Directed Fuzzing Based on Program Dynamic Instrumentation

Sargsyan, Sevak; Kurmangaleev, Shamil; Hakobyan, Jivan; Mehrabyan, Matevos; Asryan, Sergey; Movsisyan, Hovhannes

doi:10.1109/ent.2019.00011

Cited by 7 publications

(3 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…2) Directed fuzzers aim to audit specific parts of the code and paths of the SUT. With this type of fuzzers, it is possible to direct the fuzz test to relevant parts of the SUT (e.g., code changed in an update or critical parts of the application) allowing to gather faster results [66], [68].…”

Section: A Fuzzing Taxonomymentioning

confidence: 99%

“…Finally, the environment interactions when performing system calls may arise when execution reaches components that are no under control of the interpreter [73]- [75]. This technique is used in the context of fuzzing for facilitating the determination of the initial seed by leveraging the range of values provided by the symbolic execution, the range value data for specific sections [68], or for increasing the code coverage. This approach is commonly used in the white-box Fig.…”

Section: ) Grammar Representation: This Technique Is a Black-boxmentioning

confidence: 99%

See 1 more Smart Citation

Fuzzing the Internet of Things: A Review on the Techniques and Challenges for Efficient Vulnerability Discovery in Embedded Systems

Eceiza

Flores

Iturbe

2021

IEEE Internet Things J.

View full text Add to dashboard Cite

With a growing number of embedded devices that create, transform, and send data autonomously at its core, the Internet of Things (IoT) is a reality in different sectors, such as manufacturing, healthcare, or transportation. With this expansion, the IoT is becoming more present in critical environments, where security is paramount. Infamous attacks, such as Mirai, have shown the insecurity of the devices that power the IoT, as well as the potential of such large-scale attacks. Therefore, it is important to secure these embedded systems that form the backbone of the IoT. However, the particular nature of these devices and their resource constraints mean that the most cost-effective manner of securing these devices is to secure them before they are deployed, by minimizing the number of vulnerabilities they ship. To this end, fuzzing has proved itself as a valuable technique for automated vulnerability finding, where specially crafted inputs are fed to programs in order to trigger vulnerabilities and crash the system. In this survey, we link the world of embedded IoT devices and fuzzing. For this end, we list the particularities of the embedded world as far as security is concerned, we perform a literature review on fuzzing techniques and proposals, studying their applicability to embedded IoT devices and, finally, we present future research directions by pointing out the gaps identified in the review.

show abstract

Section: A Fuzzing Taxonomymentioning

confidence: 99%

Section: ) Grammar Representation: This Technique Is a Black-boxmentioning

confidence: 99%

Fuzzing the Internet of Things: A Review on the Techniques and Challenges for Efficient Vulnerability Discovery in Embedded Systems

Eceiza

Flores

Iturbe

2021

IEEE Internet Things J.

View full text Add to dashboard Cite

show abstract

“…In order to achieve extendibility of the framework, ISP-Fuzzer provides opportunity to add custom plugins for different tasks solution. It contains number of implemented plugins, such as: BNF data generation plugin [17,18], directed fuzzing plugin [19], DSE invocation plugin [20], etc. ISP-Fuzzer has its own mutation engine with several mutation algorithms.…”

Section: Introductionmentioning

confidence: 99%

Improving fuzzing performance by applying interval mutations

Саргсян¹,

Акопян²,

Мовсисян³

et al. 2019

Proceedings of ISP RAS

View full text Add to dashboard Cite

This paper presents a novel approach of generation effective inputs for fuzz testing. Most applications check input format before performing basic calculations. That kind of applications usually parse service information of input file to decide whether it is supported or not. Input formats which are not supported are discarded and the application finishes its execution immediately. For example, the service information of ELF (Extensible Linking Format) file should start with the following data: "0x7f 'E' 'L' 'F'". If a file does not contain this information in header section then it will not be considered as ELF. Effective fuzzing of an application which has input validation stage is a relevant and important problem. Random changes of input files usually malform service data and the target application finishes immediately without execution of main code. This makes fuzzing process inefficient. To solve this problem, we have designed and implemented three special plugins for ISP-Fuzzer. The first plugin is intended to collect execution traces. The second plugin connects fragments of input data and executed basic blocks of the target program. Based on that information we can determine potential fragments (critical fragments) of input data which should not be mutated for new test case generation. The third plugin is designed for interval mutations. It mutates input file escaping critical fragments detected by the second plugin. Experimental results prove the effectiveness of proposed method.

show abstract