Related Experiment Video
Updated: May 17, 2025
08:15
Data Communication Based on MQTT in a Polymer Extrusion Process
Published on: July 15, 2022
3.4K
Large Language Model-Powered Protected Interface Evasion: Automated Discovery of Broken Access Control
Enze Wang1, Wei Xie1, Shuhuan Li1
1College of Computer Science and Technology, National University of Defense Technology, No. 137 Yanwachi Street, Changsha 410073, China.
Sensors (Basel, Switzerland)
|May 14, 2025
Summary
ACBreaker, a new method using a large language model (LLM), effectively finds broken access control flaws in IoT device web interfaces. This system identifies vulnerabilities, enhancing IoT security against unauthorized access.
Area of Science:
- Cybersecurity
- Software Engineering
- Artificial Intelligence
Background:
- Broken access control is a critical vulnerability in IoT devices, per the OWASP Top 10.
- Existing detection methods for these flaws are insufficient.
- Unauthorized access to IoT devices can lead to sensitive data breaches and network attacks.
Purpose of the Study:
- To introduce ACBreaker, a novel methodology for systematically detecting broken access control vulnerabilities in IoT device web interfaces.
- To leverage large language models (LLMs) for enhanced vulnerability detection.
- To improve the security posture of Internet of Things (IoT) devices.
Main Methods:
- Developed ACBreaker, a three-stage methodology utilizing an LLM.
- Code chunking to handle large firmware files beyond LLM context limits.
- LLM-driven information extraction and integration with mutation-based fuzzing and differential analysis.
Main Results:
- Evaluated ACBreaker on 11 IoT devices, analyzing over 1.2 million lines of code.
- Discovered 39 previously unknown broken access control vulnerabilities.
- Categorized vulnerabilities into three types facilitating protected interface evasion.
Conclusions:
- ACBreaker demonstrates a highly effective approach to identifying critical access control vulnerabilities in IoT devices.
- The methodology significantly enhances the detection of security flaws in protected web interfaces.
- Responsible disclosure of identified vulnerabilities led to vendor patches and CVE assignments.
