3 ms·
On 2.1, I"m not sure this is security through obscurity. I can send a malicious individual a link to this paper saying I used these techniques on my binary but
by 283b 7y ago
On 2.1, I"m not sure this is security through obscurity.
I can send a malicious individual a link to this paper saying I used these techniques on my binary but fuzzing will still be more difficult.
Just like encryption takes my message and jumbles it up to "obscure it", this technique is adding slowdowns and false paths to hinder the fuzzer.
Knowing my message is encrypted doesn't make it any easier to read, just like knowing my binary has been fuzzification-ified doesn't make it any easier to fuzz. The only thing that would help is giving you the key to my message, or program paths with added complexity to throw off the fuzzer.
- a1369209993 7y agoIf you have the source code[0], you can compile your own version without fuzzification, and any attacks you find will work just as well on the fuzzified executable. This is not true of eg ASLR. If you don't have the source code, it's security through obscurity. 0: Note that obfuscator output is not source code.