Discovering Vulnerabilities in COTS IoT Devices through Blackbox Fuzzing Web Management Interface
Joint Authors
Zhang, Xiaosong
Wang, Dong
Chen, Ting
Li, Jingwei
Source
Security and Communication Networks
Issue
Vol. 2019, Issue 2019 (31 Dec. 2019), pp.1-19, 19 p.
Publisher
Hindawi Publishing Corporation
Publication Date
2019-11-04
Country of Publication
Egypt
No. of Pages
19
Main Subjects
Information Technology and Computer Science
Abstract EN
A novel approach for discovering vulnerability in commercial off-the-shelf (COTS) IoT devices is proposed in this paper, which will revolutionize the area.
Unlike previous work, the web management interface in IoT was used to detect vulnerabilities by leveraging fuzzing technology.
To validate and evaluate this scheme, a tool named WMIFuzzer was designed and implemented.
There were also two challenges: (1) due to the diversity of web interface implementations, there were no existing seed messages for fuzzing this interface and it was inefficient while taking random messages to launch the fuzzing and (2) because of the highly structured seed message, fuzzing with byte-level mutation could conduce to be rejected by the device at an early stage.
To address these challenges, a brute-force UI automation was designed to drive the web interface to generate initial seed messages automatically, as well as a weighted message parse tree (WMPT) was proposed to guide the mutation to generate mostly structure-valid messages.
The extensive experimental results show that WMIFuzzer could achieve expected result while 10 vulnerabilities including 6 zero-days in 7 COTS IoT devices were discovered.
American Psychological Association (APA)
Wang, Dong& Zhang, Xiaosong& Chen, Ting& Li, Jingwei. 2019. Discovering Vulnerabilities in COTS IoT Devices through Blackbox Fuzzing Web Management Interface. Security and Communication Networks،Vol. 2019, no. 2019, pp.1-19.
https://search.emarefa.net/detail/BIM-1210456
Modern Language Association (MLA)
Wang, Dong…[et al.]. Discovering Vulnerabilities in COTS IoT Devices through Blackbox Fuzzing Web Management Interface. Security and Communication Networks No. 2019 (2019), pp.1-19.
https://search.emarefa.net/detail/BIM-1210456
American Medical Association (AMA)
Wang, Dong& Zhang, Xiaosong& Chen, Ting& Li, Jingwei. Discovering Vulnerabilities in COTS IoT Devices through Blackbox Fuzzing Web Management Interface. Security and Communication Networks. 2019. Vol. 2019, no. 2019, pp.1-19.
https://search.emarefa.net/detail/BIM-1210456
Data Type
Journal Articles
Language
English
Notes
Includes bibliographical references
Record ID
BIM-1210456