# SloTFuzzer: Fuzzing Web Interface in IoT Firmware via Stateful Message Generation
## 1 Introduction  
With the rapid development of the Internet of Things (IoT), the number of global IoT connections continues to grow exponentially and will reach 27 billion by 2025 [1]. Since the rise of the smart home, more and more smart devices are widely used, such as routers, and IP cameras. A large number of vulnerabilities in IoT devices have been disclosed in recent years. For example, at the 2013 Black Hat Conference, [PERSON] [2] demonstrated the overflow, hard-coded password, and command injection vulnerabilities of a variety of web cameras, involving D-Link, TP-Link, Linksys, and Trendnet equipment vendors. Attackers can use these vulnerabilities to log in without authorization and hijack the real-time video of the camera. In addition, real security incidents caused by security vulnerabilities are frequently emerging. In 2019, most areas in Venezuela, including the capital Caracas, experienced a continuous power outage over more than 24 h [3]. The power outage made the Caracas subway inoperable and caused large-scale traffic congestion, and the Internet could not be used normally. Due to the long service-life of IoT devices, there are a large number of devices in the network that have not been maintained by vendors. In the sameyear, a D-link product found an unauthenticated remote code execution vulnerability [4], which affected more than 10 products of related models. Although the product has been discontinued, D-link vendors did not release related patches, and the vulnerability has not been fixed. In cyber attacks, the user interface of devices is one of the main attack surfaces. This means that once user interfaces are exposed, these routers and IP cameras are likely to become a zombie host and be used in attacks such as DDoS. As a result, IoT security is increasingly becoming a topic of concern to researchers. It is an important research field to detect the vulnerabilities of IoT devices quickly. Due to huge differences in the hardware and software of IoT devices from different vendors, it is difficult to build IoT vulnerability analysis models and establish a unified dynamic simulation environment. However, centralized testing for certain devices is inefficient. Testers prefer to use automated approaches to test all kinds of devices. The automated approaches to detect IoT vulnerability are generally divided into static methods [5; 6] and dynamic methods [7; 8; 9]. Firmware images are usually published in the vendor's online service and testers can obtain images easily. For static methods, testers unpack images by Binwalk [10]. The unpacked files can be used for analysis with a reverse tool, such as IDA. Dynamic methods mainly stand by firmware simulation. This method requires that images contain an operating system, including a general operating system (e.g., Linux) or a specific embedded operating system (e.g., VxWorks). Qemu [11], a processor emulator based on Linux, is able to provide fast system-mode emulation. Therefore, IoT devices that are Linux-based could be emulated by Qemu and tested more easily. Vendors usually use web and application to provide users with operating interfaces. These interfaces can directly operate a device, and their design standards evolve according to the actual operation of the device. When the web and application obtain a user's input, they will send operation messages to the device. After receiving these requests, the device performs further procedures according to the request parameter and executes the targeted program. The status of the device will change with this process. If an implementation flaw exists in the parameter parsing and processing program, a vulnerability will be exploited. Therefore, an IoT device with user interfaces can be treated as a blackbox. Through feeding these interfaces with mutated messages, a fuzzer may trigger potential vulnerabilities. The testers do not need knowledge of the underlying architecture. The fuzzing could send a large number of messages per unit of time.