Virtual 802.11 Fuzzing

About Virtual 802.11 Fuzzing

Fuzzing wireless communication is a non-trivial endeavor, because of a number of properties of the underlying IEEE 802.11 protocol. Above all, response timing and target monitoring are two critical issues that introduce complex obstacles when fuzzing 802.11.

Virtual 802.11 fuzzing enables us to overcome (many of) these obstacles, by providing a framework to test wireless communication software (typically a device driver) inside a virtual environment (our implementation is based on Qemu).

Status

Documentation / Publications

• White Paper: Stateful Fuzzing of Wireless Device Drivers in an Emulated Environment
• White Paper: Kernel-mode Exploits Primer
• Presentation slides BlackHat Japan 2007: Stateful Fuzzing of Wireless Device Drivers in an Emulated Environment
• Presentation slides DeepSec 2007: Fuzzing and Exploiting Wireless Device Drivers

Software

• March 3rd, 2008:
  We have posted a patch for the Qemu CVS version and hope it will be merged into the public Qemu project, soon. The patch allows to use the virtual wireless device as casual network interface card inside the system emulator. For more information, refer to the Qemu mailing list archives here and here.
• November 26th, 2007:
  Initial release

Authors

Virtual 802.11 fuzzer is developed by Clemens Kolbitsch and Sylvester Keil.