SNFuzz: Gateway-Centric State-Oriented Fuzzing for MQTT-SN
summary
SNFuzz models gateway-managed MQTT-SN state and drives inputs by gateway responses, using a state manager that issues mutated UDP packets (injection, deletion, modification) and plans next messages based on replies. A prototype fuzzes three gateways (Hive, Paho, EMQX) for 3‑hour campaigns and outperforms two baseline network fuzzers on gateway-centric state modeling and response-driven execution, yielding 17/13/22 unique network responses respectively and uncovering a high‑severity DoS in EMQX that was reported.
AI-written summary · about
chapters (10)
- 0:00SNFuzz and MQTT-SN intro
- 1:12MQTT protocol basics
- 2:39MQTT-SN gateway state
- 4:07Fuzzing MQTT-SN gateways
- 5:33Threat model
- 6:18SNFuzz framework design
- 7:20SNFuzz design principles
- 8:21Preliminary results
- 9:23EMQX vulnerabilities
- 10:08Future work and conclusion
related talks
29mHow Protocol Gateways May Introduce More Problems than They Solve
39mFuzzing Session: Finding Bugs and Vulnerabilities Automatically
28mFuzz Testing of Envoy
40mBroken Brokers in Boxes: Fuzzing Breaks Everything, Even Erlang
05mLightning Talk: Securing Envoy: Catching Vulnerabilities With Continuous Fuzz Testing
36mFuzzing the CNCF Landscape
53mFuzz Testing for Fun and Profit
20mFUZZVPN: Finding Vulnerabilities in OpenVPN