Edward Bonver — Symantec

Testing software for security encompasses a variety of different security testing tools and techniques. One such technique is fuzzing data files, which is producing many variants of the original data files by mutating their contents. The goal is to make the software under test interact with the fuzzed files, in hopes of either crashing the software or making it behave unexpectedly.

Intelligent fuzzing is a more sophisticated type of fuzzing than dumb (completely random) fuzzing, because it is aware of the internal data layout of the file and targets specific data blobs. The hope is that this will allow it to bypass file integrity checks that may already be in place.

We argue that if software under test interacts with data or configuration files in any way, it is crucial to use fuzzing (more specifically intelligent fuzzing) to test the security of the software.

---