Reza Zamiri
Reza is a security researcher with a focus on the security of cyber-physical systems. He previously worked as a research assistant at the CISPA Helmholtz Center for Information Security and has spent the past several years working as a senior product security engineer in the automotive and industrial automation sectors. His interests include firmware security, fuzzing, reverse engineering, and securing safety-critical embedded systems.
Session
Modern vehicles rely on dozens of electronic control units (ECUs) that manage critical vehicle functions. The firmware of an ECU is low-level software that controls the microcontroller within the unit, enabling it to read sensor values and issue commands to actuators. Since ECUs control critical functionalities, ensuring their security is essential for both safety and reliability. While fuzzing has become a standard technique for finding vulnerabilities in desktop and server software, applying it to automotive firmware presents a very different set of challenges.
Compared to classic software, ECU firmware usually works on unique hardware setups, relies on hardware parts, and operates in conditions where code coverage, memory error detection, and instrumentation are hard to implement. Therefore, the majority of today's automotive fuzzing activities still mainly target communication protocols like CAN or UDS while most parts of firmware remain mostly unexplored, i.e., blackbox.
In this study, we present the real-world difficulties of developing a firmware fuzz testing framework for automotive ECUs and how to overcome them. During this research we have designed a fuzz testing framework capable of rehosting firmware and integrated with AFL++. We also present our methodology to reduce the cost of fuzzing by prioritizing regions with the most probability of containing a vulnerability in the firmware. Furthermore, we discuss how we developed our custom memory error detector tool, designed to identify out-of-bounds memory operations in Tricore-based firmware with an AUTOSAR software stack.
The framework successfully identified all vulnerabilities in our manually crafted benchmark. Moreover, we also managed to find numerous memory safety violations in real-world TriCore firmware.