What is Fuzzing and How Did It Find 26 USB Bugs?

Rich Gates May 27, 2020 Security, Software, Test Equipment

Fuzzing is a method of testing with automated software which provides invalid, unexpected, and random data as inputs to a computer program. The testing program then monitors for crashes, assertions and potential memory leaks.

A research team based from Purdue University came up with USBFuzz, which pushes enormous amounts of random data through the USB bus of a system. Hui Peng and Mathias payer (from the Swiss Federal Institute of Tech) came up with the idea and program.

Please don’t lose any sleep over the bugs found.

Peng and Mathias found one bug in FreeBSD, three in MacOS (two resulting in an unplanned reboot and one freezing the system), four in Windows 8 and Windows 10 (resulting in Blue Screens of Death) and the vast majority of bugs, in Linux — 18 in total.

Of all these bugs, Windows users do not need to worry, they have been fixed. Of the 18 found in Linux, 16 of them have been corrected already. Those correct where major security flaws.

What we like about the USBFuzz is the underlying theme to improve the security of the USB platform and continued improvement. We also like USBFuzz becoming an open source bit of code that everyone may use to strengthen thier USB product. The team will release a version on GitHub later this year, 2020.

Tags: usbfuzz

Rich Gates

Administator for GetUSB.info GetUSB.info started in 2004 with the concept of providing USB information for everything USB related. At the time, USB was gaining momentum and every day new products, articles and news became published. Today, the site is focused on bringing technical information, tricks and hacks to USB related products. The site does publish off topic information as well, to keep the variety up. Please visit the footer area of any page if you or your company is interested in article or product placement via purchased advertising.