Abstract:ABSTRACTReal-Time Operating System (RTOS) has become the main category of embedded systems. It is widely used to support tasks requiring real-time response such as printers and switches. The security of RTOS has been long overlooked as it was running in special environments isolated from attackers. However, with the rapid development of IoT devices, tremendous RTOS devices are connected to the public network. Due to the lack of security mechanisms, these devices are extremely vulnerable to a wide spectrum of attacks. Even worse, the monolithic design of RTOS combines various tasks and services into a single binary, which hinders the current program testing and analysis techniques working on RTOS. In this paper, we propose SFuzz, a novel slice-based fuzzer, to detect security vulnerabilities in RTOS. Our insight is that RTOS usually divides a complicated binary into many separated but single-minded tasks. Each task accomplishes a particular event in a deterministic way and its control flow is usually straightforward and independent. Therefore, we identify such code from the monolithic RTOS binary and synthesize a slice for effective testing. Specifically, SFuzz first identifies functions that handle user input, constructs call graphs that start from callers of these functions, and leverages forward slicing to build the execution tree based on the call graphs and pruning the paths independent of external inputs. Then, it detects and handles roadblocks within the coarse-grain scope that hinder effective fuzzing, such as instructions unrelated to the user input. And then, it conducts coverage-guided fuzzing on these code snippets. Finally, SFuzz leverages forward and backward slicing to track and verify each path constraint and determine whether a bug discovered in the fuzzer is a real vulnerability. SFuzz successfully discovered 77 zero-day bugs on 35 RTOS samples, and 67 of them have been assigned CVE or CNVD IDs. Our empirical evaluation shows that SFuzz outperforms the state-of-the-art tools (e.g., UnicornAFL) on testing RTOS.

Poster: Fuzzing IoT Firmware via Multi-stage Message Generation

SIoTFuzzer: Fuzzing Web Interface in IoT Firmware Via Stateful Message Generation

MorFuzz: Fuzzing Processor Via Runtime Instruction Morphing Enhanced Synchronizable Co-simulation.

Simulation-Based Fuzzing for Smart IoT Devices

Fw‐fuzz: A code coverage‐guided fuzzing framework for network protocols on firmware

Physical Devices-Agnostic Hybrid Fuzzing of IoT Firmware

Parallel Fuzzing of IoT Messaging Protocols Through Collaborative Packet Generation

MultiFuzz: A Coverage-Based Multiparty-Protocol Fuzzer for IoT Publish/Subscribe Protocols

Optimizing IoT Web Fuzzing by Firmware Infomation Mining

Firmware Fuzzing: the State of the Art

Discovering Vulnerabilities in COTS IoT Devices Through Blackbox Fuzzing Web Management Interface

IoTInfer: Automated Blackbox Fuzz Testing of IoT Network Protocols Guided by Finite State Machine Inference

Labrador: Response Guided Directed Fuzzing for Black-box IoT Devices

ChatHTTPFuzz: Large Language Model-Assisted IoT HTTP Fuzzing

HFuzz: Towards automatic fuzzing testing of NB-IoT core network protocols implementations

AflIot: Fuzzing on linux-based IoT device with binary-level instrumentation

SFuzz: Slice-based Fuzzing for Real-Time Operating Systems

Exploring Effective Fuzzing Strategies to Analyze Communication Protocols

SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices

Trampoline Over the Air: Breaking in IoT Devices Through MQTT Brokers

SPFuzz: A Hierarchical Scheduling Framework for Stateful Network Protocol Fuzzing