Yan Ivnitskiy

Summary: Trail of Bits published a post by Yan Ivnitskiy on May 18, 2016 describing ProtoFuzz, a fuzzer for Google's Protocol Buffers, the serialization format commonly used in distributed applications. The post notes that protobufs let developers define data types and have the protoc compiler generate serialization and deserialization code automatically, and that ProtoFuzz targets services expecting protobuf-encoded structures.
Why it matters: The parsing code that protobuf compilers generate automatically is exactly the code a fuzzer like ProtoFuzz is built to stress, and it sits in the request path of distributed services that many teams treat as safe because the code was generated rather than hand-written.

Read the original at Trail of Bits Blog ↗