google/oss-fuzz on Hacker News

…it was used to switch between optimized implementations of CRC. So that part was in the git repo. https://github.com/google/oss-fuzz/pull/10667

comment by sp332 · 2024-04-02 · in The xz attack shell script

…tool). There’s an interesting discussion as to whether that would have picked up the vulnerability https://github.com/google/oss-fuzz/issues/11760

comment by jsmith99 · 2024-04-01 · in Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

…a check that may have caught the backdoor, or at least drawn attention to it for unrelated reasons: https://github.com/google/oss-fuzz/pull/10667

comment by 4bpp · 2024-04-01 · in What we know about the xz Utils backdoor that almost infected the world

…to user JiaT75 [xz] Remove JiaT75 as a contact, determine correct contacts #11760 - Google/oss-fuzz https://github.com/google/oss-fuzz/issues/11760 Tuktest index hash #7 - tukaani-project/xz/pull/7 https://web.archive.org/web/20240329230522…

comment by krascovict · 2024-03-31 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…was that the compromised build-scripts had measures to only run when producing deb/rpms. https://github.com/google/oss-fuzz/blob/5f70676a6c9050b9cb68...

comment by filleokus · 2024-03-31 · in XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

…for those projects than critical linux system software. 1. https://lwn.net/Articles/967442/ 2, 3: https://github.com/google/oss-fuzz/pull/10667 4. https://news.ycombinator.com/item?id=39866161

comment by creato · 2024-03-31 · in XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

They also used social engineering to disable fuzzing which would have caught the discrepancy: https://github.com/google/oss-fuzz/pull/10667

comment by joshcryer · 2024-03-30 · in XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

…presumably would have caught it since here's a PR from the attacker asking for it to be disabled: https://github.com/google/oss-fuzz/pull/10667

comment by ReflectedImage · 2024-03-30 · in Debian on xz-utils: revert to version that does not contain changes by bad actor

This PR from July 8 2023 is suspicious, so it was very likely a long con: https://github.com/google/oss-fuzz/pull/10667

comment by gamer191 · 2024-03-30 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…stealing a weakly protected account. The long-con theory seems a bit more plausible at the moment https://github.com/google/oss-fuzz/pull/10667

comment by dralley · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

This is getting addressed here: https://github.com/google/oss-fuzz/issues/11760

comment by miduil · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…for xz? They made themselves the primary contact for xz for Google oss-fuzz about one year ago: https://github.com/google/oss-fuzz/commit/6403e93344476972e9...

comment by ikmckenz · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…to prevent accidental discovery: https://social.treehouse.systems/@Aissen/112180302735030319 https://github.com/google/oss-fuzz/pull/10667 But luckily there was some serendipity: "I accidentally found a security issue while benchmarking…

comment by Aissen · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…all sorts of build options and obviously caused many problems with various sanitizers for example, https://github.com/google/oss-fuzz/pull/10667

comment by bluecheese33 · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…project maybe one way they tried to prevent this particular backdoor being flagged by that tool? https://github.com/google/oss-fuzz/pull/10667

comment by travem · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

https://github.com/google/oss-fuzz/pull/10667

comment by selckin · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…JiaT75 should be reviewed and maybe even rolled back, as they have obliterated their trust. edit: https://github.com/google/oss-fuzz/pull/10667 Even this might be nefarious.

comment by fullstop · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…has done should be investigated. Woha, is this legit or some sort of scam on Google in some way?: https://github.com/google/oss-fuzz/pull/11587 edit: I have to be missing something, or I'm confused. The above author seems to be primary…

comment by bbarnett · 2024-03-29 · in Backdoor in upstream xz/liblzma leading to SSH server compromise

…good fuzzers themselves, but could potentially be hard to build or run or adapt to your codebase. https://github.com/google/oss-fuzz/blob/master/projects/grpc...

comment by Jensson · 2024-03-22 · in Ask HN: Any Good Fuzzer for gRPC?

…Dispelling Myths and Understanding" https://www.fda.gov/media/123052/download?attachment oss-fuzz: https://github.com/google/oss-fuzz : > We support the libFuzzer, AFL++, and Honggfuzz fuzzing engines in combination with Sanitizers, as…

comment by medicalfuzz · 2024-01-14 · in Your pacemaker should be running open source software

…of thing a simple setup can find, see mongoose's (another embedded web server) fuzzer in oss-fuzz: https://github.com/google/oss-fuzz/blob/master/projects/mong... .

comment by costco · 2023-12-30 · in Crashes in HTTP server used in routers found with simple fuzzing

Yes, mosh has fuzz tests in oss-fuzz [1]. [1] https://github.com/google/oss-fuzz/tree/master/projects/mosh

comment by achernya · 2022-11-24 · in Mosh: An Interactive Remote Shell for Mobile Clients (2012) [pdf]

I find it odd that Google's oss-fuzz didn't find this a long time ago. https://github.com/google/oss-fuzz/blob/master/projects/open...

comment by spullara · 2022-11-02 · in The latest OpenSSL vulns were added fairly recently

These might help: * https://github.com/Endava/cats * https://github.com/google/oss-fuzz

comment by asicsp · 2022-05-26 · in Learnings from 5 years of tech startup code audits

It is tested by Google's OSS-Fuzz among others: https://github.com/google/oss-fuzz/tree/master/projects/dav1... One of the bugs found by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11464

comment by zinekeller · 2022-03-19 · in Dav1d, fast AV1 decoder, version 1.0

ffmpeg/libav is being fuzzed with reasonable success. See for example https://github.com/google/oss-fuzz/tree/master/projects/ffmp... and https://security.googleblog.com/2014/01/ffmpeg-and-thousand-... . They found issues in code I…

comment by mikaraento · 2021-12-26 · in All the giant companies used ffmpeg (2020)

For what it's worth, libvips is part of OSS fuzz https://github.com/google/oss-fuzz/tree/a21768ce6a5056d27f82... I thought they mostly fuzz the loaders, which are the most critical, apparently the found bugs present a picture of a pretty…

comment by clon · 2021-12-10 · in Imagor: A fast, Docker-ready image processing server written in Go

Related: https://www.llvm.org/docs/LibFuzzer.html https://github.com/google/oss-fuzz

comment by oenetan · 2021-08-20 · in FuzzBench: Open Fuzzer Benchmarking Platform and Service

…selected values by cross-comparison with other libraries is a very good idea for code like this. https://github.com/google/oss-fuzz

comment by dodobirdlord · 2021-03-23 · in FastDoubleParser: Java port of Daniel Lemires fast_double_parser

…If you're fuzzing open source software, you might consider applying to OSS-Fuzz https://github.com/google/oss-fuzz which provides a lot of free compute power to run fuzzers (so that vulnerabilities can be found & fixed).

comment by dwheeler · 2021-03-12 · in AFL++ Fuzzing Framework

…automated tools on. E.g. glib, cairo, harfbuzz are all continuously fuzzed as part of OSS-Fuzz - https://github.com/google/oss-fuzz/tree/master/projects

comment by abharya · 2020-12-12 · in Finding Critical Open Source Projects

…regression testing which verifies the decoded images against libpng and is fuzzed by OSS-Fuzz ( https://github.com/google/oss-fuzz ) just like libpng.

comment by randy408 · 2019-03-13 · in Libspng 0.4.4 – modern alternative to libpng, single source/header pair

…easiest to just use a homogeneous cloud like Google's data centers or AWS. There's also stuff like https://github.com/google/oss-fuzz which improves productivity. I do think that most software will be tested 24/7 by computers in the…

comment by chubot · 2019-03-08 · in Why isn’t CPU time more valuable?

+1 I can speak a little bit about what motivated us. We saw from OSS-Fuzz ( https://github.com/google/oss-fuzz ) that this sort of thing could be widely useful and wanted non-open source code to benefit from making fuzzing easier.

comment by metzmanj · 2019-02-07 · in Open-Sourcing ClusterFuzz

I don't think so. But solidity was recently added to OSS-Fuzz: https://github.com/google/oss-fuzz/tree/master/projects/soli...

comment by metzmanj · 2019-02-07 · in Open-Sourcing ClusterFuzz

how does this compare to oss-fuzz [0]? is the main value proposition that its easier to set up? [0]: https://github.com/google/oss-fuzz/

comment by kvakil · 2019-01-28 · in The Day I Fell in Love with Fuzzing

…- drop me a line if you're interested - andrei@fuzzbuzz.io [0] - https://fuzzbuzz.io [1] - https://github.com/google/oss-fuzz

comment by andrei-fuzzbuzz · 2018-12-13 · in 50 CVEs in 50 Days: Fuzzing Adobe Reader

…project (only for open source projects, since as Someone1234 noted it's very difficult otherwise): https://github.com/google/oss-fuzz

comment by arkadiyt · 2018-12-13 · in 50 CVEs in 50 Days: Fuzzing Adobe Reader

See the "trophies" here: https://llvm.org/docs/LibFuzzer.html#trophies Also: https://github.com/google/oss-fuzz

comment by Joky · 2018-11-05 · in Generating Software Tests: Breaking Software for Fun and Profit

…time) when compared to AFL. [0] http://www.syssec-project.eu/m/page-media/3/johansson_tfuzz_... [1] https://github.com/google/oss-fuzz [2] https://github.com/mboehme/aflfast

comment by DyslexicAtheist · 2018-04-05 · in Patch runs ed, and ed can run anything

…ing.googleblog.com/2016/12/announcing-oss-fuzz-c... Looks like at least _some_ GNU tools are covered: https://github.com/google/oss-fuzz/tree/master/projects/gnut...

comment by Ajedi32 · 2018-04-05 · in Patch runs ed, and ed can run anything

link to OSS-Fuzz project https://github.com/google/oss-fuzz

comment by ahiknsr · 2017-05-29 · in LibreOffice leverages Google’s OSS-Fuzz to improve quality of office suite

…like Grr, Manticore, Radamsa, KLEE, and Z3. [1] https://www.microsoft.com/en-us/springfield/ [2] https://github.com/google/oss-fuzz

comment by dguido · 2017-04-17 · in The Smart Fuzzer Revolution [video]

Adding a new project doesn't seem too tough. Guide: https://github.com/google/oss-fuzz/blob/master/docs/new_proj...

comment by wyldfire · 2016-12-01 · in Announcing OSS-Fuzz: Continuous Fuzzing for Open Source Software