HotFuzz: Discovering Algorithmic Denial-of-Service Vulnerabilities Through Guided Micro-Fuzzing

Abstract

Fifteen billion devices run Java and many of them are connected to the Internet. As this ecosystem continues to grow, it remains an important task to discover any unknown security threats these devices face. Fuzz testing repeatedly runs software on random inputs in order to trigger unexpected program behaviors, such as crashes or timeouts, and has historically revealed serious security vulnerabilities. Contemporary fuzz testing techniques focus on identifying memory corruption vulnerabilities that allow adversaries to achieve either remote code execution or information disclosure. Meanwhile, Algorithmic Complexity (AC) vulnerabilities, which are a common attack vector for denial-ofservice attacks, remain an understudied threat.In this paper, we present HotFuzz, a framework for automatically discovering AC vulnerabilities in Java libraries. HotFuzz uses micro-fuzzing, a genetic algorithm that evolves arbitrary Java objects in order to trigger the worst-case performance for a method under test. We define Small Recursive Instantiation (SRI) as a technique to derive seed inputs represented as Java objects to micro-fuzzing. After micro-fuzzing, HotFuzz synthesizes test cases that triggered AC vulnerabilities into Java programs and monitors their execution in order to reproduce vulnerabilities outside the fuzzing framework. HotFuzz outputs those programs that exhibit high CPU utilization as witnesses for AC vulnerabilities in a Java library.We evaluate HotFuzz over the Java Runtime Environment (JRE), the 100 most popular Java libraries on Maven, and challenges contained in the DARPA Space and Time Analysis for Cybersecurity (STAC) program. We evaluate SRI's effectiveness by comparing the performance of micro-fuzzing with SRI, measured by the number of AC vulnerabilities detected, to simply using empty values as seed inputs. In this evaluation, we verified known AC vulnerabilities, discovered previously unknown AC vulnerabilities that we responsibly reported to vendors, and received confirmation from both IBM and Oracle. Our results demonstrate that micro-fuzzing finds AC vulnerabilities in realworld software, and that micro-fuzzing with SRI-derived seed inputs outperforms using empty values.

Fuzzing: A Survey for Roadmap

“…Therefore, SlowFuzz [152] detects AC bugs via guiding fuzzing towards executions that increase the number of executed instructions. Similarly, HotFuzz [15] detects AC bugs in Java methods via maximizing the resource consumption of individual methods. MemLock [44] detects AC bugs based on both metrics of edge coverage and memory consumption.…”

Nyx-Net: Network Fuzzing with Incremental Snapshots

“…Following the publication of AFL [66], its impact soon caused a wave of additional research. Almost every design choice was investigated: AFL's input mutation algorithm where extended upon [1,3,16,23,42,45] as was its ability to trigger and identify bugs [5,5,29,40,41,61,64]. To improve the strength of AFL's semi-random mutations, many researchers proposed to combine fuzzing with more elaborate program analysis techniques such as taint tracking [11,48] and symbolic or concolic execution [19-22, 27, 37, 44, 56, 59, 65, 68].…”

The progress, challenges, and perspectives of directed greybox fuzzing

“…Based on the feedback information from the execution of the PUT, greybox fuzzers use an evolutionary algorithm to generate new inputs and explore paths. Greybox fuzzing is widely used to test application software, libraries [8, 9], kernel code [10–12], and protocols [13–15]. Most greybox fuzzing tools are coverage‐guided, which aim to cover as many program paths as possible within a limited time budget.…”