Analysis of DTLS Implementations ... State Fuzzing

on YouTube ↗49m

" summary

Extends TLS-Attacker with DTLS support and uses protocol state fuzzing to learn Mealy-machine models for 13 DTLS implementations, with models up to ~66 states and learning runs taking hours. Produces concrete workflow traces and finds 4 serious vulnerabilities, including a full client authentication bypass in JSSE, plus epoch/retransmission tricks that let unauthenticated or plaintext application data be accepted. Framework generates reproducible exploits against UDP DTLS servers and was responsibly disclosed.

AI-written summary · about

" chapters (10)

1. 0:00Introduction
2. 0:51What is fuzzing
3. 3:34What is TLS
4. 11:03Models
5. 22:13DTLS State
6. 25:03Results
7. 26:36Expert Knowledge
8. 27:20Model of Pie
9. 31:20Model of Jesse
10. 38:58Demo of Jesse

" related talks

• 01h 05mTheory and SecurityYu Jiang, Yiwen Xu, Zijing Yin, Yiwei Hou, Paolo Pazzaglia, Martina Maggio, Jianzhong Liu, Feilong Zuo, Zhengxiong Luo, Junze Yu, Ting Chen, Aiguo Cui, Zhenya Zhang, Paolo Arcaini, Xuan Xie, Zichen Xu · EMSOFT 2022
• 45mAutomatic Discovery of Evasion Vulnerabilities Using Targeted Protocol FuzzingAntti Levomäki, Olli-Pekka Niemi · Black Hat Europe 2017
• 36mWhy TLS is better without STARTTLS ...Fabian Ising, Damian Poddebniak · RuhrSec Day 2022
• 53mThe BEAST Wins Again: Why TLS Keeps Failing to Protect HTTPAntoine Delignat-Lavaud · Black Hat USA 2014
• 20mFUZZVPN: Finding Vulnerabilities in OpenVPNCristina Nita-Rotaru, Anqi Chen · 19th USENIX WOOT Conference on Offensive Technologies (WOOT '25)
• 29mFuzzing and Breaking Security Functions of SIMATIC PLCsGao Jian · Black Hat Europe 2022
• 16mLost in Translation: Enabling Confused Deputy Attacks on EDA Software...Kaveh Razavi, Flavien Solt · USENIX Security '25
• 13mX.509DoS: Exploiting and Detecting Denial-of-Service Vulnerabilities inLuyi Xing, Xiaolong Bai, Bing Shi, Wenchao Li, Yuchen Wang · USENIX Security '25