Detection and Analysis of Broken Access Control Vulnerabilities in App-Cloud Interaction in IoT
Zehui Zhang,Futai Zou,Jianan Hong,Libo Chen,Ping Yi
DOI: https://doi.org/10.1109/jiot.2024.3400858
IF: 10.6
2024-01-01
IEEE Internet of Things Journal
Abstract:At present, there is less research on the detection of broken access control vulnerabilities in the Internet of Things (IoT) systems, mostly using state machines to analyse abnormal state transitions and no systematic tools have been developed. The main challenges include the inaccessibility of communication messages, a lack of effective detection for broken access control vulnerabilities, and excessive manual involvement. Moreover, due to the existence of encryption, signatures, and other fields, it is challenging to directly port the Web-based detection tools to IoT. In response to these challenges, we propose a framework for detecting broken access control vulnerabilities based on the interaction between the applications and cloud platforms. The framework employs man-in-the-middle techniques to obtain communication messages between the two entities, enabling fast and effective fuzz testing through the keyword extraction, database-guided fuzzing, and response-based detection algorithms. In addition, a combination of dynamic and static reverse analysis techniques are used to overcome anti-tampering measures, such as encryption and signatures. Following the detection framework, we implemented the semi-automated broken access control detector (BACDetector) system and tested it on six applications from four manufacturers. BACDetector discovered nine broken access control vulnerabilities, including risks of device hijacking and privacy leakage. This validated its effectiveness in detecting vulnerabilities in IoT.