CONFidence 2020: Software Zero-Day Discovery: A Journey from Main to Return (Kushal Arvind Shah)

### Overview In this presentation, titled "Software Zero-Day Discovery: A Journey from Main to Return," the speaker (introduced in the transcript as Kushal Arvind Shah) discusses methodology, targets, and practical techniques for discovering software zero-day vulnerabilities. The talk outlines how security researchers can identify target software, source test files, build and instrument targets, and use debugging and fuzzing approaches to identify crashes and report security issues.

### Key Topics - **Target and Application Selection:** The speaker explores how researchers can identify targets by examining platforms, bug bounty lists, and repositories of reported vulnerabilities. Resources such as file extension directories (e.g., file-extensions.org) can be used to uncover less common file formats and the applications that parse them. - **Sourcing Test Files:** Strategies for collecting sample files, including finding samples via bug trackers, specialized websites, and repositories where sample formats are hosted for testing and fuzzing. - **Building and Instrumentation:** Approaches to building software, including using address sanitizers (such as ASan) and runtime compiler options to reliably catch memory corruption and runtime errors. - **Crash Triage and Debugging:** Identifying reproducible crashes, examining call stacks and memory states, inspecting crash logs, and reporting identified vulnerabilities to relevant vendors or project maintainers.

### Technical Details - **Discovering Vulnerabilities via Public Trackers:** The speaker notes that researchers can inspect existing vulnerability reports and platforms (such as bug tracking platforms, Zero Day Initiative/ZDI advisories, and open-source project trackers) to understand where issues commonly arise and what file types trigger parsing bugs. - **File Extension and Format Research:** By consulting sites such as `file-extensions.org`, researchers can explore niche file types and map them to open-source or proprietary applications handling complex media, document, or archive formats. - **Compilation and Sanitization:** When source code is available (in open-source software), the speaker emphasizes compiling targets with sanitizers like AddressSanitizer (ASan) and debugging symbols to catch out-of-bounds reads/writes, use-after-free conditions, and invalid pointer dereferences immediately upon occurrence. - **Triage Workflow:** The workflow transitions from running or feeding generated inputs into the target, observing crashes, inspecting the program state via debuggers, locating the faulting function or line of code, and preparing reproducible proof-of-concept submissions for maintainers.

### Takeaways - Systematic target selection—focusing on applications that parse complex or uncommon file formats—is an effective starting point for finding vulnerabilities. - Utilizing compiler-assisted sanitization (like AddressSanitizer) significantly accelerates detection and triage of memory corruption bugs. - Tracking existing bug disclosures and public sample corpora provides valuable references and seed files for vulnerability research. - *Note on Transcript Quality:* Significant portions of the transcript contain corrupted or noisy speech-to-text text, which limits visibility into specific tool command-lines or exact code walkthrough details presented visually during the talk.