MultiFuzz: A Coverage-Based Multiparty-Protocol Fuzzer for IoT Publish/Subscribe Protocols

Yingpei Zeng,Mingmin Lin,Shanqing Guo,Yanzhao Shen,Tingting Cui,Ting Wu,Qiuhua Zheng,Qiuhua Wang
DOI: https://doi.org/10.3390/s20185194
IF: 3.9
2020-09-11
Sensors
Abstract:The publish/subscribe model has gained prominence in the Internet of things (IoT) network, and both Message Queue Telemetry Transport (MQTT) and Constrained Application Protocol (CoAP) support it. However, existing coverage-based fuzzers may miss some paths when fuzzing such publish/subscribe protocols, because they implicitly assume that there are only two parties in a protocol, which is not true now since there are three parties, i.e., the publisher, the subscriber and the broker. In this paper, we propose MultiFuzz, a new coverage-based multiparty-protocol fuzzer. First, it embeds multiple-connection information in a single input. Second, it uses a message mutation algorithm to stimulate protocol state transitions, without the need of protocol specifications. Third, it uses a new desockmulti module to feed the network messages into the program under test. desockmulti is similar to desock (Preeny), a tool widely used by the community, but it is specially designed for fuzzing and is 10x faster. We implement MultiFuzz based on AFL, and use it to fuzz two popular projects Eclipse Mosquitto and libCoAP. We reported discovered problems to the projects. In addition, we compare MultiFuzz with AFL and two state-of-the-art fuzzers, MOPT and AFLNET, and find it discovering more paths and crashes.
engineering, electrical & electronic,chemistry, analytical,instruments & instrumentation
What problem does this paper attempt to address?
### Problems Addressed by the Paper This paper aims to address the issue of insufficient path coverage in existing coverage-based fuzz testing tools when testing Internet of Things (IoT) publish/subscribe protocols. Specifically, existing fuzz testing tools typically assume that there are only two participants (i.e., sender and receiver) in a network protocol, ignoring the three participants (publisher, subscriber, and broker) in publish/subscribe protocols. This assumption leads to the inability of existing tools to simulate the complete multi-participant interaction process during testing, potentially missing some important execution paths and potential vulnerabilities. ### Background and Motivation 1. **Importance of the Publish/Subscribe Model**: - The publish/subscribe model is very popular in IoT networks because it provides loose coupling and scalability. For example, both MQTT and CoAP protocols support this model. - This model allows multiple publishers to send data to multiple subscribers without direct communication between them. 2. **Limitations of Existing Fuzz Testing Tools**: - Existing coverage-based fuzz testing tools (such as AFL) typically assume that there are only two participants in a network protocol, thus can only simulate single-connection interactions. - In publish/subscribe protocols, this assumption leads to the inability of the tools to simulate the complete multi-participant interaction process, potentially missing some important execution paths and potential vulnerabilities. ### Solution To overcome the above issues, this paper proposes a new coverage-based multi-participant protocol fuzz testing tool—MultiFuzz. The main features of MultiFuzz include: 1. **Multi-Connection Information Embedding**: - MultiFuzz embeds multi-connection information in a single input, allowing each input to contain messages from multiple connections. - This way, the tool can simulate the interaction process of multiple participants in a single test. 2. **Message Mutation Algorithm**: - MultiFuzz uses a new message mutation algorithm to stimulate protocol state transitions without requiring the user to provide protocol specifications. - This algorithm mutates messages at a higher level, thereby more effectively exploring different states of the protocol. 3. **New desockmulti Module**: - MultiFuzz introduces a new desockmulti module to input network messages into the program under test. - desockmulti is 10 times faster than the existing desock tool and supports multiple connections. ### Experimental Results - **Performance Comparison**: - MultiFuzz outperforms existing fuzz testing tools such as AFL, MO PT, and AFL NET in terms of discovering paths and crashes. - For example, when testing Eclipse Mosquitto, MultiFuzz discovered 44.6% more paths than AFL NET, 126.6% more than AFL, and 125.4% more than MO PT. - **Practical Application**: - The authors used MultiFuzz to test two popular projects: Eclipse Mosquitto (an MQTT broker) and libCoAP (a CoAP library). - The discovered vulnerabilities have been reported to the respective projects and have been confirmed. ### Conclusion The MultiFuzz tool proposed in this paper effectively addresses the issue of insufficient path coverage in existing fuzz testing tools when testing publish/subscribe protocols by supporting multi-connection and multi-participant interactions. Experimental results show that MultiFuzz has significant advantages in discovering paths and vulnerabilities.