一句话：提出 WingMuzz，用同规范开源实现的灰盒覆盖率反馈引导 IoT 协议黑盒模糊测试，并以二维调度提升边覆盖与漏洞发现。
针对 IoT 设备源码与固件常不可得、黑盒模糊测试缺乏覆盖率反馈的问题，WingMuzz 利用同一协议规范下的开源实现作为参照：先在开源代码上运行覆盖率引导的灰盒模糊测试，再将探索不同代码区域的输入用于引导 IoT 协议黑盒测试。其二维调度一方面在开源实现（wingmates）间优先选择相似者，另一方面在开源代码上执行覆盖率引导灰盒模糊测试。在 8 个 IoT 协议上，WingMuzz 比 Boofuzz、Spike、Peach、Snipuzz、Pulsar、ChatAFL 平均多发现 42.1%、26.92%、25.01%、34.95%、23.56% 和 11.63% 的边；发现 10 个协议缺陷，而其他工具最多 3 个，并新发现 2 个 IoT 设备协议漏洞。
The Internet of Things (IoT) is widely used in various sectors but is often prone to vulnerabilities. With the proprietary nature of IoT devices, their source code and firmware are frequently unavailable for open review, rendering blackbox fuzzing a viable approach. However, the effectiveness of blackbox fuzzing is often challenging due to the lack of feedback, especially the information of code coverage. In this paper, we propose WingMuzz to provide blackbox fuzzing of IoT protocols with effective feedback. The key is to guide blackbox fuzzing by utilizing runtime information from greybox fuzzing on counterpart open-source code. This is based on our observation that IoT protocols and open-source code conform to the same specifications, indicating that inputs exploring different code regions on open-source code may also discover new coverage on IoT protocols. WingMuzz uses a two-dimensional fuzzing schedule to optimize the process of fuzzing IoT protocols. The first dimension involves scheduling open-source implementations, referred to as wingmates, so that similar ones are preferred to guide blackbox fuzzing. The second dimension utilizes coverage-guided greybox fuzzing to test open-source code. This solution can bridge the performance gap between blackbox fuzzing and greybox fuzzing on IoT protocols. We evaluate the performance of WingMuzz across eight IoT protocols and compare it with six widely-used blackbox fuzzers. On average, WingMuzz can discover 42.1%, 26.92%, 25.01%, 34.95%, 23.56% and 11.63% more edges than Boofuzz, Spike, Peach, Snipuzz, Pulsar and ChatAFL, respectively. Additionally, WingMuzz exposes 10 bugs in IoT protocols while other fuzzers expose no more than 3 bugs. It also exposes 2 new protocol vulnerabilities in IoT devices while other fuzzers cannot identify any.
DOI 原文 ·
@inproceedings{paperbot9406,
title = {WingMuzz: Blackbox Testing of IoT Protocols via Two-dimensional Fuzzing Schedule},
author = {Xiaogang Zhu and Enze Dai and Xiaotao Feng and Shaohua Wang and Xin Xia and Sheng Wen and Kwok-Yan Lam and Yang Xiang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00212}
}