Fuzz testing has become the de facto standard for vulnerability discovery. In this paper we study 32 prominent protocol implementations that have been continuously fuzzed by OSS-Fuzz, a widely used fuzzing platform. We define metrics to measure fuzzing activity within a project and correlate our measurements with registered CVEs for discovered vulnerabilities. Our analysis show a strong correlation between fuzzing activity and registered CVEs within a project. However, by using the CWE-1000 analys framework, we find that the correlation is only strong for certain classes of vulnerabilities.

Fuzz testing has become the de facto standard for vulnerability discovery. State-of-the-art fuzzers employ a so-called gray-box approach,where coverage information is fed back to the fuzzer after each generated test case, thereby allowing it to effectivize its generationstrategy over time to find bugs deep within the code. Despite research efforts in recent years, networked applications have proven tobe notoriously difficult to fuzz efficiently and thoroughly. Modern fuzzers struggle with the complex environmental interactions andstatefulness associated with networked systems and subsequently, shortcuts are taken to ensure at least some degree of hardening.

In this paper we study 32 prominent protocol implementations that have been continuously fuzzed by OSS-Fuzz. We define metricsto measure fuzzing activity within a project and correlate our measurements with registered CVEs for discovered vulnerabilities. Our analysis show a strong correlation between fuzzing activity and registered CVEs within a project. However, by using the CWE-1000 analys framework, we show that the correlation is only strong for certain classes of vulnerabilities. From those observations, we areable to draw conclusions about what current fuzzing practices are lacking and where fuzzing research efforts need to be spent in thefuture.

This technical report is an extension of doi:10.1145/3672608.3707730, which has been published with ACM in the SAC 2025 conference proceedings.

Work life is rapidly developing owing to digitalization and new work practices. As a consequence, intensive training is needed for working people to acquire new skills and knowledge. Such training might require larger efforts of weeks or months of full time work in order for professionals to get started on new roles at work. For this type of education, the boot camp format may be suitable. It is characterized by a focus on essentials in contents, scheduled work time, and social interaction and support amongst the course participants. This paper presents learning from boot camp training of conscript soldiers and it extends the experiences to training of working professionals. The novelty of the endeavor for the university is that the courses are given on a remote site by instructors without expert knowledge in the field; the university provides curated contents, formal examination and support to the instructors. This setup works well and has been in production for four years with minimal adjustments. It builds on good communication with the instructors, on teaching material structured for independent study, and on peer support among the students. We contrast the format with the popular massive open online courses and discuss how the boot camp format scales in terms of number of courses and course participants with respect to resources, primarily the time of the responsible teachers. The conclusion is that boot camp training should be considered for professional education and that it might not be more demanding for the teachers than any other course format.

To handle the complexity of modern technical systems, the operator often relies on some kind of graphical user interface software. Such software typically provides statistics, visualization and remote management capabilities to the operator. Today, this software is usually implemented using various web technologies. This lets operators monitor and manage the system in question with a tool familiar to most people today, namely their web browser. Unfortunately, web technology comes with plenty of intricate and unexpected caveats and flaws that can lead to unpredictable and sometimes even insecure behavior. In this paper, we focus on how one such obscure flaw, cross-channel scripting, can affect communications and service-provider networks. We provide a testing framework for detecting such flaws and use it to test four different open-source network management systems. Three vulnerabilities were found and acknowledged and fixed by the developers and one CVE was assigned.

Cybercampus Sweden is a national initiative to provide education, research, innovation and advice in cybersecurity and cyber-defense. This brochure addresses needs for cybersecurity training and education. The contents are fictitious courses created from the outcomes of a planning workshop on agile education, conducted by the planning project for Cybercampus Sweden, held on October 17, 2022.

Service providers are adopting open-source technology and open standards in their next-generation networks. This gives them great flexibility and spurs innovation. But it also means that they must ensure proper interoperability between components; otherwise, vulnerabilities might get introduced in their networks. Unfortunately, state-of-the-art vulnerability scanning tools are unable to handle the complexity of service provider networks. In this letter we show how interoperability issues between seemingly reliable components introduce an injection vulnerability that allows us to control a firewall-protected network management system. We also extend the state-of-the-art in black-box fuzzing to give service providers a tool for combating similar issues.

I denna rapport har jag sammanställt bakgrundsinformation och övergripande förslag för att öka högskolans utbud av fortbildning[1] för yrkesverksamma. Såväl företag och branschorganisationer som fackföreningar uttrycker en efterfråga som inte möts idag. Därför börjar rapporten med behovet av fortbildning och korta genomgångar av möjligheter som redan finns för att etablera en betydande verksamhet.

Sedan diskuteras frågan om anslagsfinansierad kontra uppdragsfinansierad fortbildning samt utformning av fortbildningskurser. Jag skissar sedan på en ändamålsenlig organisation för ett verksamhetsstöd.  Sist i rapport föreslår jag en handlingsplan som bör följas av en genomförandeplan med konkreta, realiserbara erbjudanden och samarbeten.

Jag gör inga anspråk på att handledningen täcker alla väsentliga områden för fortbildning vare sig  i stort eller för enskilda utbildningsområden. Den är ämnad som en utgångspunkt för arbeten med att ta fram ett utbud och en organisation för att erbjuda fortbildning till yrkesverksamma i en större omfattning än vad som sker idag. 

For a software system to be reliable, it must manage its resources properly. Failure to do so will result in unreliable behaviour: an application that leaks memory will eventually crash, a packet source that overloads a queue may cause other systems to fail, a process that consumes too many CPU cycles will degrade the performance of other processes and so on. Resource leaks or resource exhaustion are difficult to discover during testing as it may happen slowly over a long time. One approach for discovering issues with reliability, security and robustness is fuzzing (short for fuzz testing). Fuzzing can take many forms, depending on what type of system is to be tested and what kinds of bugs one is after. Black-box fuzzing is arguably the most flexible approach to fuzzing. Unfortunately, it suffers from a low efficiency that makes it slow at finding bugs such as resource leaks. In this paper we explore the topic of black-box fuzzing by modeling it as a multi-armed bandit problem, an important subclass of the general reinforcement learning problem. We believe that by utilizing a reinforcement learning framework, black-box fuzzing can be better understood and attention can be drawn to the field, which deserves to be studied more. We also implement a fuzzer according to our model and evaluate it against a toy implementation of a simple protocol with a known resource leak. Lastly, we apply our fuzzer in a real-world case study against two widely distributed implementations of the Link Layer Discovery Protocol (LLDP), a key component in critical infrastructure applications such as network management and network automation. Our results show that our fuzzer gradually learns how to effectively trigger the resource leak in the toy implementation, thereby speeding up the bug discovery process. In the case study, the fuzzer struggles to learn from the observations it makes about the test target. We believe this to be because of excessive delays between the actions the fuzzer takes during testing and their corresponding effects. Despite this, our fuzzer still manages to find one resource leak in each of the two LLDP implementations, one of which was previously unknown. With this paper, we have taken the first steps towards a better understanding of black-box fuzzing and that a new generation of smart and highly efficient black-box fuzzers is within reach.

For some 30 years, fuzzing has been a favored methodology for vulnerability discovery and robustness testing by researchers anddevelopers alike. Following the popularity of American Fuzzy Lop and the rise of coverage-guided fuzzing, many state-of-the-art fuzzersemploy heavy instrumentation, work best on small components and often require source code access. For networking equipmentsuch as switches and routers, this may not be feasible. If the software needs to run on or interact with specialized hardware, fuzzingthe equipment on a component level becomes very difficult. Heavy instrumentation may also degrade the performance of the SUTtoo much, thus invalidating the testing. Furthermore, the customers who buy the networking equipment often want to do their ownsecurity or robustness testing, but lack access to the source code.This paper details the design and usage of a grammar-based fuzzing framework and applies it to the Link Layer Discovery Protocol(LLDP), which is commonly used by industrial networking equipment. By modeling the fuzzing campaign as a multi-armed banditproblem, the grammar used to generate frames is able to adapt to observations made by lightweight probes, a novel concept accordingto the author’s knowledge.

Högskoleutbildning för yrkesverksamma kan vara svår att överblicka och förstå. Denna kortfattade text är ämnad att förklara hur högskolor kan hjälpa organisationer med kompetensförsörjning genom att utbilda anställda.