• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.14 no.9
• /
• pp.3885-3906
• /
• 2020

Hybrid fuzzing which combines fuzzing and concolic execution, has proved its ability to achieve higher code coverage and therefore find more bugs. However, current hybrid fuzzers usually suffer from inefficiency and poor scalability when applied to complex, real-world program testing. We observed that the performance bottleneck is the inefficient cooperation between the fuzzer and concolic executor and the slow symbolic emulation. In this paper, we propose a novel solution named EPfuzzer to improve hybrid fuzzing. EPfuzzer implements two key ideas: 1) only the hardest-to-reach branch will be prioritized for concolic execution to avoid generating uninteresting inputs; and 2) only input bytes relevant to the target branch to be flipped will be symbolized to reduce the overhead of the symbolic emulation. With these optimizations, EPfuzzer can be efficiently targeted to the hardest-to-reach branch. We evaluated EPfuzzer with three sets of programs: five real-world applications and two popular benchmarks (LAVA-M and the Google Fuzzer Test Suite). The evaluation results showed that EPfuzzer was much more efficient and scalable than the state-of-the-art concolic execution engine (QSYM). EPfuzzer was able to find more bugs and achieve better code coverage. In addition, we discovered seven previously unknown security bugs in five real-world programs and reported them to the vendors.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.5
• /
• pp.775-785
• /
• 2023

As processor technology advances, it has accelerated ISA extensions and increased the complexity of micro-architectures, leading to a continued rise in the importance of processor validation techniques. Recently, various fuzzing techniques have been introduced to discover undocumented instructions, and this study highlights the shortcomings of existing undocumented instruction fuzzing techniques and presents our observation on error cases in the latest processors from Intel and AMD. In particular, we analyzes the causes of false positives resulting from the fuzzer incorrectly judging CPU instruction length and proposes the length determination technique based on instruction execution information to improve accuracy.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2023.01a
• /
• pp.405-406
• /
• 2023

일반적으로 네트워크 장비는 원활한 장비 관리를 위해 SNMP라는 프로토콜을 활용한다. SNMP를 활용함에 있어, 각 장비 제조사에서는 고유 기능을 정의하여 사용하기도 하는데 이를 Private MIB이라고 한다. 본 연구에서는 이러한 Private MIB을 대상으로 하는 퍼징(Fuzzing) 기술을 고안하였다. 본 논문에서는 특정 제조사의 Private MIB에 대해 페이로드를 만드는 전략과 실제 페이로드의 생성을 보인다. 이는 수많은 소프트웨어 혹은 장비들의 초기 안전성 평가를 수행하는 데 응용될 수 있을 것으로 기대한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2019.10a
• /
• pp.407-408
• /
• 2019

산업제어시스템에서 사용되는 소프트웨어의 보안취약점을 테스트하기 위한 방법으로 퍼징(Fuzzing)이 사용되고 있다. 퍼징 시스템은 크게 퍼징 대상을 테스트하는 퍼저(fuzzer)와 퍼징 대상을 모니터링하는 모니터링 모듈로 구성된다. 본 논문에서는 VxWorks 환경에서 효과적인 퍼징을 제공하기 위해 요구되는 퍼징 대상 모니터링 기능을 정의하고 모니터링 모듈을 설계한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2023.05a
• /
• pp.154-155
• /
• 2023

WebAssembly(Wasm)은 웹에서 네이티브에 가까운 속도로 실행 가능하고, 고성능 어플리케이션의 구현도 가능하기 때문에 브라우저 및 기타 플랫폼에서 활발히 사용되고 있다. 이로 인해 Wasm에 대한 보안성이 대두되고 있는데, 이때 취약점을 탐지하는 Fuzzing 기법을 적용한 연구들이 있다. Fuzzing 기법에 대한 분류 및 대표적인 도구를 소개하고 각 기법 간 차이점 및 한계점과 향후 연구 방향을 제시한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2023.05a
• /
• pp.111-112
• /
• 2023

IoT 산업의 규모가 커짐에 따라서 IoT 디바이스 간의 통신 프로토콜에 대한 위협도 증가하고 있으며, 이에 따라 IoT 프로토콜에 대한 보안의 중요성이 대두되고 있다. 하지만 IoT 프로토콜 중 비교적 최근에 등장한 프로토콜인 CoAP 프로토콜에 대한 연구는 아직 충분하지 않으며, CoAP에 대한 기존의 연구는 커버리지를 고려하지 않은 퍼저를 사용하였다. 따라서 이번 연구에서는 커버리지를 고려한 CoAP대상 퍼저를 개발하고 CoAP의 잠재적인 취약성을 점검한다. CoAP의 c 구현체인 libcoap 라이브러리를 대상으로 퍼징한 결과, 총 2개의 힙 버퍼 오버 플로우 취약점을 발견하였다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.13 no.7
• /
• pp.3511-3532
• /
• 2019

Coverage-guided fuzzing is an efficient solution that has been widely used in software testing. By guiding fuzzers through the coverage information, seeds that generate new paths will be retained to continually increase the coverage. However, we observed that most samples follow the same few high-frequency paths. The seeds that exercise a high-frequency path are saved for the subsequent mutation process until the user terminates the test process, which directly affects the efficiency with which the low-frequency paths are tested. In this paper, we propose a fuzzing solution, ER-Fuzz, that truncates the recording of a high-frequency path to influence coverage. It utilizes a deep learning-based classifier to locate the high and low-frequency path transfer points; then, it instruments at the transfer position to promote the probability low-frequency transfer paths while eliminating subsequent variations of the high-frequency path seeds. We implemented a prototype of ER-Fuzz based on the popular fuzzer AFL and evaluated it on several applications. The experimental results show that ER-Fuzz improves the coverage of the original AFL method to different degrees. In terms of the number of crash discoveries, in the best case, ER-Fuzz found 115% more unique crashes than did AFL. In total, seven new bugs were found and new CVEs were assigned.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.3
• /
• pp.443-454
• /
• 2020

The JavaScript engine is a module that receives JavaScript code as input and processes it, among many functions that are loaded into web browsers and display web pages. Many fuzzing test studies have been conducted as vulnerabilities in JavaScript engines could threaten the system security of end-users running JavaScript through browsers. Some of them have increased fuzzing efficiency by guiding test coverage in JavaScript engines, but no coverage guided fuzzing of optimized, dynamically generated machine code was attempted. Optimized JavaScript codes are difficult to perform sufficient iterative testing through fuzzing due to the function of runtime guards to free the code in the event of exceptional control flow. To solve these problems, this paper proposes a method of performing fuzzing tests on optimized machine code by avoiding deoptimization. In addition, we propose a method to measure the coverage of runtime-guards by the dynamic binary instrumentation and to guide increment of runtime-guard coverage. In our experiment, our method has outperformed the existing method at two measures: runtime coverage and iteration by time.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.4
• /
• pp.587-604
• /
• 2021

Because the library cannot be run independently and used by many applications, it is important to detect vulnerabilities in the library. Fuzzing, which is a dynamic analysis, is used to discover vulnerabilities for the library. Although this fuzzing technique shows excellent results in terms of code coverage and unique crash counts, it is difficult to apply its effects to library fuzzing. In particular, a fuzzing executable and a seed corpus are needed that execute the library code by calling a specific function sequence and passing the input of the fuzzer to reproduce the various states of the library. Generating the fuzzing environment such as fuzzing executable and a seed corpus is challenging because it requires both understanding about the library and fuzzing knowledge. We propose a novel method to improve the ease of library fuzzing and enhance code coverage and crash detection performance by using a test framework. The systems's performance in this paper was applied to nine open-source libraries and was verified through comparison with previous studies.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.2
• /
• pp.51-59
• /
• 2007

Software testing is the process of analyzing a software item to detect the differences between existing and required conditions and to evaluate the features of the software item. A traditional testing focuses on proper functionality, not security testing. Fuzzing is a one of many software testing techniques and security testing. Fuzzing methodology has advantage that low-cost, efficiency and so on. But fuzzing has defects such as intervening experts. Also, if there is no specification, fuzzing is impossible. ROAD Tool is automated testing tool for RPC(Remote Procedure Call) based protocol and software without specification. Existing tools are semi-automated. Therefore we must modify these tools. In this paper, we design and implement ROAD tool. Also we verify utility in testing results.