Automated Vulnerability Discovery and Exploitation in the Internet of Things

Abstract

Recently, automated software vulnerability detection and exploitation in Internet of Things (IoT) has attracted more and more attention, due to IoT’s fast adoption and high social impact. However, the task is challenging and the solutions are non-trivial: the existing methods have limited effectiveness at discovering vulnerabilities capable of compromising IoT systems. To address this, we propose an Automated Vulnerability Discovery and Exploitation framework with a Scheduling strategy, AutoDES that aims to improve the efficiency and effectiveness of vulnerability discovery and exploitation. In the vulnerability discovery stage, we use our Anti-Driller technique to mitigate the “path explosion” problem. This approach first generates a specific input proceeding from symbolic execution based on a Control Flow Graph (CFG). It then leverages a mutation-based fuzzer to find vulnerabilities while avoiding invalid mutations. In the vulnerability exploitation stage, we analyze the characteristics of vulnerabilities and then propose to generate exploits, via the use of several proposed attack techniques that can produce a shell based on the detected vulnerabilities. We also propose a genetic algorithm (GA)-based scheduling strategy (AutoS) that helps with assigning the computing resources dynamically and efficiently. The extensive experimental results on the RHG 2018 challenge dataset and the BCTF-RHG 2019 challenge dataset clearly demonstrate the effectiveness and efficiency of the proposed framework.

A Survey of Cybersecurity Certification for the Internet of Things

“…Their approach is based on a brute-force process to generate messages automatically and a mutation-based algorithm to generate structure valid messages. Fuzzing testing is also considered in Reference [186] to discover new vulnerabilities by mutating test cases that represent a valid attack path for a vulnerability. Moreover, in Reference [123], different CoAP implementations are tested through several fuzzing testing techniques by modeling a CoAP packet.…”

AEMB: An Automated Exploit Mitigation Bypassing Solution

“…Ref. [29] analyze the characteristics of vulnerabilities and then propose to generate EXPs via the use of several proposed attack techniques that can produce a shell based on the detected vulnerabilities.…”

Exploratory Review of Hybrid Fuzzing for Automated Vulnerability Detection

“…Therefore, a significant problem is determining how to produce sufficient testinputs. As mentioned in Section IV, there are two approaches in the test-input generation for fuzzers: a mutation-based approach which produces test-inputs according to the random mutation of the test-input files, or the use of predefined L Intriguer [140] L [141] AutoDES [142] L SHFuzz [143] L HFL [144] L FIoT [145] L BugMiner [146] L…”

“…al. [125] VUzzer [50] DeepFuzzer [107] Intriguer [140] Colossus [128] DigFuzz [119] Munch [133] SAFL [106] QSYM [64] Cyberdyne [72] Tinker [132] SHFuzz [143] SAVIOR [66] Wildfire [92] IoT Patching Kernel Java SAVIOR [63] FIoT [145] RedQueen [111] AutoDES [142] SynFuzz [127] DeepDiver [65] This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.…”

“…1) AutoDES [142] is a hybrid fuzzer that seeks to enhance the performance of bug detection and exploitation in IoT applications. It contains three key steps: AutoD-automatic bug discovery, AutoE-automatic bug exploitation, and AutoSefficient scheduling strategy.…”