Search

Cyber attacks against the web management interface of Internet of Things (IoT) devices often have serious consequences. Current research uses fuzzing technologies to test the web interfaces of IoT devices. These IoT fuzzers generate messages (a test case sent from the client to the server to test its functionality) without considering their dependency, which is unlikely to bypass the early check of the server. These invalid test cases significantly reduce the efficiency of fuzzing. To overcome this problem, we propose a stateful message generation (SMG) mechanism for IoT web fuzzing. SMG addresses two problems in IoT fuzzing. First, we retrieve the message dependency by using web front-end analysis and status analysis. These dependent messages, which can easily bypass the server check, are used as a valid seed. Second, we adopt a multi-message seed format to preserve the dependency of the messages when mutating the seed to get a valid test case, so that the test case can bypass the state check of the server to make a valid test. Message dependency preservation is implemented by our proposed parameter mutation and structural mutation methods. We implement SMG in our IoT fuzzer, SIoTFuzzer, which applies IoT firmware on the latest Linux-based simulation tool, FirmAE. We test nine IoT devices including a router and an IP camera and adopt a vulnerability detection mechanism. Our evaluation results show that (1) SIoTFuzzer is capable of finding real-world vulnerabilities in IoT devices, (2) our SMG is effective as it enables Boofuzz (a popular protocol fuzzer) to find command injection and cross-site scripting (XSS) vulnerabilities, and (3) compared to FirmFuzz, SIoTFuzzer found all the vulnerabilities in our benchmarks, while FirmFuzz found only four—the efficiency of our tool increased by 20.57% on average.

Företag idag är pressade och måste prioritera sina primära arbetsuppgifter, vilket ofta leder till att arbetsmiljöarbetet blir svårt att upprätthålla eller kan ses som en omotiverad kostnad. För att bespara tid och inte störa den dagliga verksamheten förekommer det att representanter väljs ut som får agera länk mellan slutanvändare och systemutvecklare vid framtagandet av nya system. Det leder till att viktiga kunskaper och behov inte kommer fram under utvecklingsfasen. Bristande utformning av datorsystem kan leda till att de inte nyttjas eller att arbetsmiljöarbetet blir lidande. Vid utformning av datorsystem är det viktigt att ta hänsyn till användbarhet. Ett datorsystem som är byggt med användaren i fokus verkar ha en större acceptans hos företag. Syftet med undersökningen var att identifiera behov av datorstöd till systematiskt arbetsmiljöarbete (SAM) hos företag som sedan tidigare arbetar med AFS 2001:1. Metoden för denna uppsats bestod huvudsakligen av litteraturundersökningar och intervjuer med chefer samt medarbetare (alternativt skyddsombud). Insamlad data jämfördes mellan chef och medarbetare och skillnader mellan företagen analyserades. Resultat visade att det inte fanns skillnader av den insamlade data mellan chef och medarbetare (alternativt skyddsombud) inom samma företag. Detta betyder att deltagarna från samma företag har samma bild över deras arbetsmiljöarbete. Mellan företagen råder det dock olikheter då kunskapsnivån spelar roll och vilken slags kunskapsöverföring som finns idag. Det som var en gemensam bristande faktor för samtliga företag var det sista steget i det systematiska arbetsmiljöarbetet ”Undersöka-Bedömning-Åtgärda-Kontroll”. Samtliga företag var duktiga på att åtgärda arbetsmiljöbrister som var av den akuta karaktären. Akuta ärenden är något som upptäcks direkt exempelvis personskada på grund av snubbling. Medan långsiktiga brister ses som större processer med längre implementeringsperioder exempelvis kartläggning av fallande produktivitet på grund av arbetsmiljöbrister. Slutsats av resultaten visade på att det finns behov av ett ledningssystem med IT-stöd som är användaranpassat. Det bör ge stöd istället för att belasta arbetsgivaren med mängder av dokumentation och administration. Inför designfasen av ett ledningssystem är syfte och mål viktiga delar att definiera tillsammans med utvecklaren för att kunna skapa ett användarvänligare system. Något som genomsyrade resultaten av undersökningen var att samtliga deltagare inte genomförde någon form av uppföljning. Därför blir det viktigt att i framtida utvecklingsprojekt ta hänsyn till den delen av systematiskt arbetsmiljöarbete för att säkerställa att det inte glöms bort. Detta steg är en viktig del av systematiskt arbetsmiljöarbete och måluppfyllning samt utveckling. Bättre uppföljning ger bättre beslut. Companies today are pressed and need to prioritize their primary work tasks which often means that work environment management is hard to maintain or can be seen as an unmotivated cost. To save money and avoid disturbing the daily operations representatives are sometimes chosen to be the link between the end-user and the system developer during the development of a new system. That means that important knowledge and needs aren’t included in the development phase. Poorly designed computer systems can lead to it not being used or the fact that the work environment management becomes suffering. During the development of a computer system it’s important to consider the usability. A system that is built focused on the end-user seems to have a higher level of acceptance at companies. The purpose of this essay was to identify the needs of computer aid for the systematic work environment management at companies that have previously worked with AFS 2001:1 (Swedish law for systematic work environment management). The method for this essay mainly consisted of literature studies and interviews with managers and co-workers (alternatively safety representative). Collected data from managers and co-workers were compared and the differences between the companies were analyzed. Results show that there wasn’t any difference between the data collected from the managers and the co-workers in the same company. This means that participants from the same company had the same view on their work environment management. When the companies were compared to each other there were differences related to the level of knowledge and the ability to pass the knowledge along. A common factor that was lacking for all companies was that the final step in the systematic work environment management which is control. All companies were good at addressing occupational safety deficiencies that were of the acute nature. Acute cases are something that is detected directly, for example, injuries due to tripping. While long-term deficiencies are seen as major processes with longer implementation periods, such as mapping of declining productivity due to workplace shortcomings. Conclusion of the results showed that there is a need for a management system with IT support that is user-adapted. It should provide support rather than burden the employer with a load of documentation and administration. Before the design phase of a management system, the purpose and goal are key elements to define with the developer in order to create a user-friendly system. Something that permeated the results of the survey was that all participants didn’t do any kind of follow-up. Therefore, in future development projects, it is important to take into account that part of the systematic work environment management to ensure that it is not forgotten. This step is an important part of systematic work environment management and goal fulfillment as well as development. Better follow up leads to better decisions.

The diploma thesis on Development of Front-end Applications focuses on the design of computerization of enterprise processes covered by a unified front-end application. Exploratory research was used to suggest working methods to solve technological growth of the enterprise and how to evaluate business need of a front-end application. Later chapters present basic summary of development methodology used for automation of business processes. The diploma thesis innovatively proposes a role of a front-end specialist who does not need to create a program code and has closer relation to business departments. There are recommend analytical standards and development tools for automation of business processes as well as front-end implementation. Finally the work attaches a model example demonstrating relative simplicity and practical realization of new techniques for front-end application development. Powered by TCPDF (www.tcpdf.org)