Antonio Bianchi

Robotic vehicles, such as Unmanned Aerial Vehicles (UAVs), are deployed in safety-critical applications ranging from package delivery to search and rescue operations. In these cyber-physical systems, software vulnerabilities can cause physical consequences such as collisions and mission failures, giving them direct safety implications. Most existing security research has focused on core control software. However, peripheral subsystems such as proximity sensors, optical flow sensors, and camera gimbals remain under-tested despite directly influencing control decisions, creating opportunities for attackers to manipulate vehicle behavior without immediately triggering software-level alarms. In this paper, we present DroneFuzz, a fuzzing framework for discovering cyber-physical vulnerabilities (CPVs) in robotic vehicle peripheral subsystems. DroneFuzz targets MAVLink-based systems and uses a grammar-based mutation engine to generate semantically valid peripheral inputs. The engine parses publicly available MAVLink XML specifications to produce well-formed messages, allowing us to explore peripheral-dependent code paths. DroneFuzz addresses the challenge of separating genuine safety violations from normal flight variations caused by wind, turbulence, and sensor noise using a novel hybrid bug oracle that combines Dynamic Time Warping (DTW) with Long Short-Term Memory (LSTM) autoencoders. We evaluate DroneFuzz on ArduPilot and PX4, two widely used autopilot systems. DroneFuzz reproduces five known vulnerabilities and discovers two previously unknown bugs in proximity sensor and optical flow subsystems. To support reproducibility, we release our implementation of the framework and configuration artifacts. These findings indicate that peripheral subsystems are a practical and largely overlooked attack surface.

Android smartphones use a dedicated component, Keymaster, to perform all their cryptographic, security-sensitive operations (e.g., storing cryptographic material and performing signing operations). While all Android Keymaster implementations need to expose a specific interface, their internals are hard to analyze, since their source code is generally not available. Moreover, Android Keymasters' code normally runs in a Trusted Execution Environment (TEE), where typical debugging functionality is not available. For these reasons, Keymaster implementations cannot be analyzed using white-box or gray-box automated approaches. To address this issue, in this paper, we design, implement, and evaluate AKF (Android Keymaster Fuzzer), a device-agnostic, differential, black-box fuzzer. AKF uses a dynamic grammar to test, in parallel, multiple Keymaster implementations, comparing their behavior, looking for inconsistencies. AKF can operate on different Keymaster implementations at the same time, including Keymaster implementations running on different devices and in different TEEs (e.g., ARM TrustZone and Google's Titan-M). We evaluated AKF by running it on 6 different Android devices, where it correctly detected 87 implementation inconsistencies that are a cause for concern in terms of both security and usability of cryptographic operations, including a previously-known encryption bug affecting the Titan-M chip (CVE-2019-9465).

Starlink constellations are currently the largest LEO WAN and have seen considerable interest from the research community. In this paper, we use high-frequency and high-fidelity measurements to uncover evidence of hierarchical traffic controllers in Starlink -- a global controller which allocates satellites to terminals and an on-satellite controller that schedules transmission of user flows. We then devise a novel approach for identifying how satellites are allocated to user terminals. Using data gathered with this approach, we measure the characteristics of the global controller and identify the factors that influence the allocation of satellites to terminals. Finally, we use this data to build a model which approximates Starlink's global scheduler. Our model is able to predict the characteristics of the satellite allocated to a terminal at a specific location and time with reasonably high accuracy and at a rate significantly higher than baseline.

Applications use serialization and deserialization to exchange data. Serialization allows developers to exchange messages or perform remote method invocation in distributed applications. However, the application logic itself is responsible for security. Adversaries may abuse bugs in the deserialization logic to forcibly invoke attacker-controlled methods by crafting malicious bytestreams (payloads). Crystallizer presents a novel hybrid framework to automatically uncover deserialization vulnerabilities by combining static and dynamic analyses. Our intuition is to first over-approximate possible payloads through static analysis (to constrain the search space). Then, we use dynamic analysis to instantiate concrete payloads as a proof-of-concept of a vulnerability (giving the analyst concrete examples of possible attacks). Our proof-of-concept focuses on Java deserialization as the imminent domain of such attacks. We evaluate our prototype on seven popular Java libraries against state-of-the-art frameworks for uncovering gadget chains. In contrast to existing tools, we uncovered 41 previously unknown exploitable chains. Furthermore, we show the real-world security impact of Crystallizer by using it to synthesize gadget chains to mount RCE and DoS attacks on three popular Java applications. We have responsibly disclosed all newly discovered vulnerabilities.

Fuzzing is the de-facto default technique to discover software flaws, randomly testing programs to discover crashing test cases. Yet, a particular scenario may only care about specific code regions (for, e.g., bug reproduction, patch or regression testing)—spurring the adoption of directed fuzzing. Given a set of pre-determined target locations, directed fuzzers drive exploration toward them through distance minimization strategies that (1) isolate the closest-reaching test cases and (2) mutate them stochastically. However, these strategies are applied onto every explored test case—irrespective of whether they ever reach the targets—stalling progress on the paths where targets are unreachable. Accelerating directed fuzzing requires prioritizing target-reachable paths. To overcome the bottleneck of wasteful exploration in directed fuzzing, we introduce tripwiring: a lightweight technique to preempt and terminate the fuzzing of paths that will never reach target locations. By constraining exploration to only the set of target-reachable program paths, tripwiring curtails directed fuzzers’ search noise—while unshackling them from the high-overhead instrumentation and bookkeeping of distance minimization—enabling directed fuzzers to obtain up to 99 × higher test case throughput. We implement tripwiring-directed fuzzing as a prototype, SieveFuzz, and evaluate it alongside the state-of-the-art directed fuzzers AFLGo, BEACON and the leading undirected fuzzer AFL++. Overall, across nine benchmarks, SieveFuzz’s tripwiring enables it to trigger bugs on an average 47% more consistently and 117% faster than AFLGo, BEACON and AFL++.