Fuzzing has become the dominant dynamic testing approach to find bugs in software. For complex software like Chrome, we observed that fuzzing only reaches around 30% of coverage, i.e., 70% of code is not executed and therefore not tested. While not all code will be reachable in practice, there's …
read moreOther articles
SymCTS: Untangling Symbolic Execution and Fuzzing
Bug discovery has long been a key concern in the field of software security. Bugs are plentiful and many impact security. When bugs are discovered and fixed, the underlying risk is mitigated. A wide variety of techniques exist from formal verification over symbolic execution to fuzzing.
Out of those techniques …
read moreIEEE Symposium on Security and Privacy (Oakland) '26
What a great time at the IEEE Symposium on Security and Privacy (informally called Oakland) in San Francisco. With about 700 attendees, Oakland now seems the smallest of the top four security conferences. It was great to meet many friends and make new ones during the three days of the …
read moreTÄMU: Emulating Trusted Applications
Android runs sensitive applications in the so-called "secure world". These trusted applications (TAs) handle sensitive operations such as authentication, key management, or DRM. As they interact with regular Android applications from the normal world, vulnerabilities in these applications compromise the secure world and give adversaries access to privileged data. Our …
read moreThe AIpocalypse or how LLM-based exploitation is the new normal
In the last 3-4 months, AI models have made an immense jump in exploitation capabilities. Several talks and blog posts highlight the "new" capabilities of frontier AI models. The agents have learned from countless CTF writeups, research papers on exploitation techniques, and conference talks/demonstrations on how to automate diverse …
read moreSysyphuzz: the pressure for more coverage
Fuzzing faces a key challenge: after running for an extensive time, coverage plateaus and will no longer increase despite extensive mutations. Only new seed inputs or mutation operators will likely change that. We have observed that for Syzbot fuzzing in the Linux kernel has essentially plateaued due to Google's multi-year …
read more39c3: Master reset in Hamburg
Another year, another CCC. As every year, I went to Hamburg to appreciate all galactic life forms in their diverse multi-dimensional environment. My goal this year was the usual meet ups with friends I haven't seen in a long time, get inspired for new research directions, to catch some talks …
read moreAISec and the exploration of the Chinese soul
Just a few weeks ago, Chao Zhang invited me to a workshop in AI security at Tsinghua University in Beijing. Chao and myself overlapped as post docs in Dawn Song's BitBlaze group at UC Berkeley and we're both deeply interested in low level systems security, binary analysis, fuzzing, and mitigation …
read moreDroidot: Vulnerable Native Libraries on Android
Android is a complex platform with diverse, concurrently running services. Looking at user-space the assumption is that each app is isolated from all others running on top of the rich Android runtime system. Unfortunately, the available system libraries are heavily limited and Android apps often ship diverse libraries. These libraries …
read more