Microsoft Security: Let's Get Fuzzy

On Wednesday, June 6th 2007 at 12:54 PM

By Andrew Pociu (View Profile)

Michael Howard, the most popular security whiz at Microsoft and a popular figure among Windows developers and enthusiasts, urges developers to adopt fuzz testing as part of the bug testing process of their software. Fuzz testing is a technique that provides random data to the inputs of a program, and that is what the hackers and crackers are doing most of the time to your software in order to find a way to exploit it. The input could come through the software's user interface, though files, though a database or though the API. By fuzzing, the developer makes sure his application only accepts valid data and there is no way to breach the security of the software by passing ill-intentioned data throught those means.

â€œOne of the things we want our developers at Microsoft to understand is that you canâ€™t trust data. You need to understand what the bad guys can control and, if he can control a part of your code, what can he do with it. If he controls certain parts, that [can be] exploitable,â€ Howard said.