SIoTFuzzer: Fuzzing Web Interface in IoT Firmware via Stateful Message Generation

Abstract

Cyber attacks against the web management interface of Internet of Things (IoT) devices often have serious consequences. Current research uses fuzzing technologies to test the web interfaces of IoT devices. These IoT fuzzers generate messages (a test case sent from the client to the server to test its functionality) without considering their dependency, which is unlikely to bypass the early check of the server. These invalid test cases significantly reduce the efficiency of fuzzing. To overcome this problem, we propose a stateful message generation (SMG) mechanism for IoT web fuzzing. SMG addresses two problems in IoT fuzzing. First, we retrieve the message dependency by using web front-end analysis and status analysis. These dependent messages, which can easily bypass the server check, are used as a valid seed. Second, we adopt a multi-message seed format to preserve the dependency of the messages when mutating the seed to get a valid test case, so that the test case can bypass the state check of the server to make a valid test. Message dependency preservation is implemented by our proposed parameter mutation and structural mutation methods. We implement SMG in our IoT fuzzer, SIoTFuzzer, which applies IoT firmware on the latest Linux-based simulation tool, FirmAE. We test nine IoT devices including a router and an IP camera and adopt a vulnerability detection mechanism. Our evaluation results show that (1) SIoTFuzzer is capable of finding real-world vulnerabilities in IoT devices; (2) our SMG is effective as it enables Boofuzz (a popular protocol fuzzer) to find command injection and cross-site scripting (XSS) vulnerabilities; and (3) compared to FirmFuzz, SIoTFuzzer found all the vulnerabilities in our benchmarks, while FirmFuzz found only four—the efficiency of our tool increased by 20.57% on average.

PDFuzzerGen: Policy-Driven Black-Box Fuzzer Generation for Smart Devices

“…SIoTFuzzer [19] is another third-party independent work while writing this paper. SIoTFuzzer chooses to start from the Web front-end page and complete stateful message generation through front-end source code review, state analysis, and seed generation.…”

“…Fuzzing type Hardware support Component Zero-day detection IoTFuzzer [11] Black-box Bare-metal APP-related Yes FIRM-AFL [7] Grey-box Emulation Web Yes FirmFuzz [6] Grey-box Emulation Web Yes IoTHunter [17] Grey-box Emulation Protocol Yes MultiFuzz [18] Grey-box None Protocol Yes SIoTFuzzer [19] Black-box Emulation Web No DIANE [10] Black-box Bare-metal APP-related Yes device require authentication? (ii) Is the authentication process replayable?…”

“…In our research, we implemented a full-featured prototype of PDFuzzerGen and evaluated it in a real-world environment. To assess its effectiveness, we ran PDFuzzerGen on 19 We have reported all these vulnerabilities to CNCERT/CC [15] in pursuit of helping vendors fix them.…”

RW-Fuzzer: A Fuzzing Method for Vulnerability Mining on Router Web Interface

“…EWVHunter can automatically detect authentication bypass vulnerabilities and command injection vulnerabilities in embedded devices by using information from official firmware and logic programs that control the terminal's Web front-end. Reference [9] designed a black-box fuzzing tool named SIoTFuzzer, which can detect the vulnerabilities of IoT devices, design, and implement for automatic discovery of IoT devices' loopholes through device monitoring deployed in the system or built 2.4. Fuzzing Test Technology.…”

FirmHunter: State-Aware and Introspection-Driven Grey-Box Fuzzing towards IoT Firmware

“…FirmFuzz [10] and EWVHunter [14] implement web crawlers to maintain authenticated state, but intramessage and inter-message dependencies are often neglected. SIoTFuzzer [16] extracts messages between page responds to gain a stateful seed while not analyzing the intramessage dependencies in these messages.…”