0

Is software fuzzing safe (Anerican fuzzy lop or AFL for example)? What's its probability of producing a random input that can make the program

  • Delete a file or
  • Connect to a random server

into a program?

Improve this question
12
  • 6
    Figuring that out is the whole point of fuzzing. Fuzzing tests if the software behaves unexpectely.
    – schroeder ♦
    Commented Apr 28, 2019 at 9:15
  • 3
    Let me explain: if the program has the function to do something, fuzzling can potentially trigger that functionality.
    – schroeder ♦
    Commented Apr 28, 2019 at 9:30
  • 4
    @mike1024: The probability is between 0 and 100%. The specific value depends FULLY on the specific program and the way you fuzz it. Just make sure that there is nothing to harm in the environment you fuzz if you don't want harmful things to happen accidentally.
    – Steffen Ullrich
    Commented Apr 28, 2019 at 9:40
  • 3
    @mike1024: I have no idea how you come to this conclusion. I did not say anything like this and I would also not agree to this. Like I said, it depends fully on the specific program and the way you fuzz it. You narrowed down the program a little bit (but really only a little) but not specify at all how do you fuzz it.
    – Steffen Ullrich
    Commented Apr 28, 2019 at 9:46
  • 2
    @mike1024 Unless it already has routines for connecting to a server, then it's very unlikely. Opening a network connection requires a number of very specific syscalls to be called with the right arguments in the right order, which is only likely if there exist functions to do that. Even if it did connect to another server though, it's not like it would do anything (again, assuming the program is not designed for networking in general).
    – forest
    Commented Apr 28, 2019 at 10:09

1 Answer 1

Reset to default
6

There's no way to give you a probability for every program, but I can say that no it is not safe to run a fuzzer on a program with access to a filesystem that you do not want damaged. While programs that do not do any I/O at all are much less likely to delete or modify files, it is still absolutely possible. I have had data on filesystems damaged (and in one case, the filesystem itself got corrupted) as a result of fuzzing with AFL. Thankfully in my case, the program only had access to an empty partition...

Improve this answer
2
  • 1
    Thank you. So VMs are recommended for the job I guess..
    – mike1024
    Commented Apr 28, 2019 at 9:59
  • Just use a virtual machine and you should be fine. That's what I usually do
    – Niek N.
    Commented Apr 29, 2019 at 10:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .