EH2008 - 0.1
Easterhegg 2008
Follow the white rabbit
| Speakers | |
|---|---|
|
Daniel Mende |
| Schedule | |
|---|---|
| Day | Ostersonntag (2008-03-23) |
| Room | 416 |
| Start time | 16:00 |
| Duration | 04:00 |
| Info | |
| ID | 2469 |
| Event type | workshop |
| Track | Hacking |
| Language used for presentation | en |
The Art of Protocol Fuzzing
Der Workshop ist aus meinem talk auf der ShmooCon (und Simons Talk auf der DayCon) entstanden (beschreibung unten) und bietet eine einfuehrung in fuzzing im allgemeinen und später layer2 fuzzing im speziellen. Es gibt eine Einfuehrung in sulley und unsere layer2 ergänzungen und danach einige übungen in denen auch die teilnehmer aktiv protokoll-beschreibungen schreiben und auch gegen entsprechende devices fuzzen koennen.
The talk is based on a research project whose goal was to evaluate the security of network devices used in carrier space. After some (very short) introduction into the main concepts of fuzzing (in particular of network protocols) we will explain which options of existing fuzzers and frameworks we found and why we finally chose SPIKE. Given SPIKE has no Layer2 functionality by default we were forced to write some additional modules like a (libnet-based) generic Layer 2 packet generator and lots of SPK-scripts for different protocols. We will describe this development process, the pitfalls and lessons learned. Furthermore we will release all the code and discuss the results of performing extensive fuzz-testing of network devices and some common operating systems.