Security Analysis of Zigbee Protocol Implementation via Device-agnostic Fuzzing
-
Published:2023-03-07
Issue:1
Volume:4
Page:1-24
-
ISSN:2692-1626
-
Container-title:Digital Threats: Research and Practice
-
language:en
-
Short-container-title:Digital Threats
Author:
Ren Mengfei1ORCID,
Ren Xiaolei1ORCID,
Feng Huadong1ORCID,
Ming Jiang1ORCID,
Lei Yu1ORCID
Affiliation:
1. The University of Texas at Arlington, Arlington, Texas, USA
Abstract
Zigbee is widely adopted as a resource-efficient wireless protocol in the IoT network. IoT devices from manufacturers have recently been affected due to major vulnerabilities in Zigbee protocol implementations. Security testing of Zigbee protocol implementations is becoming increasingly important. However, applying existing vulnerability detection techniques such as fuzzing to the Zigbee protocol is not a simple task. Dealing with low-level hardware events still remains a big challenge. For the Zigbee protocol, which communicates over a radio channel, many existing protocol fuzzing tools lack a sufficient execution environment.
To narrow the gap, we designed
Z-Fuzzer
, a device-agnostic fuzzing tool for detecting security flaws in Zigbee protocol implementations. To simulate Zigbee protocol execution,
Z-Fuzzer
leverages a commercial embedded device simulator with pre-defined peripherals and hardware interrupt setups to interact with the fuzzing engine. Z-Fuzzer generates more high-quality test cases with code-coverage heuristics. We compare Z-Fuzzer with advanced protocol fuzzing tools, BooFuzz and Peach fuzzer, on top of Z-Fuzzer’s simulation platform. Our findings suggest that Z-Fuzzer can achieve greater code coverage in Z-Stack, a widely used Zigbee protocol implementation. Compared to BooFuzz and Peach, Z-Fuzzer found more vulnerabilities with fewer test cases. Three of them have been assigned CVE IDs with high CVSS scores (7.5~8.2).
Funder
Information Technology Lab of National Institute of Standards and Technology
National Science Foundation
Publisher
Association for Computing Machinery (ACM)
Subject
Computer Networks and Communications,Computer Science Applications,Hardware and Architecture,Safety Research,Information Systems,Software
Reference60 articles.
1. The advantages of block-based protocol analysis for security testing;Aitel Dave;Immunity Inc.,,2002
2. An Introduction to SPIKE, the Fuzzer Creation Kit;Aitel Dave;BlackHat USA,2002
3. Zigator
4. Zigbee Alliance. 2015. Zigbee. https://zigbeealliance.org/.
5. Zigbee Alliance. August 5 2015. Zigbee Specification. https://zigbeealliance.org/wp-content/uploads/2019/11/docs-05-3474-21-0csg-zigbee-specification.pdf.