Browser Fuzzing at Mozilla | Hacker News Reader

Browser Fuzzing at Mozilla

hacks.mozilla.org

232 pointsgbrown_25 comments

They don’t seem to be using a fuzzer that uses a “smart” way of creating new inputs based on previous inputs that revealed novel execution paths, as done in the AFL fuzzer ( https://en.m.wikipedia.org/wiki/American_fuzzy_lop_(fuzzer) ).

I wonder why that is— that always struck me as a particular elegant approach, and I know AFL has been used to find tons of bugs in various popular open source projects. There was a popular article on HN a while back where AFL even “learned” how to generate valid jpg image file headers.

I believe they use libfuzzer to test isolated components [0], but seems like they wanted to specifically focus on browser fuzzing for this post (it's probably more interesting, too).

[0]: https://firefox-source-docs.mozilla.org/tools/fuzzing/fuzzin...

The state space is too large for these algorithms to be effective on Firefox as a whole, and there are many libraries we just don't care about when browser fuzzing.

eg. if AFL/libFuzzer manages to hit a path that makes an input appear as gz encoded, the "novel" zlib coverage is very attractive to the algorithm, but that's a very inefficient way to fuzz zlib.

Most of these libraries are targeted specifically by OSS-Fuzz [0] and their integration into Firefox is fuzzed with libFuzzer using the fuzzing interface andrei mentioned.

0: https://google.github.io/oss-fuzz/

What about the decrease in paid security professionals?

AFL is not that smart. If you only do bit flippings on the inputs, then fuzzing a JavaScript engine/dom engine will take forever. The "domino" (Mozilla internal tool) looks quite powerful as it generates semantically correct dom. Sadly, it is not open source. Google has a tool designed specifically to fuzz JavaScript engines, Fuzzilli[1], which hackers have been using for bug hunting.

[1]: https://github.com/googleprojectzero/fuzzilli

I wonder why domino hasn't been released? Is Mozilla selling it to other companies?

Because it often finds security issues in our code: see the graph at the end of the blog post.

If opensource, this fuzzer could be used against our users...

AFAIK, Mozilla doesn't sell any software!

Mozilla sells VPN products ;) But no, not these tools.

VPN products are more like a service than selling software.

does mozilla or chrome have some sort of sandbox containership?

"firefox containers"

That only "sandboxes" websites from each other, not from the system. Firefox has a sandbox but it's not Firefox Containers.

Yes, Firefox uses the same sandbox as Chromium. https://wiki.mozilla.org/Security/Sandbox/Specifics

Note that there are some holes in the Firefox sandbox that don't exist in the Chromium one: https://bugzilla.mozilla.org/show_bug.cgi?id=1129492

yes but only for Windows it seems

Firefox uses seccomp-bpf on Linux and the platform sandbox on macOS.

Might be a bit off topic, but does building Firefox from source use your default profile, or is it separate?

A local build of Firefox can use any profile you like, but by default, the “mach run” build script will create a separate new profile for testing.

It depends on which branch you checked out before you built. By default you'll normally end up with a checkout of 'mozilla-central', in which case it will use a separate profile.

Fuzzing is probably the only AI that's actually in general use so far.

Most of the others AIs are more the product really, like Chess I guess?

Well, let's ask. "Hey Google, is what is AI used in?". My Google Home responded that AI is used in virtual assistants and autonomous flying among other things. She sent me a link with more info on my phone. So it sounds like it might have some other uses :P

10,000 people working on Alexa and every time I use my Firestick it can't even search the right data, that's before we even start talking about the voice recognition quality. I wish we had virtual assistants so it could tell me a media player that actually works like it's 2021.

A good Fuzzer would probably replace a few 100 of these workers.

Amazon Says It Has Over 10,000 Employees Working on Alexa - https://www.wsj.com/articles/amazon-says-it-has-over-10-000-...

I think you have serious misconceptions of the capabilities a fuzzer has.

I'm aware 10,000 workers is part hyperbole and mostly not coders more like HR, managing, translations and marketing but I'm pretty sure you could kill off 100 people without hurting the product given how it stands so even if the fuzzer did nothing it could replace 100 people.

But it could test UI both voice and graphical, test inputs, test codebase, test load balancing, find security issues, it could help with marketing and translations. I also think a fuzzer could beat a manager at doing their job, but that's probably cynicism. You'd be better using the fuzzer at getting useless managers re-assigned.

I work on fuzzers professionally, and I wouldn't consider them any sort of "AI." Genetic programming, maybe.

Reply on news.ycombinator.com