计算机科学 ›› 2024, Vol. 51 ›› Issue (10): 196-207.doi: 10.11896/jsjkx.230700068
司健鹏, 洪征, 周振吉, 陈乾, 李涛
SI Jianpeng, HONG Zheng, ZHOU Zhenji, CHEN Qian, LI Tao
摘要： 大部分嵌入式设备的固件提供Web接口,方便用户对设备进行配置和管理。然而,这些Web接口常常存在安全问题,给嵌入式设备的安全带来挑战。针对嵌入式设备固件中Web接口的漏洞检测方法误报率较高的问题,提出一种关键字敏感的嵌入式设备固件模糊测试方法KS-Fuzz(Keyword Sensitive Fuzzing),高效地对嵌入式设备固件中Web接口的处理逻辑进行模糊测试。该方法通过前后端文件的关联分析,生成高质量的测试用例,在模糊测试过程中记录目标设备后端文件对前端文件关键字的引用,引导测试用例的变异,扩大模糊测试的覆盖范围。文中使用KS-Fuzz对多款主流品牌的嵌入式设备进行测试,以评估KS-Fuzz的漏洞挖掘能力,并与SaTC,IOTScope,FirmFuzz等现有漏洞挖掘方法进行比较。结果表明,相比现有漏洞挖掘方法,KS-Fuzz通过对前后端文件关联性的分析,可以快速遍历目标设备的功能接口,在模糊测试过程中发现更多的安全问题。
中图分类号:
| [1]China Communications Standards Association.Internet ofThings Operating System Security White Paper(2022)[EB/OL].(2022-09-08) [2023-08-03].http://blog.nsfocus.net/wp-content/uploads/2022/09/iot-whitepaper.pdf. [2]TO BE BETTER_MEN.GoAhead1- Basic Introduction[EB/OL].(2022-09-08) [2023-08-03].https://blog.csdn.net/to_be_better_wen/article/details/128749040. [3]MY HEART.Realize HTTP server from zero－Minihttpd(IV)－semi connected and semi reactor Thread pool[EB/OL].(2020-07-03) [2023-08-03].https://www.jianshu.com/p/b11fabfc2c6c. [4]ONE PORT LINUX.Building an embedded web server fromscratch-boa[EB/OL].(2022-02-27) [2023-08-03].https://blog.csdn.net/daocaokafei/article/details/122738254. [5]KIKILBS.Schematic diagram of CGI execution in lighttpd[EB/OL].(2010-07-05) [2023-08-03].https://blog.csdn.net/kikilbs/article/details/5713677. [6]REDINI N,MACHIRY A,WANG R,et al.Karonte:DetectingInsecure Multi-binary Interactions in Embedded Firmware[C]//2020 IEEE Symposium on Security and Privacy.2020:1544-1561. [7]CHEN L,WANG Y,CAI Q,et al.Sharing More and Checking Less:Leveraging Common Input Keywords to Detect Bugs in Embedded Systems[C]//30th USENIX Security Symposium.2021:303-319. [8]CHEN D,MAVERICK W,DAVID B,et al.Towards Automated Dynamic Analysis for Linux-based Embedded Firmware[C]//Network and Distributed System Security Symposium.2016:1-16. [9]TOBIAS S,NILS B,MORITZ S,et al.Fuzzware:Using Precise {MMIO} Modeling for Effective Firmware Fuzzing [C]//31st USENIX Security Symposium.2022:1239-1256. [10]SRIVASTAVA P,PENG H,LI J,et al.FirmFuzz:Automated IoT firmware introspection and analysis[C]//Proceedings of the 2nd International ACM Workshop on Security and Privacy for the Internet-of-Things.2019:15-21. [11]ZHANG H,KAI L,XU Z,et al.SIoTFuzzer:Fuzzing Web Interface in IoT Firmware via Stateful Message Generation [J].Applied Sciences,2021,11(7):3120. [12]ZHANG Y,HUO W,K P,et al.SRFuzzer:An automaticfuzzing framework for physical SOHO router devices to discover multi-type vulnerabilities [C]//the 35th Annual Computer Security Applications Conference.2019. [13]NILO R,ANDREA C,DIPANJAN D,et al.DIANE:Identifying FuzzingTriggers in Apps to Generate Under-constrained Inputs for IoT Devices[C]//2021 IEEE Symposium on Security and Privacy.2021:484-500. [14]CHEN J,DIAO W,ZHAO Q,et al.IoTFuzzer:Discoveringmemory corruptions in IOT through APP-based fuzzing[C]//Network and Distributed System Security Symposium.2018. [15]KIM J,YU J,KIM H,et al.FIRM-COV:High-Coverage Greybox Fuzzing for IoT Firmware via Optimized Process Emulation [J].IEEE Access,2021,9:101627-101642. [16]LIU P,JI S,ZHANG X,et al.IFIZZ:Deep-State and Efficient Fault-Scenario Generation to Test IoT Firmware [C]//2021 36th IEEE/ACM International Conference on Automated Software Engineering(ASE).Melbourne,Australia,2021:805-816. |
|
||
首页