DeepDiver: Diving into Abysmal Depth of the Binary for Hunting Deeply Hidden Software Vulnerabilities
Fuzz testing is a simple automated software testing approach that discovers software vulnerabilities at a high level of performance by using randomly generated seeds. However, it is restrained by coverage and thus, there are chances of finding bugs entrenched in the deep execution paths of the progr...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2020-04-01
|
| Series: | Future Internet |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1999-5903/12/4/74 |
| _version_ | 1797570284814860288 |
|---|---|
| author | Fayozbek Rustamov Juhwan Kim JooBeom Yun |
| author_facet | Fayozbek Rustamov Juhwan Kim JooBeom Yun |
| author_sort | Fayozbek Rustamov |
| collection | DOAJ |
| description | Fuzz testing is a simple automated software testing approach that discovers software vulnerabilities at a high level of performance by using randomly generated seeds. However, it is restrained by coverage and thus, there are chances of finding bugs entrenched in the deep execution paths of the program. To eliminate these limitations in mutational fuzzers, patching-based fuzzers and hybrid fuzzers have been proposed as groundbreaking advancements which combine two software testing approaches. Despite those methods having demonstrated high performance across different benchmarks such as DARPA CGC programs, they still present deficiencies in their ability to analyze deeper code branches and in bypassing the <i>roadblocks checks</i> (magic bytes, checksums) in real-world programs. In this research, we design DeepDiver, a novel transformational hybrid fuzzing tool that explores deeply hidden software vulnerabilities. Our approach tackles limitations exhibited by existing hybrid fuzzing frameworks, by negating roadblock checks (RC) in the program. By negating the RCs, the hybrid fuzzer can explore new execution paths to trigger bugs that are hidden in the abysmal depths of the binary. We combine AFL++ and concolic execution engine and leveraged the <i>trace analyzer approach</i> to construct the tree for each input to detect RCs. To demonstrate the efficiency of DeepDiver, we tested it with the LAVA-M dataset and eight large real-world programs. Overall, DeepDiver outperformed existing software testing tools, including the patching-based fuzzer and state-of-the-art hybrid fuzzing techniques. On average, DeepDiver discovered vulnerabilities 32.2% and 41.6% faster than QSYM and AFLFast respectively, and it accomplished in-depth code coverage. |
| first_indexed | 2024-03-10T20:22:45Z |
| format | Article |
| id | doaj.art-ed854016c679496dacfb9550c003919d |
| institution | Directory Open Access Journal |
| issn | 1999-5903 |
| language | English |
| last_indexed | 2024-03-10T20:22:45Z |
| publishDate | 2020-04-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Future Internet |
| spelling | doaj.art-ed854016c679496dacfb9550c003919d2023-11-19T22:04:18ZengMDPI AGFuture Internet1999-59032020-04-011247410.3390/fi12040074DeepDiver: Diving into Abysmal Depth of the Binary for Hunting Deeply Hidden Software VulnerabilitiesFayozbek Rustamov0Juhwan Kim1JooBeom Yun2Department of Computer and Information Security, Sejong University, 209 Neungdong-ro, Gwangjin-gu, Seoul 05006, KoreaDepartment of Computer and Information Security, Sejong University, 209 Neungdong-ro, Gwangjin-gu, Seoul 05006, KoreaDepartment of Computer and Information Security, Sejong University, 209 Neungdong-ro, Gwangjin-gu, Seoul 05006, KoreaFuzz testing is a simple automated software testing approach that discovers software vulnerabilities at a high level of performance by using randomly generated seeds. However, it is restrained by coverage and thus, there are chances of finding bugs entrenched in the deep execution paths of the program. To eliminate these limitations in mutational fuzzers, patching-based fuzzers and hybrid fuzzers have been proposed as groundbreaking advancements which combine two software testing approaches. Despite those methods having demonstrated high performance across different benchmarks such as DARPA CGC programs, they still present deficiencies in their ability to analyze deeper code branches and in bypassing the <i>roadblocks checks</i> (magic bytes, checksums) in real-world programs. In this research, we design DeepDiver, a novel transformational hybrid fuzzing tool that explores deeply hidden software vulnerabilities. Our approach tackles limitations exhibited by existing hybrid fuzzing frameworks, by negating roadblock checks (RC) in the program. By negating the RCs, the hybrid fuzzer can explore new execution paths to trigger bugs that are hidden in the abysmal depths of the binary. We combine AFL++ and concolic execution engine and leveraged the <i>trace analyzer approach</i> to construct the tree for each input to detect RCs. To demonstrate the efficiency of DeepDiver, we tested it with the LAVA-M dataset and eight large real-world programs. Overall, DeepDiver outperformed existing software testing tools, including the patching-based fuzzer and state-of-the-art hybrid fuzzing techniques. On average, DeepDiver discovered vulnerabilities 32.2% and 41.6% faster than QSYM and AFLFast respectively, and it accomplished in-depth code coverage.https://www.mdpi.com/1999-5903/12/4/74software vulnerabilityhybrid fuzzingconcolic executionpatching-based fuzzing |
| spellingShingle | Fayozbek Rustamov Juhwan Kim JooBeom Yun DeepDiver: Diving into Abysmal Depth of the Binary for Hunting Deeply Hidden Software Vulnerabilities Future Internet software vulnerability hybrid fuzzing concolic execution patching-based fuzzing |
| title | DeepDiver: Diving into Abysmal Depth of the Binary for Hunting Deeply Hidden Software Vulnerabilities |
| title_full | DeepDiver: Diving into Abysmal Depth of the Binary for Hunting Deeply Hidden Software Vulnerabilities |
| title_fullStr | DeepDiver: Diving into Abysmal Depth of the Binary for Hunting Deeply Hidden Software Vulnerabilities |
| title_full_unstemmed | DeepDiver: Diving into Abysmal Depth of the Binary for Hunting Deeply Hidden Software Vulnerabilities |
| title_short | DeepDiver: Diving into Abysmal Depth of the Binary for Hunting Deeply Hidden Software Vulnerabilities |
| title_sort | deepdiver diving into abysmal depth of the binary for hunting deeply hidden software vulnerabilities |
| topic | software vulnerability hybrid fuzzing concolic execution patching-based fuzzing |
| url | https://www.mdpi.com/1999-5903/12/4/74 |
| work_keys_str_mv | AT fayozbekrustamov deepdiverdivingintoabysmaldepthofthebinaryforhuntingdeeplyhiddensoftwarevulnerabilities AT juhwankim deepdiverdivingintoabysmaldepthofthebinaryforhuntingdeeplyhiddensoftwarevulnerabilities AT joobeomyun deepdiverdivingintoabysmaldepthofthebinaryforhuntingdeeplyhiddensoftwarevulnerabilities |