|
Cornelius Aschermann
@
is_eqv
|
|
PhD on Fuzzing and Stuff
|
|
|
126
Tweetovi
|
113
Pratim
|
347
Osobe koje vas prate
|
| Tweetovi |
| Cornelius Aschermann proslijedio/la je tweet | ||
|
Mattias Meeta
@m_e_e_t_a
|
4. velj |
|
Locating Patriot Batteries through Radar Interference with freely downloadable Satellite data:
medium.com/@HarelDan/x-ma… pic.twitter.com/LdLakzQV2B
|
||
|
||
|
|
Cornelius Aschermann
@is_eqv
|
4. velj |
|
fix'd by adding this to .vimrc
"w!! writes files with root rights
cmap w!! w !sudo tee % > /dev/null
|
||
|
|
||
|
|
Cornelius Aschermann
@is_eqv
|
31. sij |
|
huge fan of this presentation style:
marctenbosch.com/quaternions/
I would love to see tooling to create this kind of presentation/blogpost easily.
|
||
|
|
||
| Cornelius Aschermann proslijedio/la je tweet | ||
|
Andrea Fioraldi
@andreafioraldi
|
30. sij |
|
Happy to announce a new LLVM instrumentation for AFL++ called CmpLog that feeds the fuzzer with comparisons operands extracted with SanCov.
github.com/vanhauser-thc/…
I used it to build the Redqueen mutator in AFL++!
|
||
|
|
||
| Cornelius Aschermann proslijedio/la je tweet | ||
|
Caroline Lemieux
@cestlemieux
|
25. sij |
|
Check out the RLCheck preprint! Cool idea to try and use reinforcement learning to tune generators to generate more valid (assumption-satisfying) inputs. With @SameerReddy0 @moarbugs @koushik77
carolemieux.com/rlcheck_prepri… pic.twitter.com/zm6THQXS6x
|
||
|
|
||
|
|
Cornelius Aschermann
@is_eqv
|
22. sij |
|
Congratulations! twitter.com/ScepticCtf/sta…
|
||
|
|
||
| Cornelius Aschermann proslijedio/la je tweet | ||
|
Sceptic
@ScepticCtf
|
21. sij |
|
Picked up my badge for #S4x20. I will be talking about the push for PLC security and how disregarding system components has rendered such efforts fruitless. Join me on Wednesday morning for @bl4ckic3's and my take on the pros and cons of allowing low-level PLC access. pic.twitter.com/z7cNwodnHA
|
||
|
|
||
| Cornelius Aschermann proslijedio/la je tweet | ||
|
Marcel Böhme
@mboehme_
|
11. sij |
|
AFLNet is a pretty awesome tool for fuzzing network protocols! Our tool paper reports on implementation and strong first results (e.g., CVE-2019-7314).
Stay tuned for more improvements and a full-fledged evaluation. twitter.com/ThuanpvNus/sta…
|
||
|
|
||
| Cornelius Aschermann proslijedio/la je tweet | ||
|
Dominik
@domenuk
|
3. sij |
|
The Fuzzing Round Table Video from #36c3 hosted by @andreafioraldi and me and featuring @is_eqv and many more.
Sorry for the sound, it could be a lot better but is understandable at least.
youtu.be/Nw3v21Zz2g8
|
||
|
|
||
| Cornelius Aschermann proslijedio/la je tweet | ||
|
|
Andrea Fioraldi
@andreafioraldi
|
26. pro |
|
New blogpost: Sanitized Emulation with QEMU-AddressSanitizer
andreafioraldi.github.io/articles/2019/…
I just open-sourced my QEMU patches to fuzz binaries with ASan, QASan. You can also use it with ARM targets on Linux, a thing that you can't do with LLVM ASan!
|
||
|
|
||
| Cornelius Aschermann proslijedio/la je tweet | ||
|
Bryan Cantrill
@bcantrill
|
31. pro |
|
If you are a C or C++ programmer somehow still on the fence about whether or not you should take #rustlang seriously, consider this piece from Cliff Biffle an absolute must-read: cliffle.com/blog/m4vga-in-…
|
||
|
|
||
|
|
Cornelius Aschermann
@is_eqv
|
27. pro |
|
Anyone at #36c3 wants to discuss Fuzzing/RE/Program Analysis/anything really, hmu
|
||
|
|
||
|
|
Cornelius Aschermann
@is_eqv
|
27. pro |
|
events.ccc.de/congress/2019/… (Tomorrow, 20:00 in M2)
|
||
|
|
||
|
|
Cornelius Aschermann
@is_eqv
|
27. pro |
|
You'll be at the fuzzing round table, I assume?
|
||
|
|
||
| Cornelius Aschermann proslijedio/la je tweet | ||
|
|
Dominik
@domenuk
|
26. pro |
|
'Tis the season #36c3
If you're into fuzzing don't miss the meetup on day 2 at 8pm.
See you around :) twitter.com/andreafioraldi…
|
||
|
|
||
|
|
Cornelius Aschermann
@is_eqv
|
18. pro |
|
We absolutely do! I was working on it some time ago, but it is surprisingly difficult to find a good test set. I personally believe measuring code coverage found on a diverse set of targets is the best approach, others think we actually need to find bugs....
|
||
|
|
||
|
|
Cornelius Aschermann
@is_eqv
|
18. pro |
|
Undefined behavior is always a bug.
No matter what behavior you expect, the compiler can change it without notice. Consider github.com/mruby/mruby/is…
The compiler simply removed security relevant code due to an integer overflow, but only under specific circumstances...
|
||
|
|
||
|
|
Cornelius Aschermann
@is_eqv
|
18. pro |
|
Also, you always have to mind the nature of academic publishing: Its a lot easier to publish a paper, if the evaluation follows a known path. If you'd base your paper on something else, I would expect, that at least one (less informed) reviewer would take offense.
|
||
|
|
||
| Cornelius Aschermann proslijedio/la je tweet | ||
|
|
Andrea Fioraldi
@andreafioraldi
|
13. pro |
|
I and @domenuk are organizing a round table about new directions in #fuzzing at #36c3
events.ccc.de/congress/2019/…
We'll try to not overlap fuzzing talks (we can change the time slot later if the room is available). Join if you're in the fuzzing loop (we'll publish a signup form ASAP)
|
||
|
|
||
| Cornelius Aschermann proslijedio/la je tweet | ||
|
|
Marcel Böhme
@mboehme_
|
9. pro |
|
"Time Travel Testing for Android apps" accepted at @ICSEconf! Congrats @zhendon01965406, Lucia and Abhik! Preprint and tool will be available soon. 1/4 pic.twitter.com/pdBPq8obhF
|
||
|
|
||