How are bugs found ?

Hello!

Ok.. so I know my way arround with C, C++, Assembly on x86, Python, Perl, PHP and I'd like to get into security research. All of the above are self tought ..

I'm not very sure how exactly people discover bugs. (I'm not talking about "accidents") Is there a "scientific" method (or "brute" method?) to find bugs in a programe? Assuming the source code is relatively big .. I suppose trying to read it and discover security bugs this way is pretty .. impossible in many cases ?

So I suppose you can use Fuzzers .. [does anyone have a good resource for theory on this subject ?] ..

How else can one discover security bugs ?

The first and most easy but important method is 'usage'. Alfa and Beta testers (intenral and external) will discover much of the bugs in the software including certain security problems.

Next extensive fuzz testing is a good idea, cause the fuzz is going to find errors a human tester does not. But still the human tester is essential.
http://en.wikipedia.org/wiki/Fuzz_testing
http://fuzz.sourceforge.net/

aptesting
http://www.aptest.com/resources.html

Bleh, finding bugs is an art form.

Look at how something is supposed to work, try all those options then think of wild ways to misuse the app and you'll shake out a healthy pile of em.

The art comes into play based on the quality of your imagination of misuse.

--TH13

OK, I now have a challenge as to try to not make this sound pompous or pedantic.

A bug is an error in the functionality of a system. Basically, that bit doesn't work properly.

Flaws, weaknesses, or whatever, arise where the system does work properly if it is used properly . However, if you make mistakes, it will let you, and screw up as a result.

When these situations allow the system security to be compromised they are "vulnerabilities"

Please remember that security problems are not "bugs" per se. A hell of a lot of them are simple design errors :D

Quote:

---

Originally posted here by nihil
OK, I now have a challenge as to try to not make this sound pompous or pedantic.

A bug is an error in the functionality of a system. Basically, that bit doesn't work properly.

Flaws, weaknesses, or whatever, arise where the system does work properly if it is used properly . However, if you make mistakes, it will let you, and screw up as a result.

When these situations allow the system security to be compromised they are "vulnerabilities"

Please remember that security problems are not "bugs" per se. A hell of a lot of them are simple design errors :D

---

I'm going to disagree... those definitions look like they came out of the Hackers Dictionary 3rd Edition from the early 90s... That's definatley how they were defined... but that definition hasn't been accurate in at least the last 5 years or so...

define: bugs on google

Quote:

---

A computer bug is an error, flaw, mistake, failure, or fault in a computer program that prevents it from working correctly or produces an incorrect result. Bugs arise from mistakes and errors, made by people, in either a program's source code or its design. It is said that there are bugs in all useful computer programs, but well-written programs contain relatively few bugs, and these bugs typically do not prevent the program from performing its task. ...

---

As to finding them... I concur with TH13 that it's an art...

However, there's a lot of things that you can do..

Reverse Engineering,
Fuzzing
Repetitive Use
Improper Use
Read the Source Code
Read the Documentation
Proper Use
....

What you listed above is that you know how to program.... don't assume that the two go together... they don't... now if it was programming and coding an exploit... they go to together... There are many aspects to finding and accurately demonstrating a flaw / vuln... and even so they are quite often stumbled upon by accident... during other work.

Peace
HT

There are also projects (also Microsoft has that kind of research) that focus on finding bugs algorithmically. The source code is analysed and a special model is created. Then using heuristics the state space of this model is checked. All the possible combinations are verified and thus the bugs can be found.