Homepage for Addison Crump
In 2024, I attended ICST in Toronto. I went to attend the first "Artificial Intelligence in Software Testing" workshop (AIST), where I gave a tutorial on a potential competition and participated in a panel (which, turned into a roundtable discussion) about the field. Our concerns at the time were principally about LLMs with two prominent questions: "how can we research this reliably?" and "how…
This one's a reminder for me: if you aren't sure...
It has now been several years since I've taught my own classes, or even acted as a tutor. That is to say: I worked with students after the lockdowns for COVID had ended, but before LLMs changed the nature of our field. I will likely take this mantle up again soon, and I find myself uncertain. Teaching is clearly the most valuable thing I can offer to the world. Any achievements I could have…
Times have changed since we were last here . Since then, SSH signing has become popular 1 , I got some FIDO2 security keys, and post-quantum cryptography has gotten a lot better . It's time for some renovations! SSH authentication We want to prevent connecting to hosts without PQC. To do so, we can simply add the following lines to our ~/.ssh/config : Match host * KexAlgorithms…
I care quite deeply about scientific communication. Part of the frustration that I hold for how we currently communicate in academia is mostly to do with the stiffness and inaccessibility of our horrifically dense, jargon-packed publications. Is it truly necessary to encode all of our works in such a way? In some cases, a paper will only be meaningful to people who have the background to…
I've updated my website a bit. Visual Changes Those of you who have visited my site will instantly notice that the colours have changed. This is pretty obvious; I prefer the purple/pink ranges nowadays and I suspect they are also easier on the eyes. If that isn't the case for you, let me know and I'll consider adjusting it again. Technical Changes I've updated from Zola…
This semester marks four years since I stopped teaching high school classes. That means that, in just a few months, nearly all of the students that I would have taught have now graduated. I never got to say goodbye to my students. I had to leave rather suddenly and only had the opportunity to talk to one or two before I left. I didn't like the way that I left teaching, especially as I taught…
I am not fond of this recent genenerative AI movement . It is a profound waste of resources, a theft machine masquerading as intelligence, and generally a tool which enables numerous social harms at scale. I am a firm proponent that we (academics) should not be involved in the rat race to improve or to use these systems because of their enormous ethical violations. Yet there is a cold calculus…
I'm having a hard time right now . Since I wrote last, there have been multiple additional reasons for me to be frustrated both with my field and my country, but I am choosing to follow the words of the serenity prayer. Instead of throwing myself into frustration forever, I have chosen two alternate routes for directing my attention: research and recreation. Research In the last two months, I…
I often suffer from world-weariness. That aching, inescapable feeling that the world is somehow going wrong and there's nothing that I can personally do about it, and the general sense of emotional and cognitive fatigue that comes with those thoughts. I worry a lot about the world -- watching systems that I once trusted falter and fail into corrupt and fraudulent practice for some…
Recording . Presentation slides available via Google Slides . Fahrplan entry on CCC website . Blurb Despite how it's often portrayed in blogs, scientific articles, or corporate test planning, fuzz testing isn't a magic bug printer; just saying "we fuzz our code" says nothing about how effectively it was tested. Yet, how fuzzers and programs interact is deeply mythologised and poorly…
I'm working on building new benchmarking tools for fuzzing. As part of this, we need to snuff out potential sources of measurement bias. One such source is described in 3.6.2 of the fuzzer evaluation guidelines , but I thought I'd reiterate it here with an example. The "unwitting student" statement Suppose that Alex has a new metric, M , that they want to build a fuzzer around. This new…
I have come to realise---or rather, I have become more and more convinced that---fuzzing research has stalled not because we have no further contributions to make, but because the contributions that we are making are either incremental and merely sound impressive or presented in ways that obscure their utility. To be more concrete: we are spending time trying to "improve" fuzzing generally rather…
Most of my comments here are US-centric, but apply to other countries I've grown up in, too. Below are some things that shouldn't need to be said, but for some reason, we do. Transgender people deserve to exist. This conquest against transgender people is merely a "common enemy" of ideologies only capable of uniting against something and not for something. If you genuinely believe that…
Previously [ 1 , 2 , 3 ], I've talked about the effects of what I call the "reinterpretation problem". This effect, known also as the havoc effect, is characterised by a reinterpretation of input segments as a result of a mutation. Think of a sequence of network packets, each with a length field: if you mutate one of the length fields, the remaining sequence of packets will be interpreted…
Recently, I was made aware of a paper in which I was acknowledged. This came as quite a surprise; I had only spoken with this group as a single email following a post on secret.club . In essence, Leo (i.e., Ao Li from the paper) reached out as we had quite the topic collision -- the effect of mutating bytes which are then interpreted as structured data. In the secret.club post in mid-2024, I…
Publication is available via the IEEE publication .
This was a presentation offered at the Search-Based and Fuzz Testing Workshop in 2025. SBFT'25 slides provided here . Recording is available on YouTube . Abstract Following the SBFT fuzzing competition, the results were analyzed and a victor was chosen. This presentation details how we organised that competition, scored the contestants, and ultimately who we chose as the victor. At the end,…
Video is not available as the presentation was provided privately. Presentation slides are available on Google Slides . Some formatting is incorrect due to a change of software. Abstract The club often hears about public sector, military, and industrial offers for careers in security research. Let's talk about academia.
Publication is provided on the conference website . Source code and other artifacts available online .
This page comes about because of two things: an assignment for my computer graphics course, and a bit of inspiration from a computer graphics YouTuber, acerola , who recently did some work with fractal motion . Though the page was actually a requirement for the course, so, you tell me what inspired this page more :P The theme for our competition in our course was "Chaos in Harmony". If we can find…
In the past year, we've had a few discussions in my research group about joining various competitions, such as AIxCC , Pwn2Own , and others. These competitions are testing grounds for many of our research topics, as our research group primarily focuses on testing strategies for a wide variety of targets. We ultimately decided against it out of limited interest in taking part. From my part, my…
I was recently invited to speak at an automotive cybersecurity conference by Vector , a development group for cyberphysical systems 1 . Specifically, I was invited by Dr.rer.nat. Till Neudecker to give a talk about fuzzing as it has seemingly not seen too much uptake in the automotive industry. This will soon change with the publication of the new Automotive SPICE for Cybersecurity model, which I…
Communication in testing topics is hard. Communicating about fuzzing in particular is hard, as it's often seen as a magical way to solve a variety of problems in testing -- it's very simple to develop, it's automated, and it has a good track record of finding bugs. But often, fuzzing can't find bugs, and when they can't, it's often very hard to explain why. I've…
I've been thinking a lot recently about what it means to do research in fuzzing. Most of what we do is a loose collection of "things we know to generally work pretty well" but without true understanding of why . I do often wonder what this means for us as a topic. We use fuzzing in many important projects, and yet, we don't really understand its bounds. What can fuzzers really do, not…
A two-part blog series posted on secret.club . Part 1 concerns the regex crate from Rust, investigating how limitations of original harnesses prevented the discovery of bugs which were shallow under grammar testing. We then discuss how the replacement was also limited, and introduce the concept of the data reinterpretation problem. Part 2 concerns PCRE2 , likely the most widely-used regex library.…
Video is available on YouTube . Presentation slides are available on Google Slides . Abstract Fuzzing is beautiful: powerful, automated, simple, elegant, and effective. Touted as one of, if not the, most powerful testing strategy available, fuzzing has seen widespread use and been the subject of great research in both industry and academia. Yet, what is fuzzing, and how is it actually used? What…
Publication is provided on the primary author's website . Source code and other artifacts available online .
This was a presentation offered at the Search-Based and Fuzz Testing Workshop and at the Artificial Intelligence in Software Testing in 2024. SBFT'24 slides provided here . Tutorials information offered by SBFT'24 . AIST'24 slides provided here . Tutorials information offered by AIST'24 . Unfortunately, recordings for these presentations are not available. Abstract Sokoban, a…
Talk is available online on YouTube . Slides are available on Google Slides . Abstract Fuzzing is a well-researched and understood concept, but so little of its potential is leveraged. Throughout the talk, I introduce key features of LibAFL being used to research the frontier of fuzzing. We will use this to explore the power and problems of alternative fuzzing oracles. It is my hope that listeners…
Recording . Presentation slides available via Google Slides . Fahrplan entry on CCC website . Blurb The maintainers of the AFLplusplus open-source project show crazy new ways to (ab)use QEMU to explore difficult, binary-only targets through fuzzing. We present a proof of concept using AFL++ and QEMU to find command and SQL-injections, going beyond the classic fuzzing for memory corruption. We also…
Developers of software or designs under test in a security research context must be informed of all vulnerabilities discovered during that research within 90 days of discovery, with no exceptions . Research strategies and materials capable of discovering previously unknown or undiscoverable vulnerabilities or of discovering known vulnerabilities better than the existing state of the art must be…
This section contains miscellaneous publications, such as blog posts on other sites or projects that sit on some git or another somewhere. 2024 Ring Around The Regex: Lessons learned from fuzzing regex libraries 2022 Differential Fuzzing of the Solana BPF VM’s Just-in-Time Compiler and Interpreter 2021 Schadenfreude: Resurrection
You may find each of the papers in this section on my ORCID page . 2025 SBFT’25 Competition Report — Fuzzing Track TWINFUZZ: Differential Testing of Video Hardware Acceleration Stacks 2024 SoK: Prudent Evaluation Practices for Fuzzing 2023 CrabSandwich: Fuzzing Rust with Rust (Registered Report) AFLrustrust: A LibAFL-based AFL++ prototype LibAFL_libFuzzer: libFuzzer on Top of LibAFL 2022 TheHuzz:…
This section contains recordings, slides, or other information regarding talks and presentations I've given. This is not an exhaustive list! 2025 39c3: Demystifying Fuzzer Behaviour SBFT'25: Fuzzing Competition Results TAMU Cybersecurity Club: Security Reserch in Academia 2024 Vector Automotive Cybersecurity Symposium: To Fuzz, or Not To Fuzz SBFT'24: SoKotHban: A…
Available with paywall online from ACM . Available online for free from EURECOM . Source code available on the LibAFL GitHub .
I only really use laptops, and I use several throughout my various tasks. This leads to some synchronisation and authentication issues; maybe I need to develop on something that's on another machine, or I need to use SSH/GPG authentication to connect/sign to my version control system. I ended up working out how to get JetBrains IDEs working for development on one of my servers so…
This was a presentation offered during SBFT'23 to describe the LibAFL team's submissions to the fuzzing tool competition. Slides presented . Recording available on YouTube (starting at 4:45:08) .
Available with paywall online from IEEE . Available online for free from AFL++ website . Source code available on the LibAFL GitHub .
Available with paywall online from IEEE . Available online for free from AFL++ website . Source code available on the LibAFL GitHub .
Available online for free from USENIX .
A two-part blog series posted on secret.club under the title: "Earn $200K by fuzzing for a weekend". Clickbait-y, yes, but I thought it was important to get people looking into differential fuzzing :) Part 1 details the process of developing the increasingly specialised fuzzers which targeted the Solana Berkeley Packet Filter Virtual Machine. Part 2 details the debugging process for each…
Available with paywall online from IEEE . Available online for free from Yanze Li's website .
This was a project I did during my undergrad when I was still learning about where I wanted to go with my security research. As with many projects, this was not completed meaningfully. The text below is my hopeful, naïve self expecting to solve a hard formal analysis and reverse engineering problem. The subsequent parts of the project are implemented in US-CERT's GhiHorn . Looking back on it,…