WPAxFuzz: Sniffing Out Vulnerabilities in Wi-Fi Implementations

Abstract

This work attempts to provide a way of scrutinizing the security robustness of Wi-Fi implementations in an automated fashion. To this end, to our knowledge, we contribute the first full-featured and extensible Wi-Fi fuzzer. At the time of writing, the tool, made publicly available as open source, covers the IEEE 802.11 management and control frame types and provides a separate module for the pair of messages of the Simultaneous Authentication of Equals (SAE) authentication and key exchange method. It can be primarily used to detect vulnerabilities potentially existing in wireless Access Points (AP) under the newest Wi-Fi Protected Access 3 (WPA3) certification, but its functionalities can also be exploited against WPA2-compatible APs. Moreover, the fuzzer incorporates: (a) a dual-mode network monitoring module that monitors, in real time, the behavior of the connected AP stations and logs possible service or connection disruptions and (b) an attack tool used to verify any glitches found and automatically craft the corresponding exploit. We present results after testing the fuzzer against an assortment of off-the-shelf APs by different renowned vendors. Adhering to a coordinated disclosure process, we have reported the discovered issues to the affected vendors, already receiving positive feedback from some of them.

A Vulnerability Scanning Method for Web Services in Embedded Firmware

“…It utilizes messages exchanged between the hub and IoT devices to discover all functions automatically and then initiates a feature-oriented message-semantics-guided fuzz test. In the latest WiFi-security-related works [16][17][18][19], wireless access points (APs) are taken as a research entry point to review the security of actual device WiFi networks, especially the security of web interfaces related to access points (APs).…”

StructuredFuzzer: Fuzzing Structured Text-Based Control Logic Applications

“…Based on the degree of understanding of the target program, fuzzers can be classified as black-box [23], grey-box [24], and white-box [25], with each technique being sequential, having more information available that can be leveraged for the analysis of the test target. Otherwise, fuzzers can also be classified, based on the type of input they create, into mutation based [26], generation based [12,27], and hybrid [28]. The first category mutates existing inputs to create new inputs, while the second generates new inputs from scratch from a specification, often based on a specific grammar.…”

“…Network protocol fuzzing: Fuzzing often involves the security testing of communication protocols [10][11][12]. For instance, in PropFuzz [13], the authors present a protocol fuzzer designed for proprietary ICS protocols.…”

“…This paper introduces a novel framework for fuzzing PLC control logic applications to address this shortcoming. Unlike the existing body of work that focuses on industrial protocols [10][11][12][13][14][15], our approach is optimized for fuzzing ST-based control logic applications. The proposed framework offers a general-purpose solution to fuzzing internal logic flaws, indirectly enhancing the reliability and security of ICS devices against external cyber threats.…”