Exploring Deficiencies in Automatic Vuln Mining Technology
Explore the limitations of automatic vulnerability mining technology in this conference talk from the Hack In The Box Security Conference. Delve into the analysis and testing of representative tools like libFuzzer, AFL, KLEE, and QSYM, and understand why they fall short compared to manual code review. Examine example codes that demonstrate these tools' deficiencies and learn about the fundamental issues in current state-of-the-art techniques. Discover the proposed "variable constraint back propagation" method based on LLVM bitcode and STP constraint solver, which aims to address these shortcomings. Gain insights into improving software testing processes, finding untested code in fuzzed software, and potentially leveraging these deficiencies to enhance software security against automated tools.