Orion: Fuzzing Workflow Automation
Introduces Orion, an automated fuzzing orchestration platform that streamlines harness generation, corpus management, and crash deduplication at enterprise scale.
Summary
Scaling Modern Fuzzing Operations
Fuzzing is one of the most effective methods for discovering memory corruption and logic vulnerabilities in complex software. However, managing fuzzing campaigns at enterprise scale involves significant manual overhead.
Orion: Automated Fuzzing Orchestration
Max Bazalii and Marius Fleischer present Orion, an automated fuzzing management platform that automates harness synthesis, target instrumentations, seed corpus minimization, and dynamic scaling across cloud compute clusters.
Intelligent Crash Triage and Deduplication
Orion incorporates automated sanitizers, root-cause classification engines, and GDB/LLDB integration to triage crashing test cases and eliminate duplicate crash reports in real time.
Democratizing Automated Software Auditing
Deploying Orion empowers security teams and open-source developers to continuously audit software projects and remediate memory safety flaws before production release.
Related talks
Briefings·24 min
Qinrun Dai · Yifei Xie
Vulnerability discovery traditionally relies on two primary approaches: manual auditing and fuzzing.
Main Stage·40 min
Julian Horoszkiewicz
Demonstrates rapid vulnerability discovery methodologies that uncovered seven zero-day local privilege escalation flaws in pre-installed OEM bloatware.
Main Stage·38 min
Zhengyu Liu · Jianjia Yu
Introduces Hulk, the first dynamic analysis tool to automatically detect and generate exploit payloads for complex DOM Clobbering vulnerabilities at web scale.