Power side channel guides fuzzer to find embedded system bugs
POZZER: A Power Side Channel-guided Fuzzer for Black-Box Embedded Systems
Cryptography and Security
Summary
Finding bugs in embedded device software is hard when the device’s internals are hidden. The authors created POZZER, a tool that listens to power usage patterns from the device to guess what it’s doing and find new software behaviors without needing to look inside. This helps POZZER test and find security problems even when the device firmware cannot be directly accessed or modified. The authors showed that POZZER worked better than a random tester on several devices and found real, previously unknown security flaws that were confirmed by the device maker.
What this means in practice
- •For embedded security engineers: Test embedded devices for hidden security vulnerabilities without needing firmware access by using power consumption patterns as feedback.
- •For hardware quality assurance teams: Improve testing of off-the-shelf embedded devices by detecting unknown bugs through side-channel guided fuzzing that works without device internals.
Authors
Pouya Narimani, Kseniia Rogova, Addison Crump, Martin Mohl, Meng Wang, Ulysse Planta, Pansilu Pitigalaarachchi, Ali Abbasi
Abstract
Firmware fuzzing is an effective technique for discovering vulnerabilities in embedded systems. However, existing coverage-guided firmware fuzzers typically obtain feedback through firmware instrumentation, hardware debug interfaces, or firmware rehosting, which requires access to the firmware source code or binary image. Such requirements are often infeasible for off-the-shelf embedded devices, where firmware binaries are inaccessible, unrehostable, immodifiable, or undebuggable, necessitating fuzzing under black-box conditions. In this paper, we present POZZER, a power side-channel-guided fuzzer for black-box embedded systems. POZZER uses power traces as feedback to identify previously unseen behavior via an incrementally constructed graph-based representation of observed executions, guiding the fuzzer toward unexplored execution paths. Its non-profiling design requires neither prior firmware knowledge nor a clone device, extracting meaningful feedback from a single power trace per execution while remaining robust to measurement noise. We evaluate POZZER on 15 firmware targets across two platforms and two real-world commercial embedded devices. Across the resulting target-platform combinations, POZZER outperforms a blind fuzzer under the same time budget in 26 out of 30 target-platform combinations. Furthermore, POZZER discovers two previously unknown vulnerabilities in one of the commercial devices, both confirmed by the vendor, demonstrating its potential for identifying vulnerabilities in black-box embedded systems.