IoT Fuzzing using AGAPIA and the River Framework

As the number of Internet of Things (IoT) systems continues to grow, so does the security risk imposed by interconnecting heterogeneous devices from different vendors. Testing and validating the security of IoT systems is difficult, especially due to the fact that most of the software is proprietary (closed-source) and the system's embedded nature makes it hard to collect data, such as memory corruptions. This paper proposes to extend the novel AGAPIA language to enable IoT developers to write safer programs that can be tested and validated with state of the art fuzzers, such as RiverIoT. We present how simple additions can enable AGAPIA modules to be integrated with the RiverIoT architecture, thus facilitating better device testing. The proposed approach also enables users, not just developers, to perform system wide, black-box, testing, increasing the reliability of the system. We show how the abstractions provided by the AGAPIA language enable the fast development of an Air Quality Monitoring application and how small additions to existing programming languages can improve the testing and validation of IoT systems.