Cornelius Aschermann

Tommaso Frassetto

Thorsten Holz

Patrick Jauernig

Ahmad-Reza Sadeghi

Daniel Teuchert

NDSS

The Network and Distributed System Security (NDSS) Symposium fosters information exchange among researchers and practitioners of network and distributed system security.

Originally the Workshop on Network and Distributed System Security, the NDSS Symposium was first held in 1993 in San Diego, California. It was organized as a workshop of the Privacy and Security Research Group of the Internet Research Task Force (IRTF) and was hosted by the Internet Society and Lawrence Livermore National Laboratory.

The Internet Society has proudly hosted the NDSS Symposium ever since to foster the next generation of Internet security experts and to support open, accessible, and collaborative security to research to help strengthen the Internet.

The symposium is now a five-day hybrid event including three days of the main NDSS Symposium and two days of co-located workshops and symposia. Each event brings together hundreds of security educators, researchers and practitioners from all over the world. The event is designed to encourage and enable the Internet community to apply, deploy, and advance the state of practical security technologies.

Abstract—Fuzz testing is a well-known method for efficiently identifying bugs in programs. Unfortunately, when programs that require highly-structured inputs such as interpreters are
fuzzed, many fuzzing methods struggle to pass the syntax checks: interpreters often process inputs in multiple stages, first syntactic and then semantic correctness is checked. Only if both checks
are passed, the interpreted code gets executed. This prevents fuzzers from executing “deeper” — and hence potentially more interesting — code. Typically, two valid inputs that lead to the
execution of different features in the target program require too many mutations for simple mutation-based fuzzers to discover: making small changes like bit flips usually only leads to the
execution of error paths in the parsing engine. So-called grammar fuzzers are able to pass the syntax checks by using ContextFree Grammars. Feedback can significantly increase the efficiency
of fuzzing engines and is commonly used in state-of-the-art mutational fuzzers which do not use grammars. Yet, current grammar fuzzers do not make use of code coverage, i.e., they do not know whether any input triggers new functionality. In this paper, we propose NAUTILUS, a method to efficiently fuzz programs that require highly-structured inputs by combining the use of grammars with the use of code coverage feedback. This allows us to recombine aspects of interesting inputs, and to increase the probability that any generated input will be syntactically and semantically correct. We implemented a proofof-concept fuzzer that we tested on multiple targets, including
ChakraCore (the JavaScript engine of Microsoft Edge), PHP, mruby, and Lua. NAUTILUS identified multiple bugs in all of the targets: Seven in mruby, three in PHP, two in ChakraCore, and one in Lua. Reporting these bugs was awarded with a sum of 2600 USD and 6 CVEs were assigned. Our experiments show that combining context-free grammars and feedback-driven fuzzing significantly outperforms state-of-the-art approaches like AFL by an order of magnitude and grammar fuzzers by more than a factor of two when measuring code coverage.


NAUTILUS: Fishing for Deep Bugs with Grammars

今天分享的论文主题是面向语法的灰盒模糊测试，由来自德国波鸿大学和达姆施塔特工业大学的研究人员完成。模糊测试是一种热门的自动化进行程序漏洞测试的方法，近年来，为了涵盖各类待测试的方法和目标，研究人员针对不同的应用场景，设计了多种模糊测试方案。

【论文分享】NAUTILUS：面向语法的灰盒模糊测试方法

NAUTILUS: Fishing for Deep Bugs with Grammars查看来源