Fuzzing for RPC vulnerabilities

So Dave Aitel said there are no more RPC vulnerabilities because his fuzzer couldn’t find any new ones. Well, I thought it was just a matter of trying more combinations and I was right.

The point, though, is not who has a longer fuzzer, but that when it comes to security always bet against the person who says something is impossible.

In fact, I made that mistake myself back in the 1990s, claiming Windows can’t be reliably exploited (I can’t find the link to the old ntbugtraq archives – thank god for that). Little did I know how easy writing Windows exploits would become. Now if I can only get a message to my younger self to avoid this embarrassment. And if I do get to talk to my young self I’ll be sure to tell me to skip the 2nd and 3rd matrix movies.

  • http://jbrownsec.blogspot.com Jeremy Brown

    CANVAS ring a bell? Maybe Dave said what he did simply because he wanted to wing people away from fuzzing MSRPC. He would like to keep all the 0days, 0day. Or not. I believe that it is a reasonable thing to do per his position and being a security researcher.