一句话：提出二进制模糊测试框架 BIFF，支持多架构纯二进制目标，低开销且能测试服务器类程序，发现 24 个未知漏洞。
IoT 与移动设备的安全问题至关重要，但其上应用多为厂商专有，fuzzer 必须支持纯二进制目标；加之设备架构异构、资源受限，且待测目标常为服务器类程序，现有灰盒 fuzzing 技术难以适用。本文提出通用模糊测试框架 BIFF：支持纯二进制目标，覆盖 Intel、ARM、MIPS、PowerPC 等多种 CPU 架构，运行时开销低于已有 fuzzer，并采用新的 fuzzing 工作流，可对目标二进制中任意代码片段进行模糊测试。实验表明 BIFF 性能优于当前最先进的二进制 fuzzer，并能测试后者无法处理的服务器类程序；利用 BIFF 在工业产品中发现 24 个未知漏洞，包括内存破坏、无限循环与无限递归。
Internet-of-things (IoT) or mobile devices are omnipresent in our daily life; the security issues inside them are especially crucial. Greybox fuzzing has been shown effective in detecting vulnerabilities. However, applications in IoT or mobile devices are usually proprietary to specific vendors, fuzzers are required to support binary-only targets. Moreover, since these devices are of heterogeneous architecture, assigned with limited resources, and many testing targets are server-like programs, applying existing fuzzing techniques faces great challenges.This paper proposes BIFF, a general-purpose fuzzer that aims to stress these issues. It supports binary-only targets, is general (supports multiple CPU architectures including Intel, ARM, MIPS, and PowerPC), fast (has the lowest runtime overhead compared to existing fuzzers), and flexible (uses a new fuzzing workflow that can fuzz any piece of code inside the target binary). Experiments demonstrate that BIFF has the best performance compared with state-of-the-art binary fuzzers and can fuzz the server-like programs which cannot be fuzzed by the existing fuzzers. Using BIFF, we’ve found 24 unknown vulnerabilities (including memory corruptions, infinite loops, and infinite recursions) in industrial products.
DOI 原文 ·
@inproceedings{paperbot6489,
title = {BIFF: Practical Binary Fuzzing Framework for Programs of IoT and Mobile Devices},
author = {Cen Zhang and Yuekang Li and Hongxu Chen and Xiaoxing Luo and Miaohua Li and Anh Quynh Nguyen and Yang Liu},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678910}
}