Fuzzing is a practical approach to discovering flaws in the design and implementation of Wi-Fi protocols. However, existing Wi-Fi fuzzers are either vendor- or ecosystem-specific. Besides, they only cover a subset of 802.11 protocols and frame types. The growing complexity of Wi-Fi protocols, which have evolved to Wi-Fi6 and WPA3 already, calls for a free and comprehensive fuzzing tool for modern Wi-Fi devices. In this paper, we present such a fuzzing tool named Owfuzz. Unlike previous works using mostly firmware emulation fuzzing or driver fuzzing, Owfuzz takes the over-the-air fuzzing approach. It can perform fuzzing tests on arbitrary Wi-Fi devices from any vendor and can fuzz all three types of Wi-Fi frames (management, control, and data) defined in all versions of the 802.11 standards. It can be easily extended to support interactive testing of various protocol models. With Owfuzz, we have tested the products of mainstream Wi-Fi chip and device vendors, leading to the discovery of 23 flaws. We have reported most of these flaws to the related vendors with 8 CVE IDs assigned. Moreover, we have open-sourced Owfuzz to the community to facilitate future research.

Mobile applications today increasingly integrate Single Sign-On (SSO) into their account management mechanisms. Unfortunately, the involved multi-party protocol, i.e., OAuth 2.0, was originally designed to serve websites for authorization purpose. Due to the complexity of the adapted protocol, a large number of insecure SSO implementations still exist in the wild. Although the security testing for real-world SSO deployments has attracted considerable attention in recent years, existing work either focuses on websites or relies on the manual discovery of specific and previously-known vulnerabilities. In the paper, we design and implement MoSSOT (Mobile SSO Tester), an automated blackbox security testing tool for Android applications utilizing the SSO services from three mainstream service providers. The tool detects the vulnerabilities within the practical SSO implementations by fuzzing related network messages. We used MoSSOT to examine over 500 first-tier third-party Android applications from US and Chinese app markets. According to the test result, around 72% of the tested applications incorrectly implement SSO and are thus vulnerable. Besides, our test identifies an unknown vulnerability as well as a new variant, in addition to four known ones. The vulnerabilities enable the attacker to illegally log into the mobile applications as the victims or gain access to the protected resources. MoSSOT has been released as an open-source project.