature! Our coverage instrumentation does not rely on JNI calls, only the libFuzzer callbacks do, so the overhead shouldn't be too …

If you want to fuzz a Java web app, our commercial platform CI Fuzz (of which Jazzer is one part) has built-in detectors for the typical vulnerabilities such as SQL injections: htt…

Good catch, thanks ;-) I will update the post.

By default, uncaught exceptions and memory issues in JNI libraries are reported as "crashes". Additionally, Jazzer provides a hooking framework that can be used to implement domain…

I'm one of the engineers behind Jazzer and happy to answer any questions about it. We also have a blogpost that talks about the most interesting technical aspects of Jazzer: https:…

Yes, that is exactly how it works, there is nothing that would require source code access. If you have a Java app packaged as app.jar, all you need to do is write a fuzz target (wi…

I'm one of the engineers behind Jazzer and happy to answer any questions about it. We also have a blogpost that talks about the most interesting technical aspects of Jazzer: https:…

The tokens are engineered to protect the private key material stored inside them very well, so you can be quite certain that nobody will ever be able to log in without physical acc…

You can set a FIDO2 PIN on your security key and it will prevent ssh-keygen/ssh-add from regenerating the key files without it. But the relevant information (the key handle) can al…

The new OpenSSH keys are very convenient if used correctly, but have a crucial disadvantage compared to the PIV-based approach of yubikey-agent: They currently can't be protected e…

You can use Secure Shell for SSH with your Yubikey in the meantime: https://chromium.googlesource.com/apps/libapps/+/HEAD/nassh/...

A Bloom filter with >500M items, even when allowing for a comparatively high rate of false positives such as 1 in 100, is still in the hundreds of MBs, which would not be that much…

I have recently added YubiKey/OpenPGP card support to the official ChromeOS SSH app Secure Shell. While key generation is not yet supported, using an already set up Yubikey for SSH…