Project Springfield – Microsoft’s service for finding security-critical bugs | Hacker News Reader

Project Springfield – Microsoft’s service for finding security-critical bugs

microsoft.com

68 pointsiou11 comments

Dup (15 h): https://news.ycombinator.com/item?id=12583795

How's this respectable? Especially with regards to efforts such as https://googleprojectzero.blogspot.se/2016/06/a-year-of-wind...

It seems to me that either

    a) Microsoft can't possibly have fuzzed
    their code for the last 15 years

    b) their fuzzer is useless

Microsoft has been doing fuzzing for years. They claim to "run the largest fuzzing lab in the world". They incorporated their Z3 solver into their fuzzer, which itself is an awesome piece of technology. What they do sounds really cool and I'd say Microsoft Research is a big authority in the fuzzing field.

[PDF] http://research.microsoft.com/en-us/um/people/pg/public_psfi...

> Microsoft has been doing fuzzing for years.

Then why do we need to rely on Google to fuzz Windows' kernel?

Obviously only Microsoft could explain why they missed these bugs. Maybe they never fuzzed the font parsing parts of the Windows kernel (what a weird thing to say). What I know is that the Project Zero people put a lot of effort into this and they had a large font corpus and mutated inputs based on domain-specific knowledge, maybe that was their key to success.

Also, there is selection bias at work here: we don't hear about all the stuff that the Microsoft fuzzing team does find. And I bet it's a lot. There's no real benefit to them to share their internal findings - it would effectively just be handing 0-days to malware authors on a plate, after all, affecting all users running older versions - and so we get this very skewed view.

SAGE/Springfield is a file format fuzzer that relies on being able to instrument the target to extract information about how to change it's fuzzing input.

I don't think they've done the work to extend the instrumentation to the Windows kernel. A more apt comparison for this would be looking at how successful other file format fuzzers are at finding bugs in Office.

They are actually stating it has been used on Office on the link in the OP.

  > Battle tested tech
  > The same state-of-the-art tools and practices used
  > inside Microsoft to fuzz Windows and Office applications.

Exactly; looking at how successful other fuzzer are at finding new bugs in Office will give you some sense that SAGE is actually pretty good, just narrow in scope.

Very strange to me to see this codename reused: http://www.artima.com/forums/flat.jsp?forum=152&thread=20607...

Should have called it Project Shelbyville instead.

BTW, title should perhaps indicate this is a security-centric fuzzing tool. Possibly a bigger deal than it might seem from the name.

Reply on news.ycombinator.com