2 ms·

> C++ is a monster. I haven’t fuzzed a C++ compiler myself, but our team recently tried fuzzing a relatively simple S-expression-based compiler and discovered

by wslh 2y ago

> C++ is a monster. I haven’t fuzzed a C++ compiler myself, but our team recently tried fuzzing a relatively simple S-expression-based compiler and discovered several issues in a few weeks [1]. I can only imagine what could be uncovered in C++ compilers. If this hypothesis holds, it suggests a significant attack vector that might elude even the smartest security researchers who are only analyzing repository codes and dependencies. [1] "Why the Fuzz About Fuzzing Compilers?": https://www.coinfabrik.com/blog/why-the-fuzz-about-fuzzing-compilers/ https://www.coinfabrik.com/blog/why-the-fuzz-about-fuzzing-c...

JonChesterfield 2y ago
Compiler engineers like fuzz testing. You'll find a bunch of infra for it in llvm. That should mean the easy targets have already been hit, though I wouldn't be too confident of that stance.
- fruffy 2y ago
  Plus there are hordes of academics using Clang/GCC as targets for bug-finding papers. The Csmith [1] paper alone has over a thousand citations at this point. I'd assume most of the low-hanging fruits are picked. [1] https://www.cs.tufts.edu/~nr/cs257/archive/john-regehr/finding-c-bugs.pdf https://www.cs.tufts.edu/~nr/cs257/archive/john-regehr/findi...
  - wslh 2y ago
    In my humble experience, both in academia and the cybersecurity industry, there are relatively few individuals and teams with the drive necessary to discover the most challenging bugs, especially compared to the sheer scale of the challenges. Fuzzing is just one example of this. Additionally, with billions of lines of code, it takes significant time for research to translate into real-world engineering practices. One example of a higher order reasoning about this is [1] (includes metrics). [1] "As TVL rises, so does the probability of being hacked" https://www.bittrap.com/resources/defis-growing-pains:-as-tvl-raises-so-does-the-probability-of-being-hacked https://www.bittrap.com/resources/defis-growing-pains:-as-tv...

by wslh 2y ago

JonChesterfield 2y ago

Compiler engineers like fuzz testing. You'll find a bunch of infra for it in llvm. That should mean the easy targets have already been hit, though I wouldn't be too confident of that stance.

fruffy 2y ago
Plus there are hordes of academics using Clang/GCC as targets for bug-finding papers. The Csmith [1] paper alone has over a thousand citations at this point. I'd assume most of the low-hanging fruits are picked. [1] https://www.cs.tufts.edu/~nr/cs257/archive/john-regehr/finding-c-bugs.pdf https://www.cs.tufts.edu/~nr/cs257/archive/john-regehr/findi...
- wslh 2y ago
  In my humble experience, both in academia and the cybersecurity industry, there are relatively few individuals and teams with the drive necessary to discover the most challenging bugs, especially compared to the sheer scale of the challenges. Fuzzing is just one example of this. Additionally, with billions of lines of code, it takes significant time for research to translate into real-world engineering practices. One example of a higher order reasoning about this is [1] (includes metrics). [1] "As TVL rises, so does the probability of being hacked" https://www.bittrap.com/resources/defis-growing-pains:-as-tvl-raises-so-does-the-probability-of-being-hacked https://www.bittrap.com/resources/defis-growing-pains:-as-tv...