Fuzzing IoT Devices via Android App Interfaces with Large Language Model

Most of the current automated testing methods for IoT devices rely on firmware analysis and firmware emulation. However, due to the diverse architectures and structures of firmware across different vendors, these methods have limited applicability and cannot perform large-scale testing. To address this issue, we have designed a tool called FIAL, a novel IoT device fuzzing method based on accompanying app interfaces. FIAL allows for the discovery of firmware vulnerabilities without the need for firmware analysis. It leverages a large language model to analyze the accompanying app and extract the most effective function interfaces for fuzzing. We applied FIAL to analyze five popular devices and discovered a total of 14 bugs, including 5 new vulnerabilities. We conducted a comparison with two other network fuzzing tools, and the experiment showed that FIAL can uncover more exploitable vulnerabilities using fewer test cases.