Powered by OpenAIRE graph
Found an issue? Give us feedback
image/svg+xml Jakob Voss, based on art designer at PLoS, modified by Wikipedia users Nina and Beao Closed Access logo, derived from PLoS Open Access logo. This version with transparent background. http://commons.wikimedia.org/wiki/File:Closed_Access_logo_transparent.svg Jakob Voss, based on art designer at PLoS, modified by Wikipedia users Nina and Beao Journal of Network a...arrow_drop_down
image/svg+xml Jakob Voss, based on art designer at PLoS, modified by Wikipedia users Nina and Beao Closed Access logo, derived from PLoS Open Access logo. This version with transparent background. http://commons.wikimedia.org/wiki/File:Closed_Access_logo_transparent.svg Jakob Voss, based on art designer at PLoS, modified by Wikipedia users Nina and Beao
Journal of Network and Computer Applications
Article . 2024 . Peer-reviewed
License: Elsevier TDM
Data sources: Crossref
https://doi.org/10.2139/ssrn.4...
Article . 2023 . Peer-reviewed
Data sources: Crossref
DBLP
Article . 2024
Data sources: DBLP
UQ eSpace
Article . 2024
Data sources: UQ eSpace
UQ eSpace
Article . 2024
Data sources: UQ eSpace
versions View all 5 versions
addClaim

Hd-Fuzz: Hardware Dependency-Aware Firmware Fuzzing Via Hybrid Mmio Modeling

Authors: Juhwan Kim; Jihyeon Yu; Youngwoo Lee; Dan Dongseong Kim; Joobeom Yun;

Hd-Fuzz: Hardware Dependency-Aware Firmware Fuzzing Via Hybrid Mmio Modeling

Abstract

Numerous interconnected small embedded systems, such as Internet of Things (IoT) devices, are pervasive in our daily lives; however, their security lags behind. In particular, firmware vulnerabilities in low-level infrastructure have a more severe impact than application -level vulnerabilities. Fuzzing is the most effective technique for detecting vulnerabilities in firmware, but it encounters several challenges such as hardwaredependency, input channel, and instrumentation. Existing studies attempt to overcome these challenges by applying fuzzing to firmware re -hosting. However, they explore only worthwhile paths based on heuristics and human assistance without identifying security -critical firmware code. This results in low code coverage and reduces the likelihood of discovering potential bugs. In this work, we propose a novel hardware dependencyaware re -hosting system named HD -FUZZ that focuses on the firmware fuzzing process to efficiently discover bugs by exploring all possible paths in security -critical firmware code. The key ideas of HD -FUZZ are: (1) to propose a hybrid memory -mapped I/O (MMIO) modeling; (2) to achieve efficiency by mainly performing MMIO modeling through fuzzing; and (3) to achieve completeness by performing MMIO modeling through symbolic execution only to satisfy complex checks affecting the execution flow. HD -FUZZ has been extensively evaluated on both unit test cases and real -world targets, covering 12 hardware platforms and 67 firmware images. Compared to state-of-the-art works, HD -FUZZ achieves the highest passing rate in unit test benchmarks, reaches up to 2.62 times higher code coverage in fuzzing benchmarks, and generates initial access models up to 11.6 times faster. Notably, HD -FUZZ finds two new bugs, including ones in targets that were previously analyzed by other works.

Related Organizations
Keywords

Symbolic execution, 1708 Hardware and Architecture, Firmware, 1705 Computer Networks and Communications, Internet of Things, 1706 Computer Science Applications, Fuzzing, Vulnerability

  • BIP!
    Impact byBIP!
    selected citations
    These citations are derived from selected sources.
    This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    7
    popularity
    This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
    Top 10%
    influence
    This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    Average
    impulse
    This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
    Top 10%
Powered by OpenAIRE graph
Found an issue? Give us feedback
selected citations
These citations are derived from selected sources.
This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Citations provided by BIP!
popularity
This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
BIP!Popularity provided by BIP!
influence
This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Influence provided by BIP!
impulse
This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
BIP!Impulse provided by BIP!
7
Top 10%
Average
Top 10%
Upload OA version
Are you the author of this publication? Upload your Open Access version to Zenodo!
It’s fast and easy, just two clicks!