English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Zendy Plus

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Zendy Tools

Zendy Open

The proliferation of Internet of Things (IoT) devices has made people's livesmore convenient, but it has also raised many security concerns. Due to thedifficulty of obtaining and emulating IoT firmware, the black-box fuzzing ofIoT devices has become a viable option. However, existing black-box fuzzerscannot form effective mutation optimization mechanisms to guide their testingprocesses, mainly due to the lack of feedback. It is difficult or evenimpossible to apply existing grammar-based fuzzing strategies. Therefore, anefficient fuzzing approach with syntax inference is required in the IoT fuzzingdomain. To address these critical problems, we propose a novel automaticblack-box fuzzing for IoT firmware, termed Snipuzz. Snipuzz runs as a clientcommunicating with the devices and infers message snippets for mutation basedon the responses. Each snippet refers to a block of consecutive bytes thatreflect the approximate code coverage in fuzzing. This mutation strategy basedon message snippets considerably narrows down the search space to change theprobing messages. We compared Snipuzz with four state-of-the-art IoT fuzzingapproaches, i.e., IoTFuzzer, BooFuzz, Doona, and Nemesys. Snipuzz not onlyinherits the advantages of app-based fuzzing (e.g., IoTFuzzer, but alsoutilizes communication responses to perform efficient mutation. Furthermore,Snipuzz is lightweight as its execution does not rely on any prerequisiteoperations, such as reverse engineering of apps. We also evaluated Snipuzz on20 popular real-world IoT devices. Our results show that Snipuzz could identify5 zero-day vulnerabilities, and 3 of them could be exposed only by Snipuzz. Allthe newly discovered vulnerabilities have been confirmed by their vendors.

Snipuzz: Black-box Fuzzing of IoT Firmware via Message Snippet Inference