Name: Fuzz Testing
Uploaded: 2022-03-21
Duration: 6 min 12 s
Description: Hey everyone my name is Robert, and I am here today to make a presentation about Fuzz Testing..

[Audio] Hey everyone my name is Robert, and I am here today to make a presentation about Fuzz Testing.. 

Scene 1

COMP-4800 Selected Topics in Software Engineering Presented by: Robert Odoh March 22, 2022

Table of Contents. Introduction Uses of Fuzz Testing Pros and Cons Types of Fuzzers Fuzz Testing Tools Steps to Successful Fuzz Testing Fuzz Testing in the Automotive Industry Common Challenges Conclusion. 

Scene 2

Introduction Uses of Fuzz Testing Pros and Cons Types of Fuzzers Fuzz Testing Tools Steps to Successful Fuzz Testing Fuzz Testing in the Automotive Industry Common Challenges Conclusion

[Audio] What is Fuzz Testing, Put simply, fuzzing introduces unexpected inputs into a system and watches to see if the system has any negative reactions to the inputs that indicate security, performance, or quality gaps or issues. Barton Miller, a professor at the University of Wisconsin, invented fuzz testing in 1989.. 

Scene 3

A picture containing text Description automatically generated

What is Fuzz Testing? Fuzz testing or fuzzing is an automatic software program checking out approach that injects in-valid, malformed, or surprising inputs into a system to expose software defects and vulnerabilities. A fuzzing device injects those inputs known as FUZZ into the system and then monitors for exceptions, including crashes or records leakage. This method introduces unexpected inputs right into a system and watches to see if the machine has any negative reactions to the inputs that suggest safety, performance, or satisfactory gaps or troubles. Background In step with fuzzing.info, the term “fuzz” was created via Professor Barton Miller inside the Nineteen Eighties. Logged right into a UNIX device via a dial-up community throughout a storm, Miller observed significant interference at the signal. The interference, in the end, led to a crash. Miller later had his college students simulate his revel in the use of a fuzz generator to bombard UNIX structures with noise to peer if they might crash .

[Audio] Why do Fuzz Testing
Usually, Fuzzy testing finds the most serious security fault or defect. Fuzz testing is used to check the Vulnerability of software. Fuzzing is one of the most common methods hackers used to find the vulnerability of the system.. 

Scene 4

Why do Fuzz Testing? Usually, Fuzzy testing finds the most serious security fault or defect. Fuzz testing gives more effective results when used with Black Box Testing, Beta Testing, and other debugging methods. Fuzz testing is used to check the vulnerability of software. It is a very cost-effective testing technique. These vulnerabilities can be exploited by way of square injection, buffer overflow, denial of service (DOS), and move-website scripting. These are often utilized by malicious hackers to disable security with the cause of both taking down a system or stealing facts.  Fuzz testing is one of the black box testing techniques. Fuzzing is one of the most common methods hackers used to find the vulnerability of the system. Fuzzing can frequently reveal severe defects which might be overlooked while the software is written and debugged.

IDENTIFY
THE
TARGET
GENERATE
FUZZED DATA
IDENTIFY
INPUT
VECTORS
EXECUTE THE
TEST CASES
LOC
DUMPS
ANALYSIS
ENGINE
UNDERSTAND Fuzz
VECTORS
SYSTEM
UNDER
TEST
Monitor
FAULT CRASH
DUMP INFO

[Audio] The advantages of Fuzz Testing include: Fuzz testing improves software Security Testing.
If any of the bugs fail to get noticed by the testers due to the limitation of time and resources those bugs are also found in Fuzz testing.
Presents results with little attempt - as soon as a fuzzer is up and strolling, it may be left for hours, days, or months to search for bugs without an interaction. The disadvantages of Fuzz Testing include:
Fuzz testing alone cannot provide a complete picture of an overall security threat or bugs.
To perform effectively, it will require significant time.. 

Scene 5

Graphical user interface

Description automatically generated

Advantages Fuzz testing improves software Security Testing. Bugs found in fuzzing are sometimes severe and most of the time used by hackers including crashes, memory leaks, unhandled exceptions, etc. If any of the bugs fail to get noticed by the testers due to the limitation of time and resources those bugs are also found in Fuzz testing. Presents results with little attempt - as soon as a fuzzer is up and strolling, it may be left for hours, days, or months to search for bugs without an interaction. Disadvantages Fuzz testing alone cannot provide a complete picture of an overall security threat or bugs. Fuzz testing is less effective for dealing with security threats that do not cause program crashes, such as some viruses, worms, Trojan, etc. Fuzz testing can detect only simple faults or threats. To perform effectively, it will require significant time.

[Audio] Fuzzers that modify existing data samples to produce new test data are known as mutation-based fuzzers.
Generation-Based Fuzzers create new data based on the model's input. It starts from the beginning, producing input depending on the requirements.
The most successful fuzzer is PROTOCOL-BASED- FUZZER, which has extensive knowledge of the protocol format being tested.. 

Scene 6

Examples of Fuzzers Mutation-Based Fuzzers alter existing data samples to create new test data. This is the straightforward approach; this starts with valid samples of protocol and keeps mangling every byte or file. Generation-Based Fuzzers define new data based on the input of the model. It starts generating input from the scratch based on the specification. PROTOCOL-BASED-fuzzer: The understanding depends on the specification. It involves writing an array of the specification into the tool then by using the model-based test generation technique going through the specification and adding irregularity in the data contents, sequence, etc. This is also known as syntax testing, grammar testing, robustness testing, etc. Fuzzer can generate test cases from an existing one, or they can use valid or invalid inputs.

[Audio] A fuzzing tool injects these inputs into the system and then monitors for exceptions such as crashes or information leakage. Burp Suite, Peach Fuzzer, Spike Proxy, Webscarab, and other online security tools may be utilized extensively in fuzz testing.. 

Scene 7

Peach Fuzzer:  Peach Fuzzer provides more robust security coverage than a scanner. Other testing tools can search only for known threads whereas Peach Fuzzer enables users to find known and unknown threats. Spike Proxy: It is a professional-grade tool looking for application-level vulnerabilities in web applications. SPIKE Proxy covers the basics, such as SQL Injection and cross-site scripting, but it’s completely open Python infrastructure. SPIKE Proxy is available for Linux and Windows. Webscarab: Webscarab is written in Java thus portable to many platforms. For analyzing application Webscarab framework is used that communicates using HTTP and HTTPS protocols. OWASP WSFuzzer: WSFuzzer is a GPL’d program written in Python. GPL’d a program that currently targets Web Services. In the current version of OWASPWSFuzzer HTTP based SOAP services are the main target.

Logo

Description automatically generated with low confidence

Icon

Description automatically generated

[Audio] Steps to Successful Fuzz Testing Step 1) Identifying the target system Step 2) Identifying inputs Step 3) Generating Fuzzed data Step 4) Executing the test using fuzzy data Step 5) Monitoring the system behavior Step 6) Logging defects. 

Scene 8

Step 1) Identify the target system Step 2) Identify inputs Step 3) Generate Fuzzed data Step 4) Execute the test using fuzzy data Step 5) Monitor system behavior Step 6) Log defects

STEP
STEP
Identify Inputs
STEP
Generate Fuzzed Data
STEP
F z zed D a t a
Monitor System Behaviour
STEP
........................................................-....O Log Defects

A picture containing text, compact disk

Description automatically generated

[Audio] With each passing year, vehicles emerge as greater complicated and linked. International data corporation predicts that via 2023, almost 70% of worldwide new light-duty cars and trucks may have embedded connectivity. While this connectivity provides consumers the comfort they demand, it will increase the automobile's attack floor – USB connections, linked entertainment, navigation systems, and wireless systems. This makes car cybersecurity testing even more crucial to prevent criminals from stealing the automobile and compromising automobile systems, privateness, and safety of occupants.. 

Scene 9

With each passing year, vehicles emerge as greater complicated and linked. International data corporation predicts that via 2023, almost 70% of worldwide new light-duty cars and trucks may have embedded connectivity.  While this connectivity provides consumers the comfort they demand, it will increase the automobile’s attack floor – USB connections, linked entertainment, navigation systems, and wireless systems.  This makes car cybersecurity testing even more crucial to prevent criminals from stealing the automobile and compromising automobile systems, privateness, and safety of occupants. There is increasing computational complexity within the connected car, and with the advent of autonomous vehicles, how do manufacturers test for cyber-security assurance? The fuzz test is a successful black-box testing method that hackers have used to find security weaknesses in various domains.  Therefore, should the fuzz test, mentioned (without any details) in SAE J3061, be applied more widely into the vehicle systems development process to help reduce vulnerabilities?

How automotive and technology experts see the future of connected vehicles

[Audio] The following are the common challenges when fuzz testing:
Where to start fuzzing?
How to fuzz complex systems with dependencies? The dependencies within the automobile software make it difficult for builders to fuzz the programs nicely and the guide attempt remains very high
How to integrate fuzz testing into the CI/ CD? Developers, safety specialists, and managers must be on the identical page about the consequences of these modifications and the way they affect certain methods.. 

Scene 10

1.	Where to start fuzzing? When developers put into effect fuzz trying out for the first time, they often begin with low finances, with little to no fuzzing revel in, and no expert support. 2.	How to fuzz complex systems with dependencies? Infotainment systems in current automobiles typically speak with a whole range of outside sensors. The dependencies within the software make it difficult for builders to fuzz the programs nicely and the guide attempt remains very high. Therefore, your long-term aim needs to be to fuzz the software constantly and to simulate the input from the ones embedded systems concurrently. 3.	How to integrate fuzz testing into the CI/CD?        Integrating fuzz testing into the CI/CD can help scale the advantages of this technique. However, for successful integration, constant communication is fundamental. Developers, safety specialists, and managers must be on the identical page about the consequences of these modifications and the way they affect certain methods.

[Audio] In conclusion, Fuzzing cannot guarantee the detection of bugs completely in an application. Remember… there is also a human component to automated bug finding
Thank you for your time and listening to my presentation. Please feel free to ask any questions. 

Scene 11

In Software Engineering, Fuzz testing shows the presence of bugs in an application. Fuzzing cannot guarantee the detection of bugs completely in an application. But using the Fuzz technique ensures that the application is robust and secure, as this technique helps to expose most of the common vulnerabilities. When it comes to fuzzing it is often better to keep it simple before proceeding to more complex challenges. For example, always start fuzz testing automotive software with a simple C/C++ library that already got tested by your security experts. This way you can get a better feeling for the fuzzing process. Later, you can work your way up to more complex projects step-by-step.  In many cases, fuzz testing will find a lot of new bugs in already tested C/C++ libraries, even if you thought this code was safe.   (Remember… there is also a human component to automated bug finding.)

Fuzz Testing

Scene 0

Hey everyone my name is Robert, and I am here today to make a presentation about Fuzz Testing.

avatar

Put simply, fuzzing introduces unexpected inputs into a system and watches to see if the system has any negative reactions to the inputs that indicate security, performance, or quality gaps or issues.

Barton Miller, a professor at the University of Wisconsin, invented fuzz testing in 1989.

Usually, Fuzzy testing finds the most serious security fault or defect.

Fuzz testing is used to check the Vulnerability of software.

Fuzzing is one of the most common methods hackers used to find the vulnerability of the system.

Fuzz testing improves software Security Testing.

If any of the bugs fail to get noticed by the testers due to the limitation of time and resources those bugs are also found in Fuzz testing.

Presents results with little attempt - as soon as a fuzzer is up and strolling, it may be left for hours, days, or months to search for bugs without an interaction.

The disadvantages of Fuzz Testing include:

Fuzz testing alone cannot provide a complete picture of an overall security threat or bugs.

To perform effectively, it will require significant time.

Fuzzers that modify existing data samples to produce new test data are known as mutation-based fuzzers.

Generation-Based Fuzzers create new data based on the model's input.

It starts from the beginning, producing input depending on the requirements.

The most successful fuzzer is PROTOCOL-BASED-FUZZER, which has extensive knowledge of the protocol format being tested.

A fuzzing tool injects these inputs into the system and then monitors for exceptions such as crashes or information leakage.

Burp Suite, Peach Fuzzer, Spike Proxy, Webscarab, and other online security tools may be utilized extensively in fuzz testing.

Step 4) Executing the test using fuzzy data

With each passing year, vehicles emerge as greater complicated and linked.

International data corporation predicts that via 2023, almost 70% of worldwide new light-duty cars and trucks may have embedded connectivity.

While this connectivity provides consumers the comfort they demand, it will increase the automobile's attack floor – USB connections, linked entertainment, navigation systems, and wireless systems.

This makes car cybersecurity testing even more crucial to prevent criminals from stealing the automobile and compromising automobile systems, privateness, and safety of occupants.

The following are the common challenges when fuzz testing:

How to fuzz complex systems with dependencies?

The dependencies within the automobile software make it difficult for builders to fuzz the programs nicely and the guide attempt remains very high

How to integrate fuzz testing into the CI/CD?

Developers, safety specialists, and managers must be on the identical page about the consequences of these modifications and the way they affect certain methods.

In conclusion,  Fuzzing cannot guarantee the detection of bugs completely in an application.

Remember… there is also a human component to automated bug finding

Thank you for your time and listening to my presentation.