Directed Fuzzing Based on Dynamic Taint Analysis for Binary Software

Abstract:

Traditional Fuzzing is simple and easy to deploy but inefficient due to different inputs usually execute the redundant path. In this paper, we put forward a binary-oriented Fuzzing technique based on input format analysis and dynamic taint analysis, which can detect vulnerability more efficient than traditional Fuzzing method. We implemented a prototype system called Smart and Directed Fuzz (SDFuzz), which first searches the locations where interested functions are called, then uses dynamic taint analysis technique to classify input data into safety-related data and safety-unrelated data, finally mutates safety-related data to direct the test procedure. The evaluation shows that our method can be used to detect vulnerabilities in binary software efficiently.

• Periodical: Applied Mechanics and Materials (Volumes 571-572)
• Pages: 539-545
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.571-572.539
• Online since: June 2014
• Authors: Bo Wu*, Bin Zhang, Sha Meng Wen, Meng Jun Li, Quan Zhang, Chao Jing Tang
• Keywords: Dynamic Taint Analysis, Fuzzing, Input Format Analysis, Security Vulnerability

References

[1] Ozment A. Vulnerability discovery & software security[J]. University of Cambridge Computer Laboratory Computer Security Group &Magdalene College, (2007).

[2] Liu B, Shi L, Cai Z, et al. Software vulnerability discovery techniques: A survey[C]/Multimedia Information Networking and Security (MINES), 2012 Fourth International Conference on. IEEE, 2012: 152-156.

DOI: 10.1109/mines.2012.202

[3] Sutton M, Greene A, Amini P. Fuzzing: brute force vulnerability discovery[M]. Pearson Education, (2007).

[4] Godefroid P, Levin M Y, Molnar D. Sage: Whitebox fuzzing for security testing[J]. Queue, 2012, 10(1): 20.

DOI: 10.1145/2090147.2094081

[5] Bekrar S, Bekrar C, Groz R, et al. Finding software vulnerabilities by smart fuzzing[C]/Software Testing, Verification and Validation (ICST), 2011 IEEE Fourth International Conference on. IEEE, 2011: 427-430.

DOI: 10.1109/icst.2011.48

[6] Kaner C, Bond W P. Software engineering metrics: What do they measure and how do we know [J]. Methodology, 2004, 8: 6.

[7] Schwartz E J, Avgerinos T, Brumley D. All you ever wanted to know about dynamic taint analysis and forward symbolic execution [C]. Security and Privacy (SP), 2010 IEEE Symposium on. IEEE, 2010: 317-331.

DOI: 10.1109/sp.2010.26

[8] Lin Z, Jiang X, Xu D, et al. Automatic Protocol Format Reverse Engineering through Context-Aware Monitored Execution[C]. NDSS. 2008, 8: 1-15.

[9] Lin Z, Zhang X, Xu D. Reverse engineering input syntactic structure from program execution and its applications [J]. Software Engineering, IEEE Transactions on, 2010, 36(5): 688-703.

DOI: 10.1109/tse.2009.54

[10] Caballero J, Yin H, Liang Z, et al. Polyglot: Automatic extraction of protocol message format using dynamic binary analysis[C]. Proceedings of the 14th ACM conference on Computer and communications security. ACM, 2007: 317-329.

DOI: 10.1145/1315245.1315286

[11] Song D, Brumley D, Yin H, et al. BitBlaze: Binary Analysis for Computer Security[J]. (2013).

[12] Antiparser: http: /antiparser. sourceforge. net.

[13] Amini P. PaiMei-Reverse Engineering Framework[C]/Reverse Engineering Conference, (RECON). (2006).