CoChat
Sign Up
Cited by 219Software Testing and Debugging TechniquesSecurity and Verification in ComputingAdvanced Malware Detection Techniques

What You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded Devices

Open access
Muench, Marius, Stijohann, Jan, Kargl, Frank, Francillon, Aurelien, Balzarotti, Davide·2018·Proceedings 2018 Network and Distributed System Security Symposium
DOI 10.14722/ndss.2018.23166
Open this paper in CoChat — free account

Abstract

As networked embedded systems are becoming more ubiquitous, their security is becoming critical to our daily life.While manual or automated large scale analysis of those systems regularly uncover new vulnerabilities, the way those systems are analyzed follows often the same approaches used on desktop systems.More specifically, traditional testing approaches relies on observable crashes of a program, and binary instrumentation techniques are used to improve the detection of those faulty states.In this paper, we demonstrate that memory corruptions, a common class of security vulnerabilities, often result in different behavior on embedded devices than on desktop systems.In particular, on embedded devices, effects of memory corruption are often less visible.This reduces significantly the effectiveness of traditional dynamic testing techniques in general, and fuzzing in particular.Additionally, we analyze those differences in several categories of embedded devices and show the resulting impact on firmware analysis.We further describe and evaluate relatively simple heuristics which can be applied at run time (on an execution trace or in an emulator), during the analysis of an embedded device to detect previously undetected memory corruptions.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.14722/ndss.2018.23166

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Most existing machine learning-based methods extract program features through static analysis or dynamic execution and use machine learning algorithms to learn existing defect features and find known defects in the program.

    “Most existing machine learning-based methods extract program features through static analysis or dynamic execution and use machine learning algorithms to learn existing defect features and find known defects in the program [43].”

    From A Survey of IoT Privacy Security: Architecture, Technology, Challenges, and Trends (2024) · cites this paper as [43]

    Section V, “Fault Detection Heuristics” (page unavailable), describes compile-time and run-time techniques for detecting memory corruption. Searches for machine-learning methods, learned defect features, and known-defect detection found no passage addressing how most machine-learning-based methods work. (LLM, conf=0.74)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

No references could be resolved yet.

Research works printed but not linked: 39

  1. M. Abadi, M. Budiu, U. Erlingsson, and J. Ligatti, "Control-flow integrity," in 12th ACM conference on Computer and communications security (CCS), 2005.
  2. V. Alimi, S. Vernois, and C. Rosenberger, "Analysis of embedded applications by evolutionary fuzzing," in International Conference on High Performance Computing & Simulation (HPCS). IEEE, 2014.
  3. Z. Basnight, J. Butts, J. Lopez, and T. Dube, "Firmware modification attacks on programmable logic controllers," International Journal of Critical Infrastructure Protection, vol. 6, no. 2, 2013.
  4. D. L. Bruening, "Efficient, transparent, and comprehensive runtime code manipulation," Ph.D. dissertation, Massachusetts Institute of Technol- ogy, 2004.
  5. D. D. Chen, M. Egele, M. Woo, and D. Brumley, "Towards Automated Dynamic Analysis for Linux-based Embedded Firmware," in Network and Distributed System Security Symposium (NDSS), 2016.
  6. V. Chipounov, V. Kuznetsov, and G. Candea, "S2E: a platform for in- vivo multi-path analysis of software systems," ACM SIGPLAN Notices, vol. 46, no. 3, 2011.
  7. A. Costin, A. Zarras, and A. Francillon, "Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces," in 11th ACM symposium on Information, computer and communications security (ASIACCS), 2016.
  8. A. Cui and S. Stolfo, "Defending embedded systems with software symbiotes," in Recent Advances in Intrusion Detection. Springer, 2011.
  9. B. Dolan-Gavitt, J. Hodosh, P. Hulin, T. Leek, and R. Whelan, "Re- peatable reverse engineering with PANDA," in Proceedings of the 5th Program Protection and Reverse Engineering Workshop. ACM, 2015.
  10. B. Dolan-Gavitt, P. Hulin, E. Kirda, T. Leek, A. Mambretti, W. Robert- son, F. Ulrich, and R. Whelan, "LAVA: Large-scale automated vulnera- bility addition," in 37th IEEE Symposium on Security and Privacy (SP), 2016.
  11. I. D. Foster, A. Prudhomme, K. Koscher, and S. Savage, "Fast and Vulnerable: A Story of Telematic Failures," in 9th USENIX Workshop on Offensive Technologies (WOOT), 2015.
  12. V. Ganesh, T. Leek, and M. Rinard, "Taint-based directed whitebox fuzzing," in 31st International Conference on Software Engineering. IEEE, 2009.
  13. P. Godefroid, M. Y. Levin, and D. Molnar, "SAGE: whitebox fuzzing for security testing," Queue, vol. 10, no. 1, 2012.
  14. I. Haller, A. Slowinska, M. Neugschwandtner, and H. Bos, "Dowsing for Overflows: A Guided Fuzzer to Find Buffer Boundary Violations," in USENIX Security Symposium, 2013.
  15. W. Jin, C. Cohen, J. Gennari, C. Hines, S. Chaki, A. Gurfinkel, J. Havrilla, and P. Narasimhan, "Recovering C++ objects from binaries using inter-procedural data-flow analysis," in Proceedings of the ACM SIGPLAN on Program Protection and Reverse Engineering Workshop (PPREW), 2014.
  16. N. Kamel and J.-L. Lanet, "Analysis of HTTP protocol implementation in smart card embedded web server," International Journal of Informa- tion and Network Security, vol. 2, no. 5, 2013.
  17. M. Kammerstetter, D. Burian, and W. Kastner, "Embedded Security Testing with Peripheral Device Caching and Runtime Program State Approximation," in 10th International Conference on Emerging Security Information, Systems and Technologies (SECUWARE), 2016.
  18. M. Kammerstetter, C. Platzer, and W. Kastner, "PROSPECT: Peripheral Proxying Supported Embedded Code Testing," in 9th ACM symposium on Information, computer and communications security (ASIACCS), 2014.
  19. K. Koscher, A. Czeskis, F. Roesner, S. Patel, T. Kohno, S. Checkoway, D. McCoy, B. Kantor, D. Anderson, H. Shacham et al., "Experimental security analysis of a modern automobile," in 30th IEEE Symposium on Security and Privacy (SP), 2010.
  20. K. Koscher, T. Kohno, and D. Molnar, "SURROGATES: enabling near- real-time dynamic analyses of embedded systems," in 9th USENIX Workshop on Offensive Technologies (WOOT), 2015.
  21. H. Lee, K. Choi, K. Chung, J. Kim, and K. Yim, "Fuzzing CAN Packets into Automobiles," in 29th International Conference on Advanced Information Networking and Applications (AINA). IEEE, 2015.
  22. U. Lindqvist and P. G. Neumann, "The future of the internet of things," Communications of the ACM, vol. 60, no. 2, 2017.
  23. C.-K. Luk, R. Cohn, R. Muth, H. Patil, A. Klauser, G. Lowney, S. Wallace, V. J. Reddi, and K. Hazelwood, "Pin: building customized program analysis tools with dynamic instrumentation," in ACM SIG- PLAN notices, vol. 40, 2005.
  24. B. P. Miller, L. Fredriksen, and B. So, "An empirical study of the reliability of UNIX utilities," Communications of the ACM, vol. 33, no. 12, 1990.
  25. C. Miller and C. Valasek, "Remote exploitation of an unaltered passen- ger vehicle," Black Hat USA, vol. 2015, 2015.
  26. C. Mulliner, N. Golde, and J.-P. Seifert, "SMS of Death: From Analyz- ing to Attacking Mobile Phones on a Large Scale," in USENIX Security Symposium, 2011.
  27. N. Nethercote and J. Seward, "Valgrind: a framework for heavyweight dynamic binary instrumentation," in ACM SIGPLAN notices, vol. 42, no. 6, 2007.
  28. A. Nordrum, "The internet of fewer things [news]," IEEE Spectrum, vol. 53, no. 10, 2016.
  29. D. Papp, Z. Ma, and L. Buttyan, "Embedded systems security: Threats, vulnerabilities, and attack taxonomy," in 13th Annual Conference on Privacy, Security and Trust (PST). IEEE, 2015.
  30. S. Rawat, V. Jain, A. Kumar, L. Cojocar, C. Giuffrida, and H. Bos, "VUzzer: Application-aware Evolutionary Fuzzing," in Network and Distributed System Security Symposium (NDSS), 2017.
  31. K. Serebryany, D. Bruening, A. Potapenko, and D. Vyukov, "Ad- dressSanitizer: A Fast Address Sanity Checker," in USENIX Annual Technical Conference, 2012.
  32. K. Serebryany and T. Iskhodzhanov, "ThreadSanitizer: data race de- tection in practice," in Proceedings of the 3rd Workshop on Binary Instrumentation and Applications (WBIA). ACM, 2009.
  33. A. Slowinska, T. Stancescu, and H. Bos, "Howard: A Dynamic Ex- cavator for Reverse Engineering Data Structures," in Network and Distributed System Security Symposium (NDSS), 2011.
  34. E. Stepanov and K. Serebryany, "MemorySanitizer: fast detector of uninitialized memory use in C++," in International Symposium on Code Generation and Optimization (CGO). IEEE, 2015.
  35. N. Stephens, J. Grosen, C. Salls, A. Dutcher, R. Wang, J. Corbetta, Y. Shoshitaishvili, C. Kruegel, and G. Vigna, "Driller: Augmenting Fuzzing Through Selective Symbolic Execution," in Network and Dis- tributed System Security Symposium (NDSS), 2016.
  36. M. Sutton, A. Greene, and P. Amini, Fuzzing: brute force vulnerability discovery. Pearson Education, 2007.
  37. F. Van Den Broek, B. Hond, and A. C. Torres, "Security testing of GSM implementations," in International Symposium on Engineering Secure Software and Systems. Springer, 2014.
  38. V. Van der Veen, L. Cavallaro, H. Bos et al., "Memory errors: the past, the present, and the future," in International Workshop on Recent Advances in Intrusion Detection. Springer, 2012.
  39. J. Zaddach, L. Bruno, A. Francillon, and D. Balzarotti, "AVATAR: A Framework to Support Dynamic Security Analysis of Embedded Systems' Firmwares," in Network and Distributed System Security Symposium (NDSS), 2014.

Cited by

Sorted by citations

Authors
Muench, M., Stijohann, J., Kargl, F., Francillon, A., & Balzarotti, D.
Affiliations
  • EURECOM (FR)
  • Siemens (Germany) (DE)
  • Universität Ulm (DE)
ORCID
Venue
Proceedings 2018 Network and Distributed System Security Symposium
Publisher
Internet Society
Published
2018
DOI
10.14722/ndss.2018.23166
OpenAlex
W2782780792
Cited by
219
References
0
Citations by year
2026: 17 · 2025: 25 · 2024: 19 · 2023: 29 · 2022: 30 · 2021: 35 · 2020: 34 · 2019: 27 · 2018: 3
FWCI
16.77
Type
conference paper
Language
en
Open access
Locations
  • Network and Distributed System Security Symposium (publishedVersion)
  • Graduate School and Research Center in Digital Science (EURECOM) (submittedVersion)
  • University of Birmingham Research Portal (University of Birmingham) (submittedVersion, other-oa)
Topics
  • Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
  • Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
  • Physical Sciences › Computer Science › Signal Processing › Advanced Malware Detection Techniques
Keywords
fuzzing, embedded devices, memory corruption vulnerabilities, dynamic testing, firmware analysis, accident detection, binary instrumentation, execution traces

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review