{"id":1016,"date":"2013-04-17T13:10:54","date_gmt":"2013-04-17T20:10:54","guid":{"rendered":"http:\/\/blog.mozilla.org\/security\/?p=1016"},"modified":"2013-04-17T13:10:54","modified_gmt":"2013-04-17T20:10:54","slug":"orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2013\/04\/17\/orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os\/","title":{"rendered":"Orangfuzz &#8211; an experimental user interaction fuzzer for Firefox OS"},"content":{"rendered":"<p>One of the goals of the fuzzing team is to identify security vulnerabilities within our products using various techniques. As we continue working with Firefox OS, we need to build and adapt the proper tools to enable fuzz testing on the mobile device.<\/p>\n<p><a href=\"https:\/\/github.com\/mozilla\/orangfuzz\">Orangfuzz<\/a> is an experimental user interaction fuzzer. It builds on <a href=\"https:\/\/github.com\/mozilla-b2g\/B2G\/blob\/master\/scripts\/generate-orangutan-script.py\">generate-orangutan-script.py<\/a> and uses the <a href=\"https:\/\/github.com\/wlach\/orangutan\">Orangutan framework<\/a>. Orangutan <a href=\"http:\/\/wrla.ch\/blog\/2012\/07\/the-evolution-of-simulating-events-in-eideticker-from-monkeys-to-orangutns\/\">injects events directly into the low-level kernel device file that represents an Android device\u2019s touch screen<\/a>. It supports actions such as &#8220;tapping&#8221; and &#8220;dragging&#8221;, simulated from a user&#8217;s perspective. The fuzzer generates an <a href=\"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=838215#c1\">Orangutan script<\/a> containing random sets of these actions.<\/p>\n<p>This concept was inspired by <a href=\"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=838215#c3\">bug 838215<\/a>, which was a crash involving the handling of touch events.<\/p>\n<p>Orangfuzz currently only supports the B2G Test Driver device, but adding additional support for other devices, if Orangutan supports them, is straightforward. We <a href=\"https:\/\/github.com\/mozilla\/orangfuzz\/blob\/master\/devices.py\">define the device<\/a> through its specifications (e.g. home key location, screen resolution). Adding support for additional devices is as simple as adding new subclasses which provide the appropriate resolution and screensizes. It may be possible to run this against the <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Mozilla\/Firefox_OS\/Using_the_B2G_emulators\">B2G emulators<\/a> but this has not been tested.<\/p>\n<p><strong>Warning<\/strong>: It is entirely possible to generate a script that contains a set of actions that dial emergency numbers such as &#8220;911&#8221;, &#8220;112&#8221; or &#8220;999&#8221;, so it is recommended to run the script against a <a href=\"https:\/\/github.com\/nth10sd\/no-phone-no-messaging-gaia\/tree\/monkey\">special build of Gaia<\/a> (not yet well-tested) with dialing and messaging capabilities disabled if one wants to run orangfuzz continuously without supervision.<\/p>\n<p>How can you help?<\/p>\n<ul>\n<li><a href=\"https:\/\/github.com\/mozilla\/orangfuzz\/blob\/master\/README.md\">Run orangfuzz<\/a> on a test device.<\/li>\n<li><a href=\"https:\/\/bugzilla.mozilla.org\/enter_bug.cgi?product=Boot2Gecko\">Report bugs in Bugzilla<\/a> when a generated script causes a crash in Firefox OS.<\/li>\n<\/ul>\n<p>At this point we are still experimenting with the most effective strategy for identifying and triaging crashes, but please feel free to file bugs or ideas moving forward either on <a href=\"https:\/\/github.com\/mozilla\/orangfuzz\">GitHub<\/a> or in <a href=\"https:\/\/bugzilla.mozilla.org\/enter_bug.cgi?product=Testing&amp;component=General&amp;cc=gary@rumblingedge.com&amp;short_desc=Orangfuzz%3A%20&amp;blocked=857276\">Bugzilla<\/a>. Do subscribe to the <a href=\"https:\/\/lists.mozilla.org\/listinfo\/dev-b2g\">mozilla.dev.b2g<\/a> newsgroup if one is interested.<\/p>\n<p><a href=\"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=858174\">Bug 858174<\/a> tracks moving orangfuzz to production.<\/p>\n<p>A <a href=\"https:\/\/www.youtube.com\/watch?v=yUPrFlrLuws\">demonstration video on YouTube<\/a> with annotations is available, or you can get the <a href=\"http:\/\/blog.mozilla.org\/security\/files\/2013\/04\/orangfuzzDemo-08Apr2013-b.webmhd.webm\">.webm version<\/a> (no audio).<\/p>\n<p>-Gary Kwong<\/p>\n<p>* Credits go out to Gregor Wagner, who wrote <a href=\"https:\/\/github.com\/mozilla-b2g\/B2G\/blob\/master\/scripts\/generate-orangutan-script.py\">generate-orangutan-script.py<\/a>, and <a href=\"http:\/\/wrla.ch\/blog\">William Lachance<\/a>, author of the Orangutan framework.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>One of the goals of the fuzzing team is to identify security vulnerabilities within our products using various techniques. As we continue working with Firefox OS, we need to build &hellip; <a class=\"go\" href=\"https:\/\/blog.mozilla.org\/security\/2013\/04\/17\/orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os\/\">Read more<\/a><\/p>\n","protected":false},"author":595,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24660,69],"tags":[542,45514],"coauthors":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Orangfuzz - an experimental user interaction fuzzer for Firefox OS - Mozilla Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/security\/2013\/04\/17\/orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Gary\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2013\/04\/17\/orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os\/\",\"url\":\"https:\/\/blog.mozilla.org\/security\/2013\/04\/17\/orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os\/\",\"name\":\"Orangfuzz - an experimental user interaction fuzzer for Firefox OS - Mozilla Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\"},\"datePublished\":\"2013-04-17T20:10:54+00:00\",\"dateModified\":\"2013-04-17T20:10:54+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/71b79b972d73beb051e296c2af15f9c5\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2013\/04\/17\/orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/security\/2013\/04\/17\/orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2013\/04\/17\/orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Orangfuzz &#8211; an experimental user interaction fuzzer for Firefox OS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/security\/\",\"name\":\"Mozilla Security Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/71b79b972d73beb051e296c2af15f9c5\",\"name\":\"Gary\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/b481da2a478431ff1c2e6fbc72f83420\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b7a4064320283b588f2231aafe455d6c?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b7a4064320283b588f2231aafe455d6c?s=96&d=identicon&r=g\",\"caption\":\"Gary\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Orangfuzz - an experimental user interaction fuzzer for Firefox OS - Mozilla Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/security\/2013\/04\/17\/orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os\/","twitter_misc":{"Written by":"Gary","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/security\/2013\/04\/17\/orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os\/","url":"https:\/\/blog.mozilla.org\/security\/2013\/04\/17\/orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os\/","name":"Orangfuzz - an experimental user interaction fuzzer for Firefox OS - Mozilla Security Blog","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/security\/#website"},"datePublished":"2013-04-17T20:10:54+00:00","dateModified":"2013-04-17T20:10:54+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/71b79b972d73beb051e296c2af15f9c5"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/security\/2013\/04\/17\/orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/security\/2013\/04\/17\/orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/security\/2013\/04\/17\/orangfuzz-an-experimental-user-interaction-fuzzer-for-firefox-os\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/security\/"},{"@type":"ListItem","position":2,"name":"Orangfuzz &#8211; an experimental user interaction fuzzer for Firefox OS"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/security\/#website","url":"https:\/\/blog.mozilla.org\/security\/","name":"Mozilla Security Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/71b79b972d73beb051e296c2af15f9c5","name":"Gary","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/b481da2a478431ff1c2e6fbc72f83420","url":"https:\/\/secure.gravatar.com\/avatar\/b7a4064320283b588f2231aafe455d6c?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b7a4064320283b588f2231aafe455d6c?s=96&d=identicon&r=g","caption":"Gary"}}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/1016"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/comments?post=1016"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/1016\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/media?parent=1016"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/categories?post=1016"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/tags?post=1016"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/coauthors?post=1016"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}