IFIZZ: Deep-State and Efficient Fault-Scenario Generation to Test IoT Firmware

Abstract

IoT devices are abnormally prone to diverse errors due to harsh environments and limited computational capabilities. As a result, correct error handling is critical in IoT. Implementing correct error handling is non-trivial, thus requiring extensive testing such as fuzzing. However, existing fuzzing cannot effectively test IoT error-handling code. First, errors typically represent corner cases, thus are hard to trigger. Second, testing error-handling code would frequently crash the execution, which prevents fuzzing from testing following deep error paths.In this paper, we propose IFIZZ, a new bug detection system specifically designed for testing error-handling code in Linuxbased IoT firmware. IFIZZ first employs an automated binarybased approach to identify realistic runtime errors by analyzing errors and error conditions in closed-source IoT firmware. Then, IFIZZ employs state-aware and bounded error generation to reach deep error paths effectively. We implement and evaluate IFIZZ on 10 popular IoT firmware. The results show that IFIZZ can find many bugs hidden in deep error paths. Specifically, IFIZZ finds 109 critical bugs, 63 of which are even in widely used IoT libraries. IFIZZ also features high code coverage and efficiency, and covers 67.3% more error paths than normal execution. Meanwhile, the depth of error handling covered by IFIZZ is 7.3 times deeper than that covered by the state-of-theart method. Furthermore, IFIZZ has been practically adopted and deployed in a worldwide leading IoT company. We will opensource IFIZZ to facilitate further research in this area.

A Large-Scale Analysis of IoT Firmware Version Distribution in the Wild

“…From a technical perspective, vulnerabilities in IoT FW are mainly caused by input-independent errors (e.g., memory exhaustion) rather than input-dependent errors (e.g., invalid parameters) as is the case in PCs. [28] examines the firmware of 10 routers and IoT devices and finds 109 errors in total.…”

Ember-IO: Effective Firmware Fuzzing with Model-Free Memory Mapped IO

“…(2) Recent studies [18,50] have identified the need for certain registers to repeatedly report specific values in order to execute firmware correctly and chosen to fix register values (use immutable inputs). But, fixing the values of registers effectively over restricts the search-space and can prevent testing of error handlers; importantly, error handlers were identified as a common source of bugs [23,28]. Expounding upon this insight we propose the peripheral input playback technique to: i) exploit the knowledge that many peripheral registers often repeatedly return the same value under typical execution conditions; and ii) benefit from mutated inputs to overcome restrictions on triggering of error handlers.…”

“…For example, bits within a serial port status register, such as the parity error, could be triggered by a malicious actor, resulting in the execution of the associated error handler. Notably, IFIZZ [28], previously identified error handlers as a common source of bugs, with more than 25% of patches for some programs commonly used on routers containing changes to error handlers. • Third, new models may need to be generated during fuzzing as the corresponding peripherals are discovered, complicating the fuzzing process.…”