Fuzz Testing and Medical Devices

What is fuzz testing

Fuzz testing is an automated software/protocol testing technique that involves feeding random or invalid data inputs to a target to discover vulnerabilities, crashes, or other unexpected behavior. It aims to uncover software flaws and security vulnerabilities that might not be easily detected through traditional testing methods. Inputs can be malformed, mutated, or randomly generated data that deviates from the expected input structure—the fuzzer then uses instrumentation to observe the program's responses, looking for abnormalities such as crashes, hangs, memory leaks, or incorrect output.

Instrumentation in fuzz testing refers to the process of monitoring the target software or system under test to collect additional information during the fuzzing process. It can be as simple as using a known good communication “ping” to see if the target is still in a healthy state or as complicated as monitoring the code with an agent or debugger hooked up to the target device (see Figure 1).

Firgure 1. Fuzz testing. 

Vulnerabilities that fuzzing can catch

The new FDA standard offers the medical device field a chance to catch up with and address some of the vulnerabilities that fuzzing has found in other systems.

In 2019, for example, a new cybersecurity vulnerability called Urgent11 was discovered in a real-time operating system called VxWorks, which is widely used in embedded devices, including medical equipment, industrial control systems, and IoT devices. Urgent11 vulnerabilities are significant because they allow remote attackers to gain unauthorized access to vulnerable devices and potentially execute arbitrary code or launch malicious attacks. The flaws stem from a TCP/IP networking stack that is part of VxWorks and affect versions 6.5 and prior.

These types of vulnerabilities can be exploited by sending specially crafted packets to the targeted device, triggering a buffer overflow or other memory corruption issues. Once exploited, an attacker can potentially take control of the affected device, leading to severe consequences such as remote code execution, data theft, system disruption, or even compromised connected networks. The use of fuzz testing on significant software releases could help eliminate certain vulnerabilities that are hard to catch and prevent zero-day vulnerabilities. Urgent11 has raised awareness about the importance of timely security updates, vulnerability management, and risk assessment in the context of IoT and embedded devices.

Conclusion

The introduction of new guidance by the FDA emphasizing the use of fuzz testing in medical devices highlights the growing importance of cybersecurity in IoT and medical spaces. The implementation of fuzz testing and adherence to the new standard can significantly enhance the cybersecurity posture of medical devices. By proactively identifying and mitigating vulnerabilities, manufacturers can minimize the risk of unauthorized access, data breaches, system disruptions, and other potential threats.