To date, grey-box fuzzing has become an essential technique to detect vulnerabilities implied in Linux-based firmware. However, existing fuzzing approaches commonly encounter three overlooked obstacles stemming from firmware service characteristics, which largely hinder the effectiveness and efficiency of vulnerability identification. Firstly, the multi-process nature of firmware services is oversimplified during both the emulation and the fuzzing procedures, limiting the scope of firmware testing. Furthermore, firmware services usually incorporate customized service protocols, which feature rich and stringent semantic constraints, causing unique challenges for input generation. To address these obstacles, this paper proposes a service-aware grey-box fuzzing tool HouseFuzz. During the firmware emulation, HouseFuzz carefully traverses the system initialization procedure for identifying those network-facing and daemon processes overlooked by existing approaches. After that, during the fuzzing procedure, HouseFuzz features a multi-process fuzzing framework, enabling the comprehensive inspection of firmware services activated via multiple processes. Furthermore, HouseFuzz leverages both offline and online firmware service analysis to capture the token-level semantic constraints of customized service protocols, based on which HouseFuzz can effectively generate high-quality test cases. In evaluation, compared to SoTA grey-box firmware fuzzing approaches, HouseFuzz identified 76% more network services, achieved 24.8% more code coverage, and detected 175% more 0-day vulnerabilities on the same firmware dataset.

The heart, responsible for circulating blood throughout our body, contains four chambers. Existing analysis methods primarily focus on one single ventricle. Transthoracic echocardiography provides real-time estimations of cardiac function and enables comprehensive observations of the entire heart, especially through the apical 4-chamber view. However, no current clinical indices evaluate cardiac function considering all four chambers simultaneously. Manual estimation of the four chambers is laborious, inefficient, and complicated by anatomical complexity and variable image quality, including motion artifacts and unclear borders. There is a significant need for a high-performance segmentation tool that can assess all four chambers concurrently. To address this, we collected a clinically representative dataset of 2D apical 4-chamber view echocardiograms, with annotated 4-chamber regions serving as the basis for automatic 4-chamber synergy analysis. We then proposed a boundary-enhanced network, denoted as $BeU^{2}$-Net, tailored for transthoracic echocardiography 4-chamber segmentation using our private dataset. Specifically, our network employs a two-level nested encoder-decoder architecture, utilizing a segmentation-specific residual U-block with a mixture of receptive fields at each stage to capture multi-level and multi-scale features. A dedicated boundary prediction branch, incorporating edge details, is integrated to enhance boundary segmentation performance. Experiments on both private and public datasets demonstrate that our $BeU^{2}$-Net possesses superior boundary detection capabilities and achieves high segmentation performance for echocardiographic images.

IoT firmware faces severe threats to security vulnerabilities. As an important method to detect vulnerabilities, recurring vulnerability detection has not been systematically studied in IoT firmware. In fact, existing methods would meet significant challenges from two aspects. First, firmware vulnerabilities are usually reported in texts without too much code-level information, e.g., security patches. Second, firmware images are released as binaries, making the analysis of known vulnerabilities and the detection of unknown vulnerabilities quite difficult.

The Android system services usually play a critical role in running multiple important tasks, and delivering seamless user experiences, e.g., conveniently storing user data. In this paper, we conduct the first systematic security study on the data storing process in Android system services, and consequently discover a novel class of design flaws (named Straw), which can lead to serious DoS (Denial-of-Service) attacks, e.g., permanently crashing the whole victim Android device.Then we propose a novel directed fuzzing based approach, called StrawFuzzer, to automatically vet all system services against the straw vulnerabilities. StrawFuzzer balances the tradeoff between path exploration and vulnerability exploitation. By applying StrawFuzzer on three Android systems with the latest security updates, we identified 35 unique straw vulnerabilities affecting 474 interfaces across 77 system services and successfully generated corresponding exploits, which can be used to conduct various permanent/temporary DoS attacks. We have reported our findings with suggestions for repairing the vulnerabilities to corresponding vendors. Up to now, Google has rated our vulnerability as high severity.