Finding vulnerabilities in binary codes using tainting/fuzzing analysis

Abstract

Recently, cyber attacks on clients and servers have rapidly increased. Most of these attacks have exploited the underlying vulnerabilities in the target software. Unfortunately, identifying and correcting these vulnerabilities has become extremely difficult and time consuming since (1) most security analyses are based on hard to understand binary representation of the software, (2) most binary codes are too large to be analyzed by a human being, and (3) most software updates or patches are done either regularly or frequently, each of which requires security analysis. Therefore, what we need is a more efficient approach to software security analysis. In response to this concern, experts are now examining tainting and fuzzing techniques as viable alternatives to improve software security. In this article, we present an efficient method for software security analysis using tainting and fuzzing techniques. © 2012 Springer-Verlag.