The CERT Basic Fuzzing Framework (BFF) is a software testing tool that
finds defects in applications that run on the Linux and Mac OS X
platforms. BFF performs mutational fuzzing on software that consumes
file input. (Mutational fuzzing is the act of taking well-formed
input data and corrupting it in various ways, looking for cases that
cause crashes.)
The BFF automatically collects test cases that cause
software to crash in unique ways, as well as debugging information
associated with the crashes. The goal of BFF is to minimize the effort
required for software vendors and security researchers to efficiently
discover and analyze security vulnerabilities found via fuzzing.
Traditionally fuzzing has been very effective at finding security
vulnerabilities, but because of its inherently stochastic nature
results can be highly dependent on the initial configuration of the
fuzzing system. BFF applies machine learning and evolutionary
computing techniques to minimize the amount of manual configuration
required to initiate and complete an effective fuzzing campaign. BFF
adjusts its configuration parameters based on what it finds (or does
not find) over the course of a fuzzing campaign. By doing so it can
dramatically increase both the efficacy and efficiency of the
campaign. As a result, expert knowledge is not required to configure
an effective fuzz campaign, and novices and experts alike can start
finding and analyzing vulnerabilities very quickly.
Some of the specific features BFF offers are:
- Minimal initial configuration is required to start a
fuzzing campaign - Minimal supervision of the fuzzing campaign is required,
as BFF can automatically recover from many common problems
that can interrupt fuzzing campaigns - Uniqueness determination through intelligent backtrace
analysis - Automated test case minimization reduces the effort
required to analyze results by distilling the test case to the
minimal changes to the input data required to induce a
specific crash - Online machine learning applied to fuzzing parameter and
input file selection to improve the efficacy of the
campaign - Distributed fuzzing support
- Crash severity / exploitability triage
