# EWVHunter: Grey-Box Fuzzing with Knowledge Guide on Embedded Web Front-Ends
## 1 Introduction  
Embedded devices are widely used in our lives, such as smart home routers and IP cameras. In the past few years, the connection between embedded devices has become closer, forming the Internet of Things (IoT). According to a recent report [1], the number of IoT devices has reached 14.2 billion in 2019 and is expected to reach 25 billion by 2021. However, some current research shows that the loose protection of these devices and the security vulnerabilities are widespread and easy to exploit [2; 3; 4]. These security risks can allow attackers to build large-scale botnets easily [5] and provide the basis for DDoS attacks. According to Akamai's statistics [6], all 300 Gbps attacks that occurred in 2016 were entirely or partially based on online IoT devices (e.g., IP cameras and home routers). In the fourth quarter of 2016, more than half of the attack traffic came from the Mirai botnet. Therefore, the security of embedded devices is not only related to user safety but also public safety. Thus it is crucial to discover security vulnerabilities in embedded devices in the real world. The firmware-based analysis is a straightforward approach for finding security vulnerabilities with embedded devices. There may have misconfigurations or security vulnerabilities in firmware [7],like traditional software. Security analysis on firmware generally contains static analysis on the source code and dynamic analysis on the binary program [8]. Static analysis usually first obtains the firmware image from public channels, and then uses unpacking tools (such as Binwalk, FRAK, and BAT (Binary Analysis Toolkit) [9; 10; 11]) to unpack the firmware. After that, we can use static analysis tools to analyze it. Firmware emulation is the base of the dynamic analysis method. If we can emulate it successfully, dynamic analysis tools are used to discover security vulnerabilities. Nevertheless, there are two challenges to a completely firmware-based approach to security analysis. The first is that static analysis is challenging because it targets a specific problem domain (Lua, PHP, binary CGLs, and so forth). However, the embedded device typically contains an amalgamation of various programs and binaries and there is no static analysis tool for that case. The second is that dynamic analysis techniques rely on the emulation of certain architectures [12], while embedded firmware requires specific hardware support. In response to this situation, some studies like Avatar [13] attempt to forward hardware I/O to real hardware so as to improve the firmware's emulation, but this method is less scalable. In this paper, we used fuzzing techniques to discover security vulnerabilities in embedded device firmware. As it can target on a real device, it does not care whether the emulation of the target device firmware can be completed. Due to the limited hardware resources of an embedded device, it does not have a user interface (e.g., keyboard, screen) like a desktop computer. However, it provides some interfaces for configuration and maintenance. Some early devices mainly rely on custom protocols or traditional interfaces (such as telnet). Nevertheless, with the widespread existence of embedded devices in people's lives, to facilitate operation, a management terminal with a web front-end has become a universal interface. The web front-end packs user inputs into a message according to protocol specifications and sends the message to the device for processing. Therefore, the web front-end contains a lot of information, such as control messages, URLs (Uniform Resource Locator), implementation of stateful network protocol, and the communication message encryption function. The communication protocol between the web front-end and the device can be a standard protocol or a vendor's self-design protocol. When a device accepts a message that conforms to the protocol specification, it processes the message. However, if there are implementation flaws in this process, the device will be vulnerable.