The Internet of Things (IoT) devices have brought invaluable convenience to our daily lives. However, they also introduce significant security challenges. Common vulnerabilities in numerous IoT devices predominantly reside in their web services. Unfortunately, existing vulnerability detection methods either incur heavy execution overhead or produce excessive false positives/negatives. This significantly hinders the efficient analysis of vulnerabilities in web services. This paper proposes CID4IoT, a novel static automated vulnerability detection approach designed to effectively detect command injection vulnerabilities in web services provided by IoT devices. Inspired by the concept of taint analysis, CID4IoT first analyzes vulnerability reports to identify taint source functions and sink functions. Then, CID4IoT extracts pseudocode between taint source functions and sink functions to form critical code snippets. Subsequently, it utilizes LLM to analyze these critical code snippets for vulnerability detection.We implemented a prototype of CID4IoT and evaluated it on real firmware devices. CID4IoT discovered 54 previously unknown vulnerabilities, of which 39 are confirmed by CVE. Compared with state-of-the-art tools KARONTE and SaTC, it identified significantly more vulnerabilities in the test set while achieving notable improvements in analysis efficiency. The results demonstrate that CID4IoT is effective in detecting flaws in IoT devices

IoT firmware faces severe threats to security vulnerabilities. As an important method to detect vulnerabilities, recurring vulnerability detection has not been systematically studied in IoT firmware. In fact, existing methods would meet significant challenges from two aspects. First, firmware vulnerabilities are usually reported in texts without too much code-level information, e.g., security patches. Second, firmware images are released as binaries, making the analysis of known vulnerabilities and the detection of unknown vulnerabilities quite difficult.

Real-Time Operating System (RTOS) has become the main category of embedded systems. It is widely used to support tasks requiring real-time response such as printers and switches. The security of RTOS has been long overlooked as it was running in special environments isolated from attackers. However, with the rapid development of IoT devices, tremendous RTOS devices are connected to the public network. Due to the lack of security mechanisms, these devices are extremely vulnerable to a wide spectrum of attacks. Even worse, the monolithic design of RTOS combines various tasks and services into a single binary, which hinders the current program testing and analysis techniques working on RTOS. In this paper, we propose SFuzz, a novel slice-based fuzzer, to detect security vulnerabilities in RTOS. Our insight is that RTOS usually divides a complicated binary into many separated but single-minded tasks. Each task accomplishes a particular event in a deterministic way and its control flow is usually straightforward and independent. Therefore, we identify such code from the monolithic RTOS binary and synthesize a slice for effective testing. Specifically, SFuzz first identifies functions that handle user input, constructs call graphs that start from callers of these functions, and leverages forward slicing to build the execution tree based on the call graphs and pruning the paths independent of external inputs. Then, it detects and handles roadblocks within the coarse-grain scope that hinder effective fuzzing, such as instructions unrelated to the user input. And then, it conducts coverage-guided fuzzing on these code snippets. Finally, SFuzz leverages forward and backward slicing to track and verify each path constraint and determine whether a bug discovered in the fuzzer is a real vulnerability. SFuzz successfully discovered 77 zero-day bugs on 35 RTOS samples, and 67 of them have been assigned CVE or CNVD IDs. Our empirical evaluation shows that SFuzz outperforms the state-of-the-art tools (e.g., UnicornAFL) on testing RTOS.