CNCFuzzer: Directed Blackbox Fuzzing of Computer Numerical Control System Based on Message Behaviour Guidance

In the era of the Industrial Internet of Things, Computer Numerical Control (CNC) Systems are confronted with a pervasive threat from attackers. Uncovering their security vulnerabilities before being exploited becomes imperative. Enterprise-level CNC devices often pose significant challenges in obtaining firmware, limiting vulnerability analysis to black-box fuzzing. However, the communication protocols used by CNC devices are characterized by heterogeneity, complexity, and proprietary formats. This inherent complexity not only makes it difficult to build high-quality test cases, but also significantly exceeds the search space of traditional black-box fuzzing methods, thus reducing their efficiency and effectiveness. In this paper, we propose CNCFuzzer, a directed black-box fuzzing approach based on message behaviour guidance. The insights of CNCFuzzer are that if a communication Application Programming Interface (API) is high-risk, the probability that other communication APIs with similar behaviour are high-risk increases. Firstly, we design a black-box directed fuzzing method based on the similarity of the behaviour of machining messages. The key to this solution is that we design graphs of message behaviour as the maps for directed fuzzing. Then, a Transformer-based seq2seq model is employed to train a proprietary protocol traffic generator, which generates high-quality test cases that meet protocol formats. Finally, We design a cyber-physical fusion monitor, which observes the current and voltage of the controllers to monitor the vulnerability of CNC devices and proactive network requests to distinguish the functional command injection and memory corruption. We have implemented CNCFuzzer and evaluated it on 6 enterprise-level CNC devices from 3 brands. Results show that CNCFuzzer outperforms 5 existing black-box fuzzing tools and identified 63 previously unknown vulnerabilities, including 30 memory corruption and 33 functional command injection.