The cloud runs on REST APIs. In this paper, we study how to {\em intelligently} generate data payloads embedded in REST API requests in order to find data-processing bugs in cloud services. We discuss how to leverage REST API specifications, which, by definition, contain data schemas for API request bodies. We then propose and evaluate a range of data fuzzing techniques, including structural schema fuzzing rules, various rule combinations, search heuristics, extracting data values from examples included in REST API specifications, and learning data values on-the-fly from previous service responses. After evaluating these techniques, we identify the top-performing combination and use this algorithm to fuzz several Microsoft Azure cloud services. During our experiments, we found 100s of ``\texttt{Internal Server Error}'' service crashes, which we triaged into 17 unique bugs and reported to Azure developers. All these bugs are reproducible, confirmed, and fixed or in the process of being fixed.
Tue 10 NovDisplayed time zone: (UTC) Coordinated Universal Time change
08:00 - 08:30 | |||
08:00 2mTalk | Boosting Fuzzer Efficiency: An Information Theoretic PerspectiveACM SIGSOFT Distinguished Paper Award Research Papers Marcel Böhme Monash University, Australia, Valentin Manès KAIST, South Korea, Sang Kil Cha KAIST, South Korea DOI | ||
08:03 1mTalk | CrFuzz: Fuzzing Multi-purpose Programs through Input Validation Research Papers Suhwan Song Seoul National University, South Korea, Chengyu Song University of California at Riverside, USA, Yeongjin Jang Oregon State University, USA, Byoungyoung Lee Seoul National University, South Korea DOI | ||
08:05 1mTalk | Detecting Critical Bugs in SMT Solvers Using Blackbox Mutational Fuzzing Research Papers Muhammad Numair Mansur MPI-SWS, Germany, Maria Christakis MPI-SWS, Valentin Wüstholz ConsenSys, Fuyuan Zhang MPI-SWS, Germany DOI Pre-print | ||
08:07 1mTalk | Fuzzing: On the Exponential Cost of Vulnerability Discovery Research Papers DOI | ||
08:09 1mTalk | Harvey: A Greybox Fuzzer for Smart Contracts Industry Papers DOI Pre-print | ||
08:11 1mTalk | Intelligent REST API Data Fuzzing Research Papers Patrice Godefroid Microsoft Research, USA, Bo-Yuan Huang Princeton University, USA, Marina Polishchuk Microsoft Research, USA DOI | ||
08:13 1mTalk | MTFuzz: Fuzzing with a Multi-task Neural Network Research Papers Dongdong She Columbia University, USA, Rahul Krishna Columbia University, USA, Lu Yan Shanghai Jiao Tong University, China, Suman Jana Columbia University, USA, Baishakhi Ray Columbia University, USA DOI Pre-print | ||
08:15 15mTalk | Conversations on Fuzzing Research Papers Dongdong She Columbia University, USA, Muhammad Numair Mansur MPI-SWS, Germany, Marcel Böhme Monash University, Australia, Suhwan Song Seoul National University, South Korea, Valentin Wüstholz ConsenSys, M: Mike Papadakis University of Luxembourg, Luxembourg | ||