4 ms·
People certainly do find security vulnerabilities by reading source code.
by mccr8 12y ago
People certainly do find security vulnerabilities by reading source code.
- trequartista 12y agoIIRC the Google researcher discovered the Heartbleed bug when he was auditing the OpenSSL code
- ScottBurson 12y agoThe Codenomicon team found it using a fuzzer. My recollection is that the Google researcher also used a fuzzer, but I can't find any evidence of that in a brief search.
- snowwrestler 12y agoThe nasty Drupal bug from last October was discovered when a (name withheld) company in Europe paid for a professional security audit of Drupal's open-source code. Thankfully when they found the bug, they contributed the patch back to the community.