Page 1 of 1
MS Asks Google To Delay Fuzzer Tool
Posted: Mon Jan 03, 2011 4:50 pm
by Sabre
/. story
"Polish Google security white hat Michal Zalewski has announced concerns that one of a hundred vulnerabilities his fuzzer tool found in IE is well known to third party hackers in China. His simple explanation provides an interesting counter argument to Microsoft's usual request that security problems not be released until they can slowly investigate them. From the article, 'Microsoft asked Zalewski to delay cross_fuzz's release, but he declined, in part because of his fear the IE vulnerability was already being explored by Chinese hackers, but also because the company's security experts had not responded to information he provided.' You can read about and download cross_fuzz for your own use."
His little tool found 120 vulnerabilities in IE alone... I'd like to see this thing generalized to test all the other browsers as well!
Re: MS Asks Google To Delay Fuzzer Tool
Posted: Mon Jan 03, 2011 5:27 pm
by complacent
fuzzing. it's almost like a meme within a meme.
can't knock it's potential.
can't love the methodology.
Re: MS Asks Google To Delay Fuzzer Tool
Posted: Mon Jan 03, 2011 10:09 pm
by thermatico
Sabre wrote:/. story
"Polish Google security white hat Michal Zalewski has announced concerns that one of a hundred vulnerabilities his fuzzer tool found in IE is well known to third party hackers in China. His simple explanation provides an interesting counter argument to Microsoft's usual request that security problems not be released until they can slowly investigate them. From the article, 'Microsoft asked Zalewski to delay cross_fuzz's release, but he declined, in part because of his fear the IE vulnerability was already being explored by Chinese hackers, but also because the company's security experts had not responded to information he provided.' You can read about and download cross_fuzz for your own use."
His little tool found 120 vulnerabilities in IE alone... I'd like to see this thing generalized to test all the other browsers as well!
There were a couple of links. I think he tested against Chrome, Opera, Firefox, Safari, & Internet Explorer. They all got pwned.
Re: MS Asks Google To Delay Fuzzer Tool
Posted: Mon Jan 03, 2011 10:12 pm
by Sabre
thermatico wrote:There were a couple of links. I think he tested against Chrome, Opera, Firefox, Safari, & Internet Explorer. They all got pwned.
Crap, I should have read it closer! For good Chrome flaws, I know Google was offering up some $$$.