DEMO: aIRQFuzz : Directed Wireless Fuzzing Through Emulation

What is it about?

We design and evaluate AIRQFUZZ, an emulation-based, directed fuzzing framework that automatically discovers vulnerabilities (e.g., denial of service and invalid ROM writes) deep within the wireless protocol implementation of bare-metal firmware. Our framework takes full control of the radio communication of microcontrollers (e.g., nRF52) used in a variety of Bluetooth Low Energy (BLE) and Zigbee applications, and is extensible to other wireless technologies. In particular, AIRQFUZZ offers a hybrid emulation environment that connects an arbitrary software protocol stack to the radio of the firmware, thus finding bugs during the emulated communication and without requiring detailed models of the radio peripheral. However, reaching execution of functions that enable stateful wireless communication is a challenging task. This is because manually implementing the behaviour of all unknown micro-controller unit (MCU) peripherals (e.g., Radio, timers, real-time clock, serial port) is tedious and error-prone. To address such challenges, AIRQFUZZ employs lightweight timing peripheral models and a novel directed strategy for Memory-mapped-I/O (MMIO) exploration. Intuitively, these strategies “guess” the read behaviour of unknown peripherals such that BLE and Zigbee packets can be systematically mutated by the fuzzer during emulation. To this day, AIRQFUZZ has found 21 new crashes (four CVEs already assigned), with a total of 22 crashes in the BLE implementation of Zephyr OS across multiple versions and 7 crashes in Zephyr/Nordic Zigbee implementation. Moreover, we show that AIRQFUZZ covers many protocol messages (e.g., 16) during emulation as compared to none from a state-of-the-art emulation fuzzing tool.

Featured Image

Photo by Marcela Miranda on Unsplash

Photo by Marcela Miranda on Unsplash

Why is it important?

Wireless protocols are key enabling technologies behind the development of internet-of-things (IoT) systems. However, in the last decade, several critical vulnerabilities have been discovered in the design and implementations of wireless protocols such as BLE , Wi-Fi, Zigbee, 5G NR etc. Due to the nature of the wireless environment, these vulnerabilities can often be exploited remotely, causing impacts such as crashing the system or bypassing authentication, among others. Hence, it is desirable that the firmware code containing implementations of wireless protocols is thoroughly validated before deployment.

Perspectives