Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am thinking of trying to make an Android API fuzzer (I never made a fuzzer before, but I understand the concepts), and I was wondering which API calls would be the most interesting ones to fuzz from the security point of view? I think probably SQL, communication and networking stuff would be the place to start but I was wondering if there are any specific ones that I should pay attention to?

share|improve this question
1  
I'd suggest playing around with something a little more accessible first. An Android fuzzer requires you to write a lot of code that talks to the target device, which makes the process quite a bit more complex. – Polynomial Jul 26 '12 at 11:53
    
@Polynomial - would it be plausible to create a fuzzer as an android app, and monitor the output of fuzzing through adb->logcat (android debug bridge (shell))? I thought that would give me the right kind of access to what the fuzzer would output. – pootzko Jul 26 '12 at 12:01
1  
Yes, that's a viable solution. However, you're still going to need to capture the fault and dig through for info. I'm not telling you not to try it, I'm just saying it might be a good idea to try something local (e.g. Windows / Linux) first. – Polynomial Jul 26 '12 at 12:05

There is a project building android fuzzers from the polytechnic institute of Singapore here: http://androidfuzzing.com/

Have a look what they are doing.

share|improve this answer
    
At the time of writing the link is not working. – gns-ank Feb 12 at 16:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.