Abstract
Internet-of-Things (IoT) devices have become widely popular and are being increasingly utilized in both home and industrial environments. Such devices use a variety of protocols for communication. Considering the complex and stateful nature of these protocols, their implementations may contain security vulnerabilities. To address this, we present U-FUZZ, a framework to automatically generate state machine and systematically discover security vulnerabilities on arbitrary wired and wireless IoT protocol implementations. U-FUZZ only takes a network capture file, which contains the packet traces of normal (i.e., benign) communication for the state machine construction and it does not require any access to the source code of the protocol. U-FUZZ does not demand any instrumentation. This makes U-FUZZ to applicable out-of-the-box for constructing state machine for fuzzing arbitrary IoT devices employing a variety of protocols. Evaluation of U- FUZZ with three popular IoT protocols (5G NR, Zigbee, and CoAP) reveals 11 new vulnerabilities (11 CVEs) and a total of 16 security flaws.