Computer scientist, Ph.D.
Москва, Россия
Joined December 2020
- Tweets102
- Following128
- Followers53
- Likes546
Pinned Tweet
We implemented the rule engine in our eBPF-based security monitoring agent Bombini: github.com/bombinisecurity/b…
Rule evaluation is blazingly fast and works entirely in eBPF!
Check out the docs: bombinisecurity.github.io/bo…
Contributions are welcome!
#ebpf #security #Kubernetes
Andrey Fedotov retweeted
🐝New Cilium Contributor🐝
The newest Cilium contributor is @anfedotoff
They helped add support for user mode stack traces in events.
github.com/cilium/tetragon/p…
Andrey Fedotov retweeted
The blog post about the libwebp vulnerability fuzzing is up, it explains how I set up the experiment, how the crash was found and why oss-fuzz was not able to find it: srlabs.de/blog-post/advanced… #fuzzing @metzmanj
Andrey Fedotov retweeted
As there is quite some interest about finding the libwebp bug with fuzzing, I will write a blog entry about this next week #fuzzing
My talk about #casr at OFFZONE 2023!!!
Slides:
offzone.moscow/upload/iblock…
Video (in Russian):
youtu.be/EgEeICZQD9M
#fuzzing
CASR 2.7.0 is available!
github.com/ispras/casr/relea…
Andrey Fedotov retweeted
Simply deduplicate and create reports for #UndefinedBehaviorSanitizer warnings with Casr: casr-ubsan -i corpus -o out -- /fuzz_target @@
github.com/ispras/casr/blob/…
#casr #defectdojo #vulnerabilitymanagement #VulnerabilityAssesment #AppSec #DevSecOps
Andrey Fedotov retweeted
Almost a year after my defense, my PhD thesis "Automated Security Testing of Unexplored Targets Through Feedback-Guided Fuzzing" is now archived on the university server 🎉
We fuzzed Nvidia drivers, tcp servers, basebands, WebAssembly, ..
Enjoy reading :)
depositonce.tu-berlin.de/ite…
Andrey Fedotov retweeted
casr-dojo: upload new and unique #crash reports found by #fuzzing to @defectdojo vulnerability management system: github.com/ispras/casr/blob/…
#casr #defectdojo #vulnerabilitymanagement #VulnerabilityAssesment #AppSec #DevSecOps #cpp #rust #go #python
github.com/ispras/casr/relea…
#casr 2.6.0, what's new:
casr-libfuzzer tool for triaging crashes found by libFuzzer based fuzzers (C/C++/go-fuzz/Atheris)
kodama crate for clustering instead of python scipy
RISCV support
#fuzzing
Andrey Fedotov retweeted
Spice up your binary program analysis with TritonDSE !
A blog post by Christian Heitman and @RobinDavid1 introducing our framework for Dynamic Symbolic Execution in Python
#symexec #fuzzing #opensource
blog.quarkslab.com/introduci…
ALT Code path variety is the spice of life, now in Python.
Andrey Fedotov retweeted
I wish tutorial articles would all have a date when they got published and last updated. Followed a tutorial which was not working, spent time trying to fix it and then found out the API has been changed in 2017
Andrey Fedotov retweeted
As it turns out, compilers happily spill the index for indirect jumps through a jump table after bounds checking, creating a TOCTTOU race for arbitrary control-flow hijacking. Check out our @HexHiveEPFL @IEEESSP "WarpAttack" paper: nebelwelt.net/files/23Oaklan…
Andrey Fedotov retweeted
casr-libfuzzer: triage crashes in C/C++/Go/Python code found by libFuzzer/Atheris/go-fuzz
casr-libfuzzer -o out -- /fuzz_target
github.com/ispras/casr
#casr #fuzzing #libfuzzer #atheris #go #python #cpp
github.com/ispras/casr/relea…
#casr 2.5.0, what's new:
#libcasr: library for crash triage, stacktrace parsing, severity estimation, and collecting crash reports.
Crash triaging for Go panics
AARCH64 support
#fuzzing
Andrey Fedotov retweeted
Excited to present new(?) approach to #fuzzing where one doesn't need to write fuzz functions.
Wanna fuzz all binaries on github - no problem.
Just give the fuzzer binaries to test. No false positives & 100% fidelity.
Blender: whole-program fuzzing:
github.com/dvyukov/centipede…
Very nice collection of publications about #fuzzing: google.github.io/fuzzbench/p…
My blog post about #fuzzing #go project golang/image: github.com/ispras/oss-sydr-f…
0. Changing existing fuzz target to find new bugs.
1. Approach for code coverage collection after fuzzing with go-fuzz libFuzzer.
2. Go panic triage with #casr.
3. Fix: github.com/golang/image/pull…
Andrey Fedotov retweeted
Auto-fuzz: we recently pushed a tool for auto generation of Python #fuzzers and #OSS-Fuzz integrations. Early days, but it can create some valid integrations and many pieces will come together in the near future -- follow along :)! github.com/ossf/fuzz-introsp…
Not the first time I'm convinced that using more the one fuzzer/symbolic executor it's a good idea. Just used @aflplusplus on known image-rs targets and found some issues:
github.com/image-rs/image-ti…
github.com/image-rs/image/is…
#fuzzing
