Fuzzing has become a very common place technique used for software testing and is heavily used to find security problems. There are many frameworks (sully, Peach Fuzzer etc.) that are geared up for fuzzing large, complex software systems. I have not found much information about fuzzing of smaller, simpler embedded systems (generally those that are small and simple enough to not run an OS).
These small systems are found everywhere - RFID card readers, burglar alarm systems, keyless entry systems, engine control units, HVAC controls, and so on. They frequently have very limited inputs and outputs (buttons, keypads, small character displays, LEDs, buzzers, RF communications). Complex networking (Ethernet, TCP/IP), serial ports etc. are rare.
I have had good success employing fuzzing like techniques to find security problems and see how the system behaves. Currently, this has largely comprised of fuzzing the formatting of packets sent into the system, based on observations of genuine packets. Some examples:
- Using fuzzing to determine the structure of packets - sometimes you know the approximate packet format, but things like ID bits, checksums etc. are not always certain if you only have a small number of genuine devices or sampled transmissions.
- Finding problems in packet decoding when packets are longer than expected - simple things like setting variable packet lengths to higher than expected values.
- Finding limits of acceptable transmissions - things like retransmission are common in one-way RF systems. What is the smallest number of packets that will register as a correct transmission? How much can we vary the baud rate (i.e. is there good clock recovery in the receiver).
- Finding the limits of jamming detection. How far can we push the system before jamming is detected? Finding undocumented features - for example, if 00 is arm, 01 is disarm, 10 is part-arm, what does 11 do?
One of the biggest challenges I have found is methods to detect the state of the system. This has generally ended up with a hodge-podge of outputs taken from LEDs, LCD buses and so on. I have been using Arduino and Arduino-like boards for the inputs and outputs (generally a Teensy 2.0). I also often need to include a method to power cycle the system in the event of a crash.
What I have been surprised by is that I cannot find many others performing work or research in this area. I'm largely making this up as I go along.
So, the questions are:
- Are there any resources out there along these lines?
- Can any of the complex fuzzing frameworks be used for this application?
(as an aside, I don't think this is a failure to google. Similar concepts include "glitching" and "fault injection", but I believe this to be distinct)
I have seen this training available: https://www.blackhat.com/us-13/training/peach-fuzzer-embedded-edition.html