Optimizing IoT Web Fuzzing by Firmware Infomation Mining
Source abstract
Abstract
IoT web fuzzing is an effective way to detect security flaws in IoT devices. However, without enough information of the tested targets, IoT web fuzzing is often blind and inefficient. In this paper, we propose to use static analysis to assist IoT web fuzzing. Our insight is that plenty of useful information is hidden in firmwares, which can be mined by static analysis and used to guide the subsequent dynamic analysis—fuzzing. Hence, our approach contains two stages: pre-fuzzing stage and fuzzing stage. In the pre-fuzzing stage, we perform static analysis on the IoT firmwares to exploit helpful information, such as web page paths, interfaces, and shared keywords. These kinds of information are used to construct diverse seeds for covering more web paths and interfaces, and are also used to prioritize seeds according to their importance (related to shared keywords) in the fuzzing stage. Based on this approach, we implement a prototype IoT web fuzzing system—IoTParser. Experiments show that IoTParser increased the vulnerability discovery capability by 44% on average, while increasing the vulnerability discovery efficiency by 48.2% on average compared with state-of-the-art IoT web fuzzer. In addition, IoTParser has found 13 vulnerabilities, including 7 0-day.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Software Testing and Debugging Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Computer, National University of Defense Technology, Changsha 410073, China
Funding
Natural Science Foundation of China · National University of Defense Technology
References (28)
Show source-provided references
1. (2022, June 09). Internet of Things. Available online: https://en.wikipedia.org/wiki/Internet_of_things.
2. Internet of Things security: A survey10.1016/j.jnca.2017.04.002 ↗
3. (2021, August 15). IoT Connected Devices Worldwide 2030. Available online: http://timmurphy.org/2009/07/22/line-spacing-in-latex-documents/.
4. A systematic review of fuzzing techniques10.1016/j.cose.2018.02.002 ↗
5. Srivastava, P., Peng, H., Li, J., Okhravi, H., Shrobe, H., and Payer, M. (2019, January 15). Firmfuzz: Automated iot firmware introspection and analysis. Proceedings of the 2nd International ACM Workshop on Security and Privacy for the Internet-of-Things, London, UK.10.1145/3338507.3358616 ↗
6. Discovering vulnerabilities in COTS IoT devices through blackbox fuzzing web management interface10.1155/2019/5076324 ↗
7. Yin, Q., Zhou, X., and Zhang, H. (2021). FirmHunter: State-Aware and Introspection-Driven Grey-Box Fuzzing towards IoT Firmware. Appl. Sci., 11.10.3390/app11199094 ↗
8. Kim, M., Kim, D., Kim, E., Kim, S., Jang, Y., and Kim, Y. (2020, January 7–11). Firmae: Towards large-scale emulation of iot firmware for dynamic analysis. Proceedings of the Annual Computer Security Applications Conference, Austin, TX, USA.10.1145/3427228.3427294 ↗
9. (2022, April 12). Web Crawler. Available online: https://en.wikipedia.org/wiki/Web_crawler.
10. (2014, July 26). binwalk. Available online: https://github.com/ReFirmLabs/binwalk.
11. (2020, April 25). Attacks. Available online: https://owasp.org/www-community/attacks/.
12. (2019, August 20). w13scan. Available online: https://github.com/w-digital-scanner/w13scan.
13. Xie, W., Chen, J., Wang, Z., Feng, C., Wang, E., Gao, Y., Wang, B., and Lu, K. (2022, January 25–29). Game of Hide-and-Seek: Exposing Hidden Interfaces in Embedded Web Applications of IoT Devices. Proceedings of the ACM Web Conference 2022, Association for Computing Machinery, Lyon, France.10.1145/3485447.3512213 ↗
14. (2010, June 10). PHP-Header. Available online: https://www.php.net/manual/en/function.header.php.
15. (2022, February 09). Request JavaScript API. Available online: https://www.javascripture.com/Request.
16. (2009, February 11). Strings—Linux Man Page. Available online: https://linux.die.net/man/1/strings.
17. (2021, February 28). Chaitin/Rad. Available online: https://github.com/chaitin/rad.
18. (2015, December 04). Jtpereyda/Boofuzz. Available online: https://github.com/jtpereyda/boofuzz.
19. (2019, May 26). fuzzDicts. Available online: https://github.com/TheKingOfDuck/fuzzDicts.
20. Towards Automated Dynamic Analysis for Linux-based Embedded Firmware
21. Thomas, S.L., Chothia, T., and Garcia, F.D. (2017). Stringer: Measuring the importance of static data comparisons to detect backdoors and undocumented functionality. European Symposium on Research in Computer Security, Springer.10.1007/978-3-319-66399-9_28 ↗
22. Cheng, K., Li, Q., Wang, L., Chen, Q., Zheng, Y., Sun, L., and Liang, Z. (2018, January 25–28). DTaint: Detecting the taint-style vulnerability in embedded device firmware. Proceedings of the 2018 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), Luxembourg.10.1109/DSN.2018.00052 ↗
23. Wang, F., and Shoshitaishvili, Y. (2017, January 24–26). Angr—The Next Generation of Binary Analysis. Proceedings of the 2017 IEEE Cybersecurity Development (SecDev), Cambridge, MA, USA.10.1109/SecDev.2017.14 ↗
24. Costin, A., Zaddach, J., Francillon, A., and Balzarotti, D. (2014, January 20–22). A Large-Scale Analysis of the Security of Embedded Firmwares. Proceedings of the 23rd USENIX Security Symposium (USENIX Security 14), San Diego, CA, USA.
25. Chen, L., Wang, Y., Cai, Q., Zhan, Y., Hu, H., Linghu, J., Hou, Q., Zhang, C., Duan, H., and Xue, Z. (2021, January 11–13). Sharing more and checking less: Leveraging common input keywords to detect bugs in embedded systems. Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), Virtual.
26. Dynamic Taint Analysis Tools: A Review
27. Chen, J., Diao, W., Zhao, Q., Zuo, C., Lin, Z., Wang, X., Lau, W.C., Sun, M., Yang, R., and Zhang, K. (2018, January 18–21). IoTFuzzer: Discovering Memory Corruptions in IoT Through App-based Fuzzing. Proceedings of the NDSS, San Diego, CA, USA.10.14722/ndss.2018.23159 ↗
28. Garbelini, M.E., Wang, C., Chattopadhyay, S., Sumei, S., and Kurniawan, E. (2020, January 15–17). SweynTooth: Unleashing Mayhem over Bluetooth Low Energy. Proceedings of the 2020 USENIX Annual Technical Conference (USENIX ATC 20), Philadelphia, PA, USA.