Favocado: Fuzzing the Binding Code of JavaScript Engines Using Semantically Correct Test Cases

Dinh, Sung Ta; Cho, Haehyun; Martin, Kyle; Oest, Adam; Zeng, Kyle; Kapravelos, Alexandros; Ahn, Gail-Joon; Bao, Tiffany; Wang, Ruoyu; Doupé, Adam; Shoshitaishvili, Yan

doi:10.14722/ndss.2021.24224

Cited by 16 publications

(5 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Black-box fuzzing does not know the internal state of the program for each execution [13,24]. The program under test is a black box to fuzzers, which usually optimize the fuzzing process by exploiting input formats or different program output states [25,26]. White-box fuzzing usually needs to have all the source code of the target object, to be able to obtain all the execution information of the target object during the fuzzing process [27].…”

Section: Iot Smart Device Fuzzingmentioning

confidence: 99%

IoTFuzzBench: A Pragmatic Benchmarking Framework for Evaluating IoT Black-Box Protocol Fuzzers

et al. 2023

View full text Add to dashboard Cite

High scalability and low operating cost make black-box protocol fuzzing a vital tool for discovering vulnerabilities in the firmware of IoT smart devices. However, it is still challenging to compare black-box protocol fuzzers due to the lack of unified benchmark firmware images, complete fuzzing mutation seeds, comprehensive performance metrics, and a standardized evaluation framework. In this paper, we design and implement IoTFuzzBench, a scalable, modular, metric-driven automation framework for evaluating black-box protocol fuzzers for IoT smart devices comprehensively and quantitatively. Specifically, IoTFuzzBench has so far included 14 real-world benchmark firmware images, 30 verified real-world benchmark vulnerabilities, complete fuzzing seeds for each vulnerability, 7 popular fuzzers, and 5 categories of complementary performance metrics. We deployed IoTFuzzBench and evaluated 7 popular black-box protocol fuzzers on all benchmark firmware images and benchmark vulnerabilities. The experimental results show that IoTFuzzBench can not only provide fast, reliable, and reproducible experiments, but also effectively evaluate the ability of each fuzzer to find vulnerabilities and the differential performance on different performance metrics. The fuzzers found a total of 13 vulnerabilities out of 30. None of these fuzzers can outperform the others on all metrics. This result demonstrates the importance of comprehensive metrics. We hope our findings ease the burden of fuzzing evaluation in IoT scenarios, advancing more pragmatic and reproducible fuzzer benchmarking efforts.

show abstract

Section: Iot Smart Device Fuzzingmentioning

confidence: 99%

IoTFuzzBench: A Pragmatic Benchmarking Framework for Evaluating IoT Black-Box Protocol Fuzzers

et al. 2023

View full text Add to dashboard Cite

show abstract

“…Blackbox fuzzing does not have any knowledge about the internal states of each execution [3,29,36,78,99]. These fuzzers usually optimize fuzzing processes via utilizing input formats [59,78,99] or diferent output states [55,61]. Whitebox fuzzing obtains all the internal knowledge of each execution, enabling it to systematically explore the state space of target programs.…”

Section: Overview Of Fuzzingmentioning

confidence: 99%

“…DIANE [159] encoding function byte-function IoT ! Facovado [59] dependency inference chunk-chunk JavaScript engine ! : Whitebox Fuzzing; : Greybox Fuzzing; : Blackbox Fuzzing.…”

Section: Search Space Of Inputsmentioning

confidence: 99%

“…Many applications require correct data dependency in inputs, which usually consist of sequences of statements. The sequences include system calls for kernel code [77,95,142], objects for processors of object-oriented programs [59,117], application programming interfaces (APIs) for services/libraries [8,83,110], or application binary interfaces (ABIs) for smart contracts [86]. On the one hand, most of these applications require deinition/declaration before using the data in inputs, as depicted in Fig.…”

Section: Dependency Inferencementioning

confidence: 99%

“…The data dependency of sequences is usually inferred via static analysis. Because many applications have documents or source code describing their interfaces, researchers infer the data dependency based on those resources [8,53,59,86,110,117]. The resources contain information about how to use an interface and the prerequisites for the interface.…”

Section: Documents or Sourcementioning

confidence: 99%

See 2 more Smart Citations

Fuzzing: A Survey for Roadmap

et al. 2022

View full text Add to dashboard Cite

Fuzz testing (fuzzing) has witnessed its prosperity in detecting security flaws recently. It generates a large number of test cases and monitors the executions for defects. Fuzzing has detected thousands of bugs and vulnerabilities in various applications. Although effective, there lacks systematic analysis of gaps faced by fuzzing. As a technique of defect detection, fuzzing is required to narrow down the gaps between the entire input space and the defect space. Without limitation on the generated inputs, the input space is infinite. However, defects are sparse in an application, which indicates that the defect space is much smaller than the entire input space. Besides, because fuzzing generates numerous test cases to repeatedly examine targets, it requires fuzzing to perform in an automatic manner. Due to the complexity of applications and defects, it is challenging to automatize the execution of diverse applications. In this paper, we systematically review and analyze the gaps as well as their solutions, considering both breadth and depth. This survey can be a roadmap for both beginners and advanced developers to better understand fuzzing.

show abstract