Event-based Fuzzing, Patch-based Research, and Comment Police - Finding Bugs Through a Bug

Explore advanced techniques for discovering security vulnerabilities in this 29-minute Black Hat conference talk. Delve into the methodologies of event-based fuzzing, patch-based research, and comment analysis to uncover bugs through existing vulnerabilities. Learn how to leverage monthly security bulletins and patch updates from major vendors as a springboard for deeper security research. Discover how these approaches have led to the development of targeted fuzzers and specific CodeQL/Weggli rules, resulting in the identification of numerous security vulnerabilities in Chrome and Android devices. Gain insights from security researchers Qingyu Li and Huinian Yang on how to apply these strategies to both mature products and customized solutions for more efficient bug hunting.

Event-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug