Hopper: Distributed Fuzzer

Masters Thesis, University of Utah. May 2023.

abstract

Software systems are becoming increasingly complex, posing significant challenges for ensuring their security and correctness. To address these challenges, researchers and industry professionals have relied on fuzzing, a technique that systematically injects random inputs into software to detect vulnerabilities and exploits. Over the past three decades, fuzzing has become a ubiquitous tool for identifying security flaws in software systems.

In recent years, there has been a growing trend towards public fuzzing campaigns, such as the OSS-Fuzz project hosted by Google. These projects have had massive impacts on the Open Source Community, driving public fuzzing campaigns for critical Open Source Software. These campaigns are typically run on the cloud, where resources can be easily scaled up or down to meet the demands of large-scale fuzzing campaigns. However, as the size and complexity of software systems continue to grow, there is a need for more efficient and scalable fuzzing techniques. We can leverage the distributed nature of the cloud to run these fuzz campaigns.

Little has been done in the space of creating truly distributed fuzzers, typically a ”parallel machine mode” is implemented in fuzzers such as AFL++. However, this is not enough and there is much still left to be done. To address this challenge, we propose a fully implemented proof of concept called Hopper, a Distributed Coverage-Guided Graybox Fuzzer that leverages the power of the cloud to distribute parallel compute across multiple nodes. Hopper aims to demonstrate a linear increase in iterations per second as the number of distributed nodes scale linearly. The inspiration for Hopper came from prior work on distributed computing techniques, such as Google’s Map-Reduce, and aims to provide a proof of concept for the use of distributed fuzzing in software testing. By distributing parallel compute across multiple nodes and leveraging tried and tested techniques in distributed computing, Hopper provides a foundation for future scalable fuzzing campaigns.