EWVHunter: Grey-Box Fuzzing with Knowledge Guide on Embedded Web Front-Ends

Abstract

At present, embedded devices have become a part of people’s lives, so detecting security vulnerabilities contained in devices becomes imperative. There are three challenges in detecting embedded device vulnerabilities: (1) Most network protocols are stateful; (2) the communication between the web front-end and the device is encrypted or encoded; and (3) the conditional constraints of programs in the device reduce the depth and breadth of fuzz testing. To address these challenges, we propose a new type of gray-box fuzz testing framework in this paper, called EWVHunter, which is mainly used to find authentication bypass and command injection vulnerabilities in embedded devices. The key idea in this paper is based on the observation that most embedded devices are controlled through the web front-end. Such embedded devices often contain rich information in the communication protocol between the web front-end and device. Therefore, by filling data at the input source on the web front-end and reusing web front-end program logic, we can effectively solve the impact of the stateful network protocol and communication data encryption on fuzzing without relying on any knowledge about the communication protocol. Additionally, we use firmware information extraction to enhance EWVHunter so that it can detect vulnerabilities in deep layer codes and hidden interfaces. In our research, we implemented EWVHunter and evaluated 8 real-world embedded devices, and our approach identified 12 vulnerabilities (including 7 zero-days), which affect a total of 31,996 online devices.

SIoTFuzzer: Fuzzing Web Interface in IoT Firmware via Stateful Message Generation

“…IoTHunter uses multi-level message generation mechanism to test the some standard protocols in IoT firmware, such as SNMP, FTP, BGP. Besides, Wang et al [17] presented EWV Hunter, a grey-box fuzzer for embedded IoT devices. EWV Hunter constructed a prior knowledge base about the web front-end and filled data at the input source.…”

FirmHunter: State-Aware and Introspection-Driven Grey-Box Fuzzing towards IoT Firmware

“…In the front-end fuzzing, the inputs are user operations, including GET requests, filling forms, and JS events. EWVHunter [14] implements web crawlers to interact with network applications which crawl the static resources from the front-end and explore input fields like URLs and forms. After filling randomly generated values in fields, EWVHunter clicks buttons to send mutated test cases and then checks the response message as well as the connection status to detect potential vulnerabilities.…”

“…However, writing templates requires full knowledge of the design of protocols. To this end, some works implement crawlers [10][11][12][13][14][15] to traverse the web application and capture the traffic messages. After that, customized strategies are applied to mutate these captured messages to generate test cases.…”

“…Although some works focus on stateful fuzzing, they have bad performance on more complex IoT devices. FirmFuzz [10] and EWVHunter [14] implement web crawlers to maintain authenticated state, but intramessage and inter-message dependencies are often neglected. SIoTFuzzer [16] extracts messages between page responds to gain a stateful seed while not analyzing the intramessage dependencies in these messages.…”

PNFUZZ: A Stateful Network Protocol Fuzzing Approach Based on Packet Clustering

“…Therefore, "smart" fuzzer can produce testcases with lower blindness and randomness and higher efficiency. For example, Peach [6], BooFuzz [7] and AFLNET [8] are "smart" fuzzers. Taking BooFuzz to test the SMTP protocol for example, BooFuzz is a kind of "smart" fuzz testing framework.…”