██╗ ██╗ ███████╗██╗ ██╗███████╗███████╗███████╗██████╗ ██║ ██║ ██╔════╝██║ ██║╚══███╔╝╚══███╔╝██╔════╝██╔══██╗ ██║ ██║█████╗█████╗ ██║ ██║ ███╔╝ ███╔╝ █████╗ ██████╔╝ ██║ ██║╚════╝██╔══╝ ██║ ██║ ███╔╝ ███╔╝ ██╔══╝ ██╔══██╗ ███████╗███████╗ ██║ ╚██████╔╝███████╗███████╗███████╗██║ ██║ ╚══════╝╚══════╝ ╚═╝ ╚═════╝ ╚══════╝╚══════╝╚══════╝╚═╝ ╚═╝ Authors: Chad Spensky (email@example.com) Hongyi Hu (firstname.lastname@example.org)
LL-Fuzzer is a fuzzing framework built to fuzz NFC applications on android devices.
To install all of the dependencies type:
or follow the individual instructions below:
If you're using a 64bit machine, you must install the 32 bit libraries:
$ sudo apt-get install ia32-libs
Some of the android stuff requires java:
$ sudo apt-get install openjdk-7-jre
NFCPy depends on libusb:
$ sudo apt-get install python-pip
$ sudo pip install pyusb
For general help try:
$ python fuzzer.py --help
An example of a real use case would be:
$ python fuzzer.py -r tty:usb:0 -s 4d001f274acd31cf -D fuzz-configs/ndef/ -o testing
There are some settings on android that make fuzzing a much more pleasurable experience.
Enable USB debugging through "Developer options" If you don't see this option go to "About phone" and tap the "Build number" a bunch of times.
Enable "Stay awake" under "Developer options"
Set "Screen Lock" to None under "Security"
Here are some example commands to test NFC functionality (All files in examples-nfc):
Emulate an NFC tag:
$ ./npp-test-client.py -b --mode=initiator --quirks=android < ndef
Read data from an NFC tag:
- RFID Reader / FrontEnd as named by nfcpy (e.g. Proxmark, Omnikey, PN532 board)
- LL-Fuzzer provides full control over what this sends over the RFID channel
- RFID Device (e.g. smartphone, tablet, etc.)
- Provides an abstraction to interaction with NFC-enabled devices
- RFID Message (e.g. NDEF, LLCP)
- LL-Fuzzer supports numerous NFC message types
- Generates inputs for fuzzing
- Drives fuzzing operation
- Uses generator to generate fuzzed messages
- Tells RFID reader to transmit fuzzed messages
- Receives logs, etc. from RFID Device
- Controls RFID stack on RFID device to reset state
It might be useful to interface the fuzzer with e-mail for very long jobs.
$ sudo apt-get install sendmail
Unreliable RF Transmission
During our own fuzzing, we had a very difficult time getting reliable
NFC communication. To facilitate this, we used a book with the reader
placed inside and the phone tapped to the top to prevent it from moving.
A more elegant setup is certainly possible, but any reliable setup will need a way of tweaking the distance and then holding the reader and phone at that fixed distance for the duration of the fuzzing.
This work is sponsored by the Defense Information Systems Agency under Air Force Contract #FA8721-05-C-0002. Opinions, interpretations, conclusions and recommendations are those of the author and are not necessarily endorsed by the United States Government.