Event-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug

Learning from known vulnerabilities is a must for every security researcher, and subscribing to the major vendors' monthly public bulletins and security patch updates is the first thing security researchers do at the beginning of each month.The value of an enlightening security vulnerability is not only to reveal significant attack surfaces and exploit scenarios but also to inspire deeper digging as an important input to bug hunting. From a period of work on security vulnerability analysis and tracking, we have concluded several approaches to finding bugs over bugs, which apply to both mature products security research and efficient finding vulnerabilities of customized products. Through such patterns, we have developed a targeted fuzzer and written specific CodeQL/Weggli rules, and we found plenty of security vulnerabilities in Chrome and Android devices...

By: Qingyu Li , Huinian Yang

Full Abstract and Presentation Materials: