Fuzz The Power: Dual-role State Guided Black-box Fuzzing for USB Power Delivery
Fuzz The Power: Dual-role State Guided Black-box Fuzzing for USB Power Delivery
复制标题
DOI：
--
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
Kyungtae Kim;Sungwoo Kim;Kevin R. B. Butler;Antonio Bianchi;R. Kennell;D. Tian
中科院分区：
文献类型：
--
作者：
Kyungtae Kim;Sungwoo Kim;Kevin R. B. Butler;Antonio Bianchi;R. Kennell;D. Tian
USB Power Delivery（USBPD）是一种用于高级电源的最先进的充电协议。由于其高容量的电源，它已被广泛采用的消费设备，如智能手机和笔记本电脑，并已成为事实上的USB充电标准在欧盟和北美。由于充电的低级别性质和协议的复杂性，USBPD通常被实现为在具有USBPD物理层的专用微控制器单元（MCU）上运行的专有固件。这些实现中的错误不仅会导致安全问题，例如，过度充电，但也会导致安全问题，例如允许攻击者破坏USBPD固件。本文提出了F UZZ PD，这是第一个具有双重角色状态指导的黑盒模糊技术，目标是具有闭源USBPD固件的现成USBPD设备。F UZ-Z PD仅需要物理USB Type-C连接即可以即插即用的方式运行。为了便于USBPD固件的黑盒模糊，F UZZ PD根据USBPD规范手动创建了一个双角色状态机，该状态机支持模糊输入的状态覆盖和转换。FUZZ PD还提供了一种多级突变策略，允许使用状态内和状态间突变进行细粒度的状态感知模糊。我们使用Chromebook作为模糊主机来实现F UZZ PD，并针对来自7个不同供应商的12个USBPD移动的设备、来自7个不同供应商的7个USB集线器和来自5个不同供应商的5个充电器对其进行评估。F UZZ PD已经发现了15个独特的bug，其中9个已经被相应的供应商确认。我们还对F UZZ PD和多种最先进的黑盒模糊技术进行了比较，证明F UZZ PD的代码覆盖率比其他解决方案高出40%至3倍。然后，我们将F UZZ PD与USBIF的USBPD合规性测试套件进行比较，并显示F UZZ PD可以以2倍更高的代码覆盖率找到7个错误。F UZZ PD是迈向安全可靠USB充电的第一步。
USB Power Delivery (USBPD) is a state-of-the-art charging protocol for advanced power supply. Thanks to its high volume of power supply, it has been widely adopted by consumer devices, such as smartphones and laptops, and has become the de facto USB charging standard in both EU and North America. Due to the low-level nature of charging and the complexity of the protocol, USBPD is often implemented as proprietary firmware running on a dedicated microcontroller unit (MCU) with a USBPD physical layer. Bugs within these implementations can not only lead to safety issues, e.g., over charging, but also cause security issues, such as allowing attackers to reflash USBPD firmware. This paper proposes F UZZ PD, the first black-box fuzzing technique with dual-role state guidance targeting off-the-shelf USBPD devices with closed-source USBPD firmware. F UZ - Z PD only requires a physical USB Type-C connection to operate in a plug-n-fuzz fashion. To facilitate the black-box fuzzing of USBPD firmware, F UZZ PD manually creates a dual-role state machine from the USBPD specification, which enables both state coverage and transitions from fuzzing inputs. F UZZ PD further provides a multi-level mutation strategy, allowing for fine-grained state-aware fuzzing with intra-and inter-state mutations. We implement F UZZ PD using a Chromebook as the fuzzing host and evaluate it against 12 USBPD mobile devices from 7 different vendors, 7 USB hubs from 7 different vendors, and 5 chargers from 5 different vendors. F UZZ PD has found 15 unique bugs, 9 of which have been confirmed by the corresponding vendors. We additionally conduct a comparison between F UZZ PD and multiple state-of-the-art black-box fuzzing techniques, demonstrating that F UZZ PD achieves code coverage that is 40% to 3x higher than other solutions. We then compare F UZZ PD with the USBPD compliance test suite from USBIF and show that F UZZ PD can find 7 more bugs with 2x higher code coverage. F UZZ PD is the first step towards secure and trustworthy USB charging.