Hacking for Charity: Automated Bug-finding in LibOTR

Summary: Trail of Bits ran its DARPA Cyber Grand Challenge bug-finding system against libotr, a secure messaging library, after Thomas Ptacek bet Matthew Green on November 4, 2014 that it would have a high severity bug within 12 months. The system ran on 48 Xeon CPUs for 24 hours against a sample application and found no memory safety violations, so Green donated $1000 to Partners in Health.
Key Takeaway: The test covered only a subset of libotr, and the team notes that vulnerabilities occurring after decryption would never be triggered by modifying encrypted and authenticated data - so a clean 24-hour run is a good sign, not a clean bill of health.

Read the original at Trail of Bits Blog ↗