Discovering Vulnerabilities in COTS IoT Devices through Blackbox Fuzzing Web Management Interface

摘要: A novel approach for discovering vulnerability in commercial off-the-shelf (COTS) IoT devices is proposed this paper, which will revolutionize the area. Unlike previous work, web management interface was used to detect vulnerabilities by leveraging fuzzing technology. To validate and evaluate scheme, a tool named WMIFuzzer designed implemented. There were also two challenges: (1) due diversity of implementations, there no existing seed messages it inefficient while taking random launch (2) because highly structured message, with byte-level mutation could conduce be rejected device at an early stage. address these challenges, brute-force UI automation drive generate initial automatically, as well weighted message parse tree (WMPT) guide mostly structure-valid messages. The extensive experimental results show that achieve expected result 10 including 6 zero-days 7 COTS discovered.