[论文解读] Snipuzz: Black-box Fuzzing of IoT Firmware via Message Snippet Inference

Xiaotao Feng, Ruoxi Sun+6 more|arXiv (Cornell University)|May 12, 2021

Advanced Malware Detection Techniques参考文献 32被引用 8

一句话总结

Snipuzz 是一种新颖的物联网固件黑盒模糊测试框架，通过分析设备响应来推断消息片段，从而指导变异操作，实现在无需事先了解协议的情况下进行语法感知测试。该框架在20款真实物联网设备中发现了5个零日漏洞，其中3个为该方法独有发现。

ABSTRACT

The proliferation of Internet of Things (IoT) devices has made people's lives more convenient, but it has also raised many security concerns. Due to the difficulty of obtaining and emulating IoT firmware, the black-box fuzzing of IoT devices has become a viable option. However, existing black-box fuzzers cannot form effective mutation optimization mechanisms to guide their testing processes, mainly due to the lack of feedback. It is difficult or even impossible to apply existing grammar-based fuzzing strategies. Therefore, an efficient fuzzing approach with syntax inference is required in the IoT fuzzing domain. To address these critical problems, we propose a novel automatic black-box fuzzing for IoT firmware, termed Snipuzz. Snipuzz runs as a client communicating with the devices and infers message snippets for mutation based on the responses. Each snippet refers to a block of consecutive bytes that reflect the approximate code coverage in fuzzing. This mutation strategy based on message snippets considerably narrows down the search space to change the probing messages. We compared Snipuzz with four state-of-the-art IoT fuzzing approaches, i.e., IoTFuzzer, BooFuzz, Doona, and Nemesys. Snipuzz not only inherits the advantages of app-based fuzzing (e.g., IoTFuzzer, but also utilizes communication responses to perform efficient mutation. Furthermore, Snipuzz is lightweight as its execution does not rely on any prerequisite operations, such as reverse engineering of apps. We also evaluated Snipuzz on 20 popular real-world IoT devices. Our results show that Snipuzz could identify 5 zero-day vulnerabilities, and 3 of them could be exposed only by Snipuzz. All the newly discovered vulnerabilities have been confirmed by their vendors.

研究动机与目标

• 解决由于缺乏内部执行反馈和未知通信协议而导致的物联网固件黑盒模糊测试挑战。
• 克服现有模糊测试工具依赖随机变异或需要语法规范的局限性。
• 在无需逆向工程或固件访问的前提下，实现高效、基于反馈的物联网固件变异测试。
• 通过分析设备响应模式，推断消息字节的语法角色，提升漏洞发现能力。

提出的方法

• Snipuzz 作为一个客户端运行，与物联网设备通信并观察其响应消息，以推断消息片段。
• 消息片段是指与代码覆盖率变化相关的连续字节块，其来源于变异过程中响应的变化。
• 该框架利用基于响应的反馈来指导变异，优先选择能改变设备行为的输入修改。
• 通过分析响应差异与输入修改之间的对应关系，实现语法推断，从而在无需预定义语法规则的情况下实现语法感知的变异。
• 变异通过识别导致不同响应的输入片段来引导，从而实现对输入空间的针对性探索。
• 系统将推断出的消息片段重新组合，生成新的有效输入，以探索更深层次的固件执行路径。

实验结果

研究问题

• RQ1 当缺乏内部执行反馈和协议语法信息时，如何提升物联网固件黑盒模糊测试的有效性？
• RQ2 能否利用设备响应模式推断出有意义的消息结构，并在无语法规范的情况下指导变异？
• RQ3 基于响应的反馈在多大程度上能提升物联网固件变异效率和漏洞发现能力？
• RQ4 轻量级、零前置条件的模糊测试框架是否能在零日漏洞检测方面超越现有最先进的物联网模糊测试工具？

主要发现

• Snipuzz 在20款真实消费级物联网设备中发现了5个零日漏洞，其中3个漏洞仅通过本方法被发现。
• 该框架在性能上优于四种最先进的模糊测试工具——IoTFuzzer、BooFuzz、Doona 和 Nemesys，结合了应用级模糊测试的优势与基于响应的反馈机制。
• Snipuzz 实现了高效的变异操作，无需固件仿真、逆向工程或事先的协议知识。
• 基于响应的反馈机制实现了针对性变异，显著缩小了搜索空间，相比盲目的随机变异具有明显优势。
• 该方法在具有非标准或复杂通信格式的设备上也表现出有效性，而传统语法驱动方法在此类场景下会失效。
• 所有发现的漏洞均已获得厂商确认，验证了 Snipuzz 在实际安全测试中的实用价值。