EH2008 - 0.1

Easterhegg 2008
Follow the white rabbit

Speakers
Daniel Mende
Schedule
Day Ostersonntag (2008-03-23)
Room 416
Start time 16:00
Duration 04:00
Info
ID 2469
Event type workshop
Track Hacking
Language used for presentation en

The Art of Protocol Fuzzing

Der Workshop ist aus meinem talk auf der ShmooCon (und Simons Talk auf der DayCon) entstanden (beschreibung unten) und bietet eine einfuehrung in fuzzing im allgemeinen und später layer2 fuzzing im speziellen. Es gibt eine Einfuehrung in sulley und unsere layer2 ergänzungen und danach einige übungen in denen auch die teilnehmer aktiv protokoll-beschreibungen schreiben und auch gegen entsprechende devices fuzzen koennen.

The talk is based on a research project whose goal was to evaluate the security of network devices used in carrier space. After some (very short) introduction into the main concepts of fuzzing (in particular of network protocols) we will explain which options of existing fuzzers and frameworks we found and why we finally chose SPIKE. Given SPIKE has no Layer2 functionality by default we were forced to write some additional modules like a (libnet-based) generic Layer 2 packet generator and lots of SPK-scripts for different protocols. We will describe this development process, the pitfalls and lessons learned. Furthermore we will release all the code and discuss the results of performing extensive fuzz-testing of network devices and some common operating systems.