Finding sands in the eyes: vulnerabilities discovery in IoT with EUFuzzer on human machine interface
Article
Men, J., Xu, G., Han, Z., Sun, Z., Zhou, X., Lian, W. and Cheng, X. 2019. Finding sands in the eyes: vulnerabilities discovery in IoT with EUFuzzer on human machine interface. IEEE Access. 7, pp. 103751-103759. https://doi.org/10.1109/ACCESS.2019.2931061
Type | Article |
---|---|
Title | Finding sands in the eyes: vulnerabilities discovery in IoT with EUFuzzer on human machine interface |
Authors | Men, J., Xu, G., Han, Z., Sun, Z., Zhou, X., Lian, W. and Cheng, X. |
Abstract | In supervisory control and data acquisition (SCADA) systems or the Internet of Things (IoT), human machine interface (HMI) performs the function of data acquisition and control, providing the operators with a view of the whole plant and access to monitoring and interacting with the system. The compromise of HMI will result in lost of view (LoV), which means the state of the whole system is invisible to operators. The worst case is that adversaries can manipulate control commands through HMI to damage the physical plant. HMI often relies on poorly understood proprietary protocols, which are time-sensitive, and usually keeps a persistent connection for hours even days. All these factors together make the vulnerability mining of HMI a tough job. In this paper, we present EUFuzzer, a novel fuzzing tool to assist testers in HMI vulnerability discovery. EUFuzzer first identifies packet fields of the specific protocol and classifies all fields into four types, then using a relatively high efficiency fuzzing method to test HMI. The experimental results show that EUFuzzer is capable of identifying packet fields and revealing bugs. EUFuzzer also successfully triggers flaws of actual proprietary SCADA protocol implementation on HMI, which the SCADA software vendor has confirmed that four were zero-day vulnerabilities and has taken measures to patch up. |
Publisher | Institute of Electrical and Electronics Engineers (IEEE) |
Journal | IEEE Access |
ISSN | 2169-3536 |
Publication dates | |
25 Jul 2019 | |
Publication process dates | |
Deposited | 15 Jul 2019 |
Accepted | 12 Jul 2019 |
Submitted | 01 May 2019 |
Output status | Published |
Accepted author manuscript | License |
Digital Object Identifier (DOI) | https://doi.org/10.1109/ACCESS.2019.2931061 |
Language | English |
https://repository.mdx.ac.uk/item/885vq
Download files
57
total views12
total downloads0
views this month0
downloads this month