Bluetooth fuzz testing method based on state feedback

Abstract

The present invention discloses a Bluetooth fuzzy testing method based on state feedback, which is configured with a vulnerability mining tool including a Bluetooth data packet transceiver, a data packet parser, a state mapping list memory, a data packet mutator and an exception recorder. After the Bluetooth data packet transceiver generates and sends a Bluetooth data packet, the data packet parser parses the Bluetooth data packet to obtain its sending state. The data packet mutator obtains the mutation priority of the sending state from the state mapping list memory, mutates the sent Bluetooth data packet and sends it to the tested Bluetooth device. If the data packet parser receives the Bluetooth data packet fed back by the tested Bluetooth device within the feedback waiting time, the mutation priority is adjusted according to the receiving state of the fed back Bluetooth data packet. If the Bluetooth data packet is not received, the exception recorder saves and feeds back the abnormal state. The present invention improves the mutation validity of the Bluetooth data packet by setting the state mapping list, thereby improving the test efficiency.

Description

Technical Field

[0001] The invention belongs to the technical field of Bluetooth testing, and more specifically, relates to a Bluetooth fuzzy testing method based on state feedback. Background Art

[0002] Currently, there are two solutions used by existing Bluetooth protocol fuzzers (vulnerability mining tools):

[0003] 1) Simulate Bluetooth communication structure and send packets

[0004] Let the Fuzzer simulate the Bluetooth data packet communication method to construct a data packet that conforms to the Bluetooth data packet structure, and mutate the generated data before constructing or sending the data packet in order to discover the implementation irregularities in the Bluetooth protocol stack.

[0005] 2) Capture data packets and mutate them

[0006] First, capture the data packets in normal Bluetooth communication as seeds. When the Fuzzer starts, the captured data packets are used as seeds for random mutations. During the Fuzzing process, replay or randomly select mutations to discover vulnerabilities in the target Bluetooth protocol stack.

[0007] The two methods used in the existing technology have their own advantages and disadvantages. The method of simulating Bluetooth communication to construct packets first requires a lot of time to manually construct Bluetooth data packet templates under multiple scenarios, and has no perception of data packets in the state of refusing connection. When the target has refused the connection, it will continue to send data packets, wasting a lot of time on invalid test cases.

[0008] The method of capturing and mutating packets requires capturing data packet communication data in various scenarios as seed samples. Secondly, the Fuzzer based on the method of replaying and randomly mutating captured packets cannot correctly respond to the temporary context information generated during Bluetooth communication, resulting in the Fuzzer being unable to test deeper parsing processes. Also, because it has no perception of the connection status, it will continue to send invalid data packets when the target has rejected the connection, wasting a lot of time looping on invalid test cases. Summary of the invention

[0009] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a Bluetooth fuzzy testing method based on state feedback, which improves the variation validity of Bluetooth data packets by setting a state mapping list, thereby improving the testing efficiency.

[0010] In order to achieve the above-mentioned object of the invention, the Bluetooth fuzzy testing method based on state feedback of the present invention comprises the following steps:

[0011] S1: Configure vulnerability mining tools, including Bluetooth data packet transceiver, data packet parser, state mapping list memory, data packet mutator and anomaly recorder, where:

[0012] The Bluetooth data packet transceiver is used to generate and send Bluetooth data packets and send them to the data packet parser;

[0013] The data packet parser is used to parse the status corresponding to each data packet during the sending and receiving process of the Bluetooth data packet, that is, the sending status of the sending data packet from the Bluetooth data packet transceiver and the receiving status of the receiving data packet from the tested Bluetooth device;

[0014] The state mapping list memory is used to store the state mapping list, including a sending state for storing the sending Bluetooth data packet and its corresponding receiving state set and mutation priority;

[0015] The data packet mutator is used to mutate the Bluetooth data packet to be sent and send it to the Bluetooth device under test;

[0016] The exception recorder is used to record the abnormal status during the test and provide feedback to the tester;

[0017] S2: The Bluetooth data packet transceiver generates a Bluetooth data packet and sends it to the data packet parser;

[0018] S3: The data packet parser parses the sending Bluetooth data packet generated by the Bluetooth data packet transceiver to obtain the protocol layer and data packet type corresponding to the sending Bluetooth data packet, and uses the protocol layer and data packet type as the sending state of the sending Bluetooth data packet; the data packet parser queries the state mapping list in the state mapping list storage, and if the sending state corresponding to the sending Bluetooth data packet exists, no operation is performed; if the sending state corresponding to the sending Bluetooth data packet does not exist, the sending state is added to the state mapping list, and its corresponding receiving state set is set to an empty set, and its mutation priority P is set to an initial value; the data packet parser sends the sending Bluetooth data packet and its corresponding current sending state to the data packet mutator;

[0019] S4: the data packet mutator searches for the current mutation priority P of the received Bluetooth data packet in the state mapping list according to the sending state of the received Bluetooth data packet; if the mutation priority P of the Bluetooth data packet is the initial value, the mutation is performed according to the preset mutation probability; if the mutation priority P of the Bluetooth data packet is greater than the initial value, the Bluetooth data packet is mutated, and then the mutated Bluetooth data packet is sent to the tested Bluetooth device;

[0020] S5: If the data packet parser receives the Bluetooth data packet fed back by the tested Bluetooth device within the preset feedback waiting time, it proceeds to step S6, otherwise it proceeds to step S7;

[0021] S6: The data packet parser parses and obtains the protocol layer and data packet type corresponding to the feedback Bluetooth data packet, and uses the protocol layer and data packet type as the receiving state of the feedback Bluetooth data packet; queries the state mapping list to obtain the receiving state set corresponding to the sending state of the sending Bluetooth data packet corresponding to the feedback Bluetooth data packet; if the receiving state set is empty, the receiving state of the feedback Bluetooth data packet is added to the receiving state set; if the receiving state set contains the same receiving state as the feedback Bluetooth data packet, the mutation is invalid and no operation is performed; if the receiving state set contains the same receiving state as the feedback Bluetooth data packet, the mutation is valid, the receiving state is added to the receiving state set, and then the mutation priority P is set to P+1; and the process proceeds to step S8;

[0022] S7: The data packet parser sends the Bluetooth data packet sent in this communication and its sending status to the abnormality recorder, and the abnormality recorder obtains the current communication status of the tested Bluetooth device and records it as an abnormal status, and then saves the current Bluetooth data packet sent as an abnormality-inducing data packet; proceed to step S8;

[0023] S8: Determine whether the vulnerability mining tool has received the detection end instruction. If so, the detection ends; otherwise, return to step S2 to continue detection.

[0024] The present invention is a Bluetooth fuzzy testing method based on state feedback, and is configured with a vulnerability mining tool including a Bluetooth data packet transceiver, a data packet parser, a state mapping list memory, a data packet mutator and an exception recorder. After the Bluetooth data packet transceiver generates and sends a Bluetooth data packet, the data packet parser parses it to obtain its sending state. The data packet mutator obtains the mutation priority of the sending state from the state mapping list memory, mutates the sent Bluetooth data packet, and then sends it to the tested Bluetooth device. If the data packet parser receives the Bluetooth data packet fed back by the tested Bluetooth device within a preset feedback waiting time, the mutation priority is adjusted according to the receiving state of the fed back Bluetooth data packet. If the Bluetooth data packet fed back by the tested Bluetooth device is not received, the exception recorder records the current communication state of the tested Bluetooth device as an abnormal state, and saves the currently sent Bluetooth data packet as an exception-inducing data packet.

[0025] The present invention realizes the mapping of the sending state and receiving state of the Bluetooth data packet communication process, thereby sensing the state of the Bluetooth protocol stack in the tested Bluetooth device in the dynamic test, avoiding the invalid ambiguity of the data packet in the Bluetooth authentication or negotiation process, thereby performing mutations on the correct time and the correct packet, improving the mutation validity, and ensuring the normal connection. In addition, the connection termination state can be quickly sensed for the data packet whose connection is rejected, avoiding the waste of invalid test cases, and improving the test efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a flowchart of a specific implementation method of the Bluetooth fuzzy testing method based on state feedback of the present invention;

[0027] Figure 2 It is a structural diagram of the vulnerability detection tool in the present invention. DETAILED DESCRIPTION

[0028] The specific implementation of the present invention is described below in conjunction with the accompanying drawings so that those skilled in the art can better understand the present invention. It should be noted that in the following description, when the detailed description of known functions and designs may dilute the main content of the present invention, these descriptions will be omitted here.

[0029] Example

[0030] Figure 1 It is a flow chart of a specific implementation method of the Bluetooth fuzzy testing method based on state feedback of the present invention.

[0031] like Figure 1 As shown, the specific steps of the Bluetooth fuzzy testing method based on state feedback of the present invention include:

[0032] S101: Configure vulnerability mining tools:

[0033] In order to implement Bluetooth fuzz testing, you first need to configure the vulnerability mining tool. Figure 2 Schematic diagram of the structure of the vulnerability mining tool in the present invention. Figure 2 As shown, the vulnerability mining tool in the present invention includes a Bluetooth data packet transceiver, a data packet parser, a state mapping list memory, a data packet mutator and an anomaly recorder, wherein:

[0034] The Bluetooth data packet transceiver is used to generate and send Bluetooth data packets and send them to the data packet parser. In the present invention, the Bluetooth data packet transceiver is mainly responsible for constructing and responding to data packets, and is not responsible for directly sending data. The Bluetooth data packet transceiver will refer to the implementation of the Bluetooth protocol stack to implement the construction and response parts of the data packet. The generated Bluetooth data packet will disguise itself as various common Bluetooth devices and their corresponding Bluetooth services by constructing data that conforms to the data packet specification, such as Bluetooth headsets, Bluetooth mice, Bluetooth keyboards, mobile phones, etc.

[0035] The data packet parser is used to parse the status of each data packet during the sending and receiving process of the Bluetooth data packet, that is, the sending status of the sending data packet from the Bluetooth data packet transceiver and the receiving status of the receiving data packet from the tested Bluetooth device.

[0036] The state mapping list memory is used to store the state mapping list, including the sending state of sending Bluetooth data packets and its corresponding receiving state set and mutation priority.

[0037] The data packet mutator is used to mutate the Bluetooth data packet to be sent and send it to the Bluetooth device under test;

[0038] The exception recorder is used to record abnormal conditions during the test and provide feedback to the tester.

[0039] S102: Generate Bluetooth data packet:

[0040] The Bluetooth data packet transceiver generates a Bluetooth data packet to be sent and sends it to the data packet parser.

[0041] S103: Get Bluetooth data packet sending status:

[0042] The data packet parser parses the Bluetooth data packet generated by the Bluetooth data packet transceiver to obtain the protocol layer and data packet type corresponding to the Bluetooth data packet, and uses the protocol layer and data packet type as the sending state of the Bluetooth data packet. The data packet parser queries the state mapping list in the state mapping list storage. If the sending state corresponding to the Bluetooth data packet exists, no operation is performed. If the sending state corresponding to the Bluetooth data packet does not exist, the sending state is added to the state mapping list, and its corresponding receiving state set is set to an empty set, and its mutation priority P is set to an initial value. Generally speaking, the initial value of the mutation priority is 0. The data packet parser sends the Bluetooth data packet and its corresponding current sending state to the data packet mutator.

[0043] In this embodiment, the Bluetooth data packet parsing is implemented using the built-in parser in Wireshark, and the data format is the same as the parser filtering rules in Wireshark. For example, when the Bluetooth data packet to be sent is btl2cap.cmd_code, its corresponding protocol layer is the l2cap layer in the Bluetooth protocol stack, and the corresponding type is cmd_code.

[0044] S104: Bluetooth data packet mutates and sends:

[0045] The data packet mutator searches for the mutation priority P of the current sending state in the state mapping list according to the sending state of the received sending Bluetooth data packet. If the mutation priority P of the sending Bluetooth data packet is the initial value, the mutation is performed according to the preset mutation probability. If the mutation priority P of the sending Bluetooth data packet is greater than the initial value, the sending Bluetooth data packet is mutated, and then the mutated sending Bluetooth data packet is sent to the tested Bluetooth device.

[0046] S105: If the data packet parser receives the Bluetooth data packet fed back by the tested Bluetooth device within the preset feedback waiting time, the process proceeds to step S106; otherwise, it indicates that the tested Bluetooth device may crash, and the process proceeds to step S107.

[0047] S106: Get Bluetooth data packet receiving status:

[0048] The data packet parser parses and obtains the protocol layer and data packet type corresponding to the feedback Bluetooth data packet, and uses the protocol layer and data packet type as the receiving state of the feedback Bluetooth data packet. The state mapping list is queried to obtain the receiving state set corresponding to the sending state of the sending Bluetooth data packet corresponding to the feedback Bluetooth data packet. If the receiving state set is empty, the receiving state of the feedback Bluetooth data packet is added to the receiving state set. If the receiving state set contains the same receiving state as the feedback Bluetooth data packet, the mutation is invalid and no operation is performed. If the receiving state set does not contain the same receiving state as the feedback Bluetooth data packet, the mutation is valid, and the receiving state is added to the receiving state set, and then the mutation priority P is set to P+1. Step S108 is entered.

[0049] S107: Record abnormal status:

[0050] The data packet parser sends the Bluetooth data packet sent in this communication and its sending status to the abnormal recorder, and the abnormal recorder obtains the current communication status of the tested Bluetooth device and records it as an abnormal status, and then saves the current Bluetooth data packet sent as an abnormality-inducing data packet. Enter step S108.

[0051] S108: Determine whether the vulnerability mining tool has received a detection end instruction. If so, the detection ends; otherwise, return to step S102 to continue detection.

[0052] When the detection is completed, the vulnerability mining tool can save the sending state with a mutation priority greater than the initial value in the current state mapping list and its corresponding receiving state set and mutation priority as a mutation template, and import the state mapping list at the beginning of the next Bluetooth fuzz test. This can reduce the time for the fuzz test iteration to select the sending Bluetooth data packet to be mutated during the next Bluetooth fuzz test, and improve the efficiency of the fuzz test.

[0053] Although the above describes the illustrative specific embodiments of the present invention to facilitate those skilled in the art to understand the present invention, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations using the concept of the present invention are protected.

Claims

1. A Bluetooth fuzzy testing method based on state feedback, characterized in that: The following steps are involved: S1: Configure vulnerability mining tools, including Bluetooth data packet transceiver, data packet parser, state mapping list memory, data packet mutator and anomaly recorder, where: The Bluetooth data packet transceiver is used to generate and send Bluetooth data packets and send them to the data packet parser; The data packet parser is used to parse the status corresponding to each data packet during the sending and receiving process of the Bluetooth data packet, that is, the sending status of the sending data packet from the Bluetooth data packet transceiver and the receiving status of the receiving data packet from the tested Bluetooth device; The state mapping list memory is used to store the state mapping list, including the sending state of the Bluetooth data packet and its corresponding receiving state set and mutation priority; The data packet mutator is used to mutate the Bluetooth data packet to be sent and send it to the Bluetooth device under test; The exception recorder is used to record the abnormal status during the test and provide feedback to the tester; S2: The Bluetooth data packet transceiver generates a Bluetooth data packet and sends it to the data packet parser; S3: The data packet parser parses the sending Bluetooth data packet generated by the Bluetooth data packet transceiver to obtain the protocol layer and data packet type corresponding to the sending Bluetooth data packet, and uses the protocol layer and data packet type as the sending state of the sending Bluetooth data packet; the data packet parser queries the state mapping list in the state mapping list storage, and if the sending state corresponding to the sending Bluetooth data packet exists, no operation is performed; if the sending state corresponding to the sending Bluetooth data packet does not exist, the sending state is added to the state mapping list, and its corresponding receiving state set is set to an empty set, and its mutation priority P is set to an initial value; the data packet parser sends the sending Bluetooth data packet and its corresponding current sending state to the data packet mutator; S4: the data packet mutator searches for the current mutation priority P of the received Bluetooth data packet in the state mapping list according to the sending state of the received Bluetooth data packet; if the mutation priority P of the Bluetooth data packet is the initial value, the mutation is performed according to the preset mutation probability; if the mutation priority P of the Bluetooth data packet is greater than the initial value, the Bluetooth data packet is mutated, and then the mutated Bluetooth data packet is sent to the tested Bluetooth device; S5: If the data packet parser receives the Bluetooth data packet fed back by the tested Bluetooth device within the preset feedback waiting time, it proceeds to step S6, otherwise it proceeds to step S7; S6: The data packet parser parses and obtains the protocol layer and data packet type corresponding to the feedback Bluetooth data packet, and uses the protocol layer and data packet type as the receiving state of the feedback Bluetooth data packet; Query the state mapping list to obtain the receiving state set corresponding to the sending state of the sending Bluetooth data packet corresponding to the feedback Bluetooth data packet. If the receiving state set is empty, add the receiving state of the feedback Bluetooth data packet to the receiving state set. If the receiving state set contains the same receiving state as the feedback Bluetooth data packet, the mutation is invalid and no operation is performed. If the receiving state set contains the same receiving state as the feedback Bluetooth data packet, the mutation is valid and the receiving state is added to the receiving state set. Then, set the mutation priority P=P+1. Enter step S8. S7: The data packet parser sends the Bluetooth data packet sent in this communication and its sending status to the abnormal recorder, and the abnormal recorder obtains the current communication status of the tested Bluetooth device and records it as an abnormal status, and then saves the current Bluetooth data packet sent as an abnormality-inducing data packet; proceed to step S8; S8: Determine whether the vulnerability mining tool has received the detection end instruction. If so, the detection ends; otherwise, return to step S2 to continue detection.

2. The Bluetooth fuzzy testing method according to claim 1, characterized in that: After the detection is completed in step S8, the following steps are also included: determine that the vulnerability mining tool saves the sending state whose mutation priority is greater than the initial value in the current state mapping list and its corresponding receiving state set and mutation priority as a mutation template, and imports the state mapping list at the beginning of the next Bluetooth fuzz test.

Images