Google ships open-source security fuzzer

The fuzzer, called Flayer, is an analysis and flow alteration tool that has been used to find errors in real software. In the past year, results from Flayer has led to the discovery of security holes in several open-source products, including OpenSSH, OpenSSL, LibTIFF and libPNG.

[ SEE: Google’s anti-malware team comes out of the shadows ]

This tool, publicly available under the GPL, was discussed by Google's Will Drewry at the WOOT '07 conference and on the company's security blog:

Fuzz testers, or fuzzers, are used during pen tests to pinpoint security vulnerabilities by sending random input to an application. If the program contains a vulnerability that leads to an exception, crash or server error, researchers can parse the results of the test to pinpoint the cause of the crash.

ALSO SEE: Microsoft security guru: Get fuzzing