IoTtracer: greybox fuzzing for Linux-based IoT devices with low-cost coverage tracing

Abstract Fuzzing, especially coverage-guided greybox (CG) fuzzing, has been demonstrated to be effective in discovering software security vulnerabilities. Code coverage achieved through instrumentation plays a vital role in this. However, closed-source software within IoT devices cannot easily perform binary instrumentation to trace coverage like traditional computers efficiently. To address this problem, we propose IoTtracer, an IoT CG fuzzing framework using low-cost coverage tracing. Unlike the state-of-the-art IoT CG fuzzers (e.g. AFLIoT and GDBFuzz), IoTtracer does not rely on complex binary-level rewrite or limited hardware breakpoints for instrumentation, but directly instruments the binary in a Linux-based IoT device through the software interrupts. To avoid frequently trapping into interrupts during fuzzing and reduce the overhead of collecting coverage, we also design a discrete instrumentation strategy and distributed adaptive coverage tracing for IoTtracer. We evaluated IoTtracer on multiple benchmarks containing real-world IoT devices. IoTtracer enables efficient and accurate tracing of full coverage in IoT devices by inserting probes into only an average of 37.8% of the binary’s basic blocks. In addition, IoTtracer’s throughput is 1.28–2.77× higher than AFLIoT. These results show that IoTtracer can more efficiently obtain the target’s coverage in IoT devices and effectively guide fuzzing to detect their potential vulnerabilities.