FUZZCON EUROPE RECORDINGS

Shipping Secure Software Should Be Easier!

Sergej Dechand

Sergej Dechand is CEO and co-founder of Code Intelligence. Moreover, he is an expert with years of experience in software testing and usable security at Frauenhofer FKIE.

Presentation topics:

• In the introduction, he will give us a short and entertaining introduction to fuzzing and automated security testing.
• What are current pain points and challenges of modern security testing? And how can we support developers to find and fix bugs as early as possible? 

Towards Systematic and Dynamic Task Allocation for Collaborative Parallel Fuzzing 

Thuan Pham

Thuan Pham is a Lecturer in Cybersecurity at the University of Melbourne. He has been working on scalable and high-performance fuzz testing to improve the reliability & security of software systems.

Presentation topics:

• Research on graph partitioning and search algorithms to propose a systematic and dynamic task allocation solution that works at the macro-task level
• How tool called AFLTeam achieved higher code coverage compared to the default parallel mode of AFL and discovered zero-day bugs in FFmpeg and JasPer toolkits

API level fuzzing: how to harden your REST endpoints

Madalin Ilie

APIs are everywhere, Madalin Illie says.  Thus, he wrote a tool called CATS which removes the boring part out of API testing, by letting QA Engineers focused on the creative side of testing.

Presentation topics:

• How to generate hundreds of API tests within seconds with no coding effort
• What types of testing are covered by the Fuzzers

Input Languages for Effective and Focused Fuzzing

Rafael Dutra and Rahul Gopinath

Rafael Dutra and Rahul Gopinath are currently postdoctoral researchers working on static and dynamic analysis of software at CISPA Helmoltz Center for Information Security.

Presentation topics:

• The ways in which fuzzers can be enhanced with an input language specification, in order to enable focused fuzzing and reach deeper parts of the code
• Input languages that are expressed as context-free grammars
• Fuzzing of binary file formats, such as MP4 or ZIP
• A new tool FormatFuzzer 

12 Angry Developers - A Qualitative Study on Developers’ Struggles with CSP

Lea Gröber

Lea Gröber is a Doctoral Student at CISPA Helmholtz Center for Information Security.

Presentation topics:

• Usable security and privacy issues
• Cross-Site Scripting attacks
• Do the standards and content security policies prevent XSS-vulnerabilities in practice?

Jazzer 2.0: Taking Java Fuzzing to the Next Level

Fabian Meumertzheim

Fabian Meumertzheim is a Senior Software Engineer at Code Intelligence and one of the leading engineers behind Jazzer, Code Intelligence’s open-source fuzzer for JVM-based languages.

Presentation topics:

• The features that Jazzer has gained since its initial release
• macOS and Windows support 
• Autofuzz – start fuzzing with just a .jar and a method name
• Bug detectors for certain high-severity vulnerability classes 

Fuzzing for Security Airworthiness

Paul Butcher

Paul Butcher, the spokesman for AdaCore, works with civilian aerospace safety regulations.

Presentation topics:

• Additional guidelines for international aerospace regulatory bodies
• Security-focused software development tools that are aligned with the objectives stated within the avionics security standards
• Vulnerability identification and security measure quality assessment within a plan for security aspects of certification