5 ms·
Project Springfield – Microsoft’s service for finding security-critical bugs
- aaronbrethorst 10y agoVery strange to me to see this codename reused: http://www.artima.com/forums/flat.jsp?forum=152&thread=206079 http://www.artima.com/forums/flat.jsp?forum=152&thread=20607...
- robert_tweed 10y agoShould have called it Project Shelbyville instead. BTW, title should perhaps indicate this is a security-centric fuzzing tool. Possibly a bigger deal than it might seem from the name.
- lancaster78 10y agoDup (15 h): https://news.ycombinator.com/item?id=12583795 https://news.ycombinator.com/item?id=12583795
- huppriy 10y agoHow's this respectable? Especially with regards to efforts such as https://googleprojectzero.blogspot.se/2016/06/a-year-of-windows-kernel-font-fuzzing-1_27.html https://googleprojectzero.blogspot.se/2016/06/a-year-of-wind... It seems to me that either a) Microsoft can't possibly have fuzzed their code for the last 15 years or b) their fuzzer is useless
- zuzun 10y agoMicrosoft has been doing fuzzing for years. They claim to "run the largest fuzzing lab in the world". They incorporated their Z3 solver into their fuzzer, which itself is an awesome piece of technology. What they do sounds really cool and I'd say Microsoft Research is a big authority in the fuzzing field. [PDF] http://research.microsoft.com/en-us/um/people/pg/public_psfiles/SAGE-in-one-slide.pdf http://research.microsoft.com/en-us/um/people/pg/public_psfi...
- creshal 10y ago> Microsoft has been doing fuzzing for years. Then why do we need to rely on Google to fuzz Windows' kernel?
- zuzun 10y agoObviously only Microsoft could explain why they missed these bugs. Maybe they never fuzzed the font parsing parts of the Windows kernel (what a weird thing to say). What I know is that the Project Zero people put a lot of effort into this and they had a large font corpus and mutated inputs based on domain-specific knowledge, maybe that was their key to success.
- xorxornop 10y agoAlso, there is selection bias at work here: we don't hear about all the stuff that the Microsoft fuzzing team does find. And I bet it's a lot. There's no real benefit to them to share their internal findings - it would effectively just be handing 0-days to malware authors on a plate, after all, affecting all users running older versions - and so we get this very skewed view.
- Eridrus 10y agoSAGE/Springfield is a file format fuzzer that relies on being able to instrument the target to extract information about how to change it's fuzzing input. I don't think they've done the work to extend the instrumentation to the Windows kernel. A more apt comparison for this would be looking at how successful other file format fuzzers are at finding bugs in Office.
- huppriy 10y agoThey are actually stating it has been used on Office on the link in the OP. > Battle tested tech > The same state-of-the-art tools and practices used > inside Microsoft to fuzz Windows and Office applications.
- Eridrus 10y agoExactly; looking at how successful other fuzzer are at finding new bugs in Office will give you some sense that SAGE is actually pretty good, just narrow in scope.