Towards Automated Dynamic Analysis for Linux-based Embedded Firmware

By Daming D. Chen, Maverick Woo, David Brumley, Manuel Egele. Network and Distributed System Security Symposium, 2016

445 citations recorded by the source corpus.

Commercial-off-the-shelf (COTS) network-enabled embedded devices are usually controlled by vendor firmware to perform integral functions in our daily lives. For example, wireless home routers are often the first and only line of defense that separates a home user’s personal computing and information devices from the Internet. Such a vital and privileged position in the user’s network requires that these devices operate securely. Unfortunately, recent research and anecdotal evidence suggest that such security assumptions are not at all upheld by the devices deployed around the world. A first step to assess the security of such embedded device firmware is the accurate identification of vulnerabilities. However, the market offers a large variety of these embedded devices, which severely impacts the scalability of existing approaches in this area. In this paper, we present FIRMADYNE, the first automated dynamic analysis system that specifically targets Linuxbased firmware on network-connected COTS devices in a scalable manner. We identify a series of challenges inherent to the dynamic analysis of COTS firmware, and discuss how our design decisions address them. At its core, FIRMADYNE relies on software-based full system emulation with an instrumented kernel to achieve the scalability necessary to analyze thousands of firmware binaries automatically. We evaluate FIRMADYNE on a real-world dataset of 23,035 firmware images across 42 device vendors gathered by our system. Using a sample of 74 exploits on the 9,486 firmware images that our system can successfully extract, we discover that 887 firmware images spanning at least 89 distinct products are vulnerable to one or more of the sampled exploit(s). This includes 14 previouslyunknown vulnerabilities that were discovered with the aid of our framework, which affect 69 firmware images spanning at least 12 distinct products. Furthermore, our results show that 11 of our tested attacks affect firmware images from more than one vendor, suggesting that code-sharing and common upstream manufacturers (OEMs) are quite prevalent. Note: This version has been corrected to eliminate false positives from SNMP exploit data discovered post-publication.

Subfields: Hardware and Architecture, Software

View Paper: https://www.semanticscholar.org/paper/158ebb18074ca6c40edfde16ee729b0970f003b5

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Hardware and Architecture

In Software

Citations in the corpus

C-FLAT: Control-Flow Attestation for Embedded Systems Software (2016, background): “Keywords remote attestation; control-flow attacks; embedded system security”
Fuzzing: A Survey for Roadmap (2022, background): “The emulators [34, 205] can execute programs, which originally run on IoT irmware, without the corresponding hardware.”
Cyber-physical systems security: Limitations, issues and future trends (2020, background): “According to current studies carried out by [160], [161], CPS is highly prone to malicious code injection attacks [162] and code-reuse attacks [163], along with fake data injection attacks [164], zero-control data attacks [165], and ﬁnally Control-Flow Attestation (C-FLAT) attacks [160].”
Scalable Graph-based Bug Search for Firmware Images (2016, methodology): “To address this critical problem, security researchers have been actively developing techniques to automatically analyze and detect vulnerabilities in IoT products [17,52,61].”
The Effect of IoT New Features on Security and Privacy: New Threats, Existing Solutions, and Challenges Yet to Be Solved (2018, methodology): “[32] presented a framework for largescale automated firmware dynamic analysis, but it is only applicable to the Linux-based system.”