Physical Devices-Agnostic Hybrid Fuzzing of IoT Firmware
Physical Devices-Agnostic Hybrid Fuzzing of IoT Firmware
复制标题
DOI：
10.1109/jiot.2023.3303780
复制
发表时间：
2023-12
影响因子：
10.6
通讯作者：
Lingyun Situ;Chi Zhang;Le Guan;Zhiqiang Zuo;Linzhang Wang;Xuandong Li;Peng Liu;Jin Shi
中科院分区：
文献类型：
--
作者：
Lingyun Situ;Chi Zhang;Le Guan;Zhiqiang Zuo;Linzhang Wang;Xuandong Li;Peng Liu;Jin Shi
随着物联网的快速发展，大量基于微处理器（MCU）的物联网设备现在很容易受到互联网攻击。固件中的漏洞是最重要的攻击面之一。Fuzzing已成为识别此类漏洞的最有效技术之一。然而，当应用于物联网固件时，会出现一些挑战，包括：1）在没有外围设备的情况下，固件无法正常执行; 2）缺乏对探索多个外围设备输入空间的支持; 3）难以检测和收集反馈;以及4）缺乏故障检测机制。为了应对这些挑战，我们开发并实现了一种创新的独立于外围设备的混合模糊工具，称为FirmHybirdFuzzer。该工具可在不依赖特定外围硬件的情况下测试MCU固件。首先，集成了统一的虚拟外设来对各种外设的行为进行建模，从而实现与物理设备无关的固件执行。然后，使用混合事件生成方法来生成不同外设访问的输入。此外，两级覆盖反馈收集优化测试用例生成。最后，实现了一种基于插件的故障检测机制来识别典型的内存损坏漏洞。一个大规模的实验评估已被执行，以显示FirmHybirdFuzzer的有效性和效率。
With the rapid expansion of the Internet of Things, a vast number of microcontroller-based (MCU) IoT devices are now susceptible to attacks through the Internet. Vulnerabilities within the firmware are one of the most important attack surfaces. Fuzzing has emerged as one of the most effective techniques for identifying such vulnerabilities. However, when applied to IoT firmware, several challenges arise, including: 1) the inability of firmware to execute properly in the absence of peripherals; 2) the lack of support for exploring input spaces of multiple peripherals; 3) difficulties in instrumenting and gathering feedback; and 4) the absence of a fault detection mechanism. To address these challenges, we have developed and implemented an innovative peripheral-independent hybrid fuzzing tool called FirmHybirdFuzzer. This tool enables testing of MCU firmware without reliance on specific peripheral hardware. First, a unified virtual peripheral was integrated to model the behaviors of various peripherals, thus enabling the physical devices-agnostic firmware execution. Then, a hybrid event generation approach was used to generate inputs for different peripheral accesses. Furthermore, two-level coverage feedback was collected to optimize the testcase generation. Finally, a plugin-based fault detection mechanism was implemented to identify typical memory corruption vulnerabilities. A large-scale experimental evaluation has been performed to show FirmHybirdFuzzer’s effectiveness and efficiency.