Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Triforce: Run AFL on Everything

nccgroup.trust

Post reply on HN
Print view View original

11–17 of 17 posts

Re: Project Triforce: Run AFL on Everything

#11

Post by dyn- »

616c wrote: post #7

So I am still reading through their Linux container security paper, and I like their stuff, but who are these NCC people? In the last few months I have seen multiple postings on their papers and blog posts, seemingly out of nowhere, never having heard of them pry to the container paper.

Glad to hear it. As mytummyhertz said, NCC Group (where we both work) is made up in the US from iSEC Partners, Matasano Security and Intrepidus Group consultancies (who were all purchased by NCC Group in the last few years). In the UK it's primarily NGS. iSEC Partners/Matasano/Intrepidus Group/NGS have published research/security presentations/tools (sslyze) etc for years.

Re: Project Triforce: Run AFL on Everything

#12

Post by 616c »

dyn- wrote: post #11
616c wrote: post #7

So I am still reading through their Linux container security paper, and I like their stuff, but who are these NCC people? In the last few months I have seen multiple postings on their papers and blog posts, seemingly out of nowhere, never having heard of them pry to the container paper.

Glad to hear it. As mytummyhertz said, NCC Group (where we both work) is made up in the US from iSEC Partners, Matasano Security and Intrepidus Group consultancies (who were all purchased by NCC Group in the last few years). In the UK it's primarily NGS. iSEC Partners/Matasano/Intrepidus Group/NGS have published research/security presentations/tools (sslyze) etc for years.

I am kind of new to the infosec scene. I was curious because your stuff seems thorough, but the new TLD domain made me wonder where you all came from, like rebranding or something else. Sounds like a little column A, little column B.

My favorite quick security tool on Linux is firejail, which uses seccomp-bpf under the hood. So I was quite excited to see in your container paper discussion of that and the interaction of Linux subsystems I do not really grok.

Keep up the good work. Obviously not all for me, but I benefit. :-)

Re: Project Triforce: Run AFL on Everything

#13

Post by dyn- »

616c wrote: post #12
dyn- wrote: post #11

Earlier quoted context omitted.

Glad to hear it. As mytummyhertz said, NCC Group (where we both work) is made up in the US from iSEC Partners, Matasano Security and Intrepidus Group consultancies (who were all purchased by NCC Group in the last few years). In the UK it's primarily NGS. iSEC Partners/Matasano/Intrepidus Group/NGS have published research/security presentations/tools (sslyze) etc for years.

I am kind of new to the infosec scene. I was curious because your stuff seems thorough, but the new TLD domain made me wonder where you all came from, like rebranding or something else. Sounds like a little column A, little column B. My favorite quick security tool on Linux is firejail, which uses seccomp-bpf under the hood. So I was quite excited to see in your container paper discussion of that and the interaction…

Thanks, firejail is a nice little tool. Yeah the .trust TLD isn't a rebranding or anything, just another NCC Group side-project.

Re: Project Triforce: Run AFL on Everything

#16

Post by stevekemp »

CGamesPlay wrote: post #6
mytummyhertz wrote: post #5

Earlier quoted context omitted.

checkout the details of the project, the idea is that you can run AFL on arbitrary VMs (like your rails VM)! just need to have your test cases, your userland harness, and the addresses to monitor for "panics"

AFL can fuzz ruby by running ruby on arbitrary inputs. This tests that paths through the ruby interpreter are being stressed. AFL cannot fuzz ruby code using the same mechanism, because it does not have the right level of insight. AFL can't detect if a branch in my ruby code was tested, only that the code for `if` in the core ruby interpreter has been tested both ways. For this reason, in order to properly test inter…

> AFL can fuzz ruby by running ruby on arbitrary inputs.

If you're brave (consider "system rm -rf /home") this is worth doing. I recently ran such a fuzzing test against GNU Awk.

Unfortunately the bugs I reported are still unfixed, but it didn't take too long to find them, and it was a good learning exercise:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816271

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816277

I'm sure passing "random" input to Perl, Python, Ruby, and many other languages will lead to similar results.

Re: Project Triforce: Run AFL on Everything

#17

Post by mytummyhertz »

stevekemp wrote: post #16
CGamesPlay wrote: post #6

Earlier quoted context omitted.

AFL can fuzz ruby by running ruby on arbitrary inputs. This tests that paths through the ruby interpreter are being stressed. AFL cannot fuzz ruby code using the same mechanism, because it does not have the right level of insight. AFL can't detect if a branch in my ruby code was tested, only that the code for `if` in the core ruby interpreter has been tested both ways. For this reason, in order to properly test inter…

> AFL can fuzz ruby by running ruby on arbitrary inputs. If you're brave (consider "system rm -rf /home") this is worth doing. I recently ran such a fuzzing test against GNU Awk. Unfortunately the bugs I reported are still unfixed, but it didn't take too long to find them, and it was a good learning exercise: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816271 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=81…

i've actually used AFL to find some input parsing bugs in Perl, Python, and Ruby.

Perl was the team who fixed them the fastest.

none of the teams (rightly) considered these particularly high impact.

Post reply on HN