OS Security Is Hard: Why All the Fuzzers in the World Won't Change the Way...
summary
Argues that fuzzers find many simple, recurring OS bugs but don't fix root causes: shows a vp9 array-of-5 overflow and a Windows syscall that writes to bayes address via mi_create_enclave when info_length is zero, plus null-deref and system-call indexing errors, all found by fuzzing; cites large payouts (Microsoft ~$35M, some bounties $10k then cut to $2k, individual 100K+ bounty discoveries) and sparse developer fixes, and calls for education, process changes, and licensing for high-risk kernel code.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:10About me
- 2:15History of OS security
- 5:27Outline of the talk
- 5:53The Bug Bounty Economy
- 12:50The Schooling System
- 15:18Examples
- 25:49Crazy Ideas
- 28:02Licensing Training
- 31:11Creativity
- 33:04Conclusion
related talks
57mI Hate Infosec
06mQ&A
50mSmashing the Stack: Let’s Make It Less Fun And Unprofitable!
39mSoftware Security Engineering (Learnings from the past to fix ...)
01h 03m“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (2 of 2)”
38mBootloaders Under Fire: Real-World Threats and Practical Defenses
31m“Fuzz or lose..."
46mFor The Win: The Art Of The Windows Kernel Fuzzing