Software Quality Assurance, Fuzzing and the Discovery of Buffer
Overflows By Aviram Jenik A homeowner thinks to secure himself
using a lock that can only be opened with the correct key. The
burglar may ignore the complexities of lock-picking and try to
slide a flexible plastic sheet through the gap between the door
and the door jamb to push the catch back. In other words, the
burglar attacked the door in a way that was unforeseen.
Similarly, hackers break into applications by addressing normal
access points in ways that developers didn't intend or foresee.
A very common method of forcing entry is by buffer overflow. The
tools used most often by hackers to discover buffer overflow
weaknesses; fuzzers. Developers produce applications that, to a
greater or lesser degree, adheres to a protocol as closely as
possible. QA then tests application functionality against that
protocol in the perfect world of the testing laboratory. But
when the application is released, hackers will bash away at it
with every possible co