Hardcoded vulnerability detection approach for IoT device firmware

Chao MU; Xin WANG; Ming YANG; Heng ZHANG; Zhenya CHEN; Xiaoming WU

doi:10.11959/j.issn.2096-109x.2022070

您当前的位置：

首页 >

文章列表页 >

Hardcoded vulnerability detection approach for IoT device firmware

Papers | 更新时间：2024-06-03

- Hardcoded vulnerability detection approach for IoT device firmware
- Chinese Journal of Network and Information Security Vol. 8, Issue 5, Pages: 98-110(2022)
- 作者机构：
  
  1. 齐鲁工业大学（山东省科学院）山东省计算中心（国家超级计算济南中心）山东省计算机网络重点实验室，山东济南 250014
  2. 江苏海洋大学计算机工程学院，江苏连云港 222005
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2022070
  CLC： TP393
- Online First：2022-10，
  
  Published：15 October 2022
- 稿件说明：
移动端阅览
Chao MU, Xin WANG, Ming YANG, et al. Hardcoded vulnerability detection approach for IoT device firmware[J]. Chinese Journal of Network and Information Security, 2022, 8(5): 98-110.
DOI：

Chao MU, Xin WANG, Ming YANG, et al. Hardcoded vulnerability detection approach for IoT device firmware[J]. Chinese Journal of Network and Information Security, 2022, 8(5): 98-110. DOI： 10.11959/j.issn.2096-109x.2022070.

摘要

随着物联网设备的普及，越来越多有价值的数据产生，依托物联网设备进行大数据分析和挖掘是近年来学术界和工业界关注的热点问题。然而，由于缺乏必要的检测和防护手段，很多物联网设备存在严重的信息安全隐患。特别地，设备硬编码信息与系统加解密、身份认证等功能密切相关，可为核心数据提供机密性保障，一旦被恶意攻击者利用，会产生敏感信息泄露、后门攻击、非授权登录等严重后果。针对该问题，在研究物联网设备中硬编码漏洞表现特征的基础上，提出了一种可执行文件中多类型字符识别定位和硬编码漏洞检测方法。首先，提取固件内容并筛选所有可执行文件作为待分析源，提出特殊格式字符、外部文件引用、密码实现3类硬编码字符的识别与定位；然后，根据函数调用关系对硬编码字符所在函数进行可达性分析，采用中间表示 IR 模型消除指令异构性，并利用数据流分析方法确定字符型和参数型硬编码值；最后，设计符号执行方法确定硬编码漏洞的触发条件，最终输出漏洞检测结果。一方面，所提方法在利用中间表示模型的基础上引入了符号执行的方法，消除了指令架构依赖性，减少了漏洞误报率；另一方面，该方法可融合字符、文件、密码实现 3 类硬编码字符的不同特征表现，增加了漏洞检测的覆盖范围，提升了检测方法的通用性。实验结果表明，所提方法可有效检测多种物联网设备中的字符、文件、密码3类硬编码漏洞，具有较好的检测精度，可为后续安全防护技术的部署提供一定指导。

Abstract

With the popularization of IoT devices

more and more valuable data is generated.Analyzing and mining big data based on IoT devices has become a hot topic in the academic and industrial circles in recent years.However

due to the lack of necessary detection and protection methods

many IoT devices have serious information security risks.In particular

device hard-coded information is closely related to system encryption and decryption

identity authentication and other functions

which can provide confidentiality protection for core data.Once this information is exploited by malicious attackers

serious consequences such as sensitive information leakage

backdoor attacks

and unauthorized logins will occur.In response to this problem

a multi-type character recognition and positioning scheme was designed and a hard-coded vulnerability detection method in executable files was proposed based on the study of the characteristics of hard-coded vulnerabilities in IoT devices.The proposed method extracted the firmware of IoT devices and filtered all executable files as the source to be analyzed.Then

a solution to identify and locate three types of hard-coded characters was provided.Further

the reachability of the function

where the hard-coded character was located

was analyzed according to the function call relationship.Meanwhile

the instruction heterogeneity was mitigated by an intermediate representation (IR) model.The character and parameter hard-coded values was obtained through a data flow analysis approach.A symbolic execution method was devised to determine the trigger conditions of the hard-coded vulnerabilities

and then the vulnerability detection result was output.On the one hand

the proposed method introduced the method of symbolic execution based on the use of the intermediate representation model

which eliminated the dependency of instruction architecture and reduces the false positive rate of vulnerabilities; On the other hand

this method can integrate characters

files

and cryptographic implementation to realize the different characteristics of three types of hard-coded characters

which increased the coverage of vulnerability detection and improves the versatility of the detection method.The experimental results show that the proposed method can effectively detect three types of hard-coded vulnerabilities of characters

files and cryptographic implementation in various IoT devices

and has good detection accuracy

which can provide certain guidance for the deployment of subsequent security protection technologies.

关键词

Keywords

references

王鑫 . 面向分布式计算的隐私保护研究 [D ] . 浙江:浙江大学 , 2020 .

WANG X . Research on privacy protection for distributed compu-ting [D ] . Zhejiang:Zhejiang University , 2020 .

BURSZTEIN E , COCHRAN G J , DURUMERIC C Z , et al . Understanding the Mirai Botnet [C ] // USENIX Security Symposium . 2017 .

杨毅宇 , 周威 , 赵尚儒 , 等 . 物联网安全研究综述:威胁,检测与防御 [J ] . 通信学报 , 2021 , 42 ( 8 ): 188 - 205 .

YANG Y Y , ZHOU W , ZHAO S R , et al . Survey of IoT security re-search:threats,detection and defense [J ] . Journal on Communica-tions , 2021 , 42 ( 8 ): 188 - 205 .

张玉清 , 周威 , 彭安妮 . 物联网安全综述 [J ] . 计算机研究与发展 , 2017 , 54 ( 10 ): 2130 .

ZHANG Y , ZHOU W , PENG A N . Survey of internet of things se-curity [J ] . Journal of Computer Research and Development , 2017 , 54 ( 10 ): 2130 - 2143 .

郑尧文 , 文辉 , 程凯 , 等 . 物联网设备漏洞挖掘技术研究综述 [J ] . 信息安全学报 , 2019 , 4 ( 5 ): 61 - 75 .

ZHENG Y W , WEN H , CHENG K , et al . A survey of IoT device vulnerability mining techniques [J ] . Journal of Cyber Security , 2019 , 4 ( 5 ): 61 - 75 .

CAO X H , SHILA D M , CHENG Y , et al . Ghost-in-zigbee:Energy depletion attack on zigbee-based wireless networks [J ] . IEEE Internet of Things Journal , 2016 , 3 ( 5 ): 816 - 829 .

WEN H , CHEN Q A , LIN Z . Plug-N-Pwned:comprehensive vulnerability analysis of OBD-II dongles as a new over-the-air attack surface in automotive IoT [C ] // USENIX Security Symposium . 2020 : 949 - 965 .

CHEN J Y , ZUO C S , DIAO W R , et al . Your IoTs are (not) mine:on the remote binding between IoT devices and users [C ] // 2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks . 2019 : 222 - 233 .

HE W , GOLLA M , PADHI R , et al . Rethinking access control and authentication for the home Internet of things (IoT) [C ] // USENIX Security Symposium . 2018 : 255 - 272 .

YUAN B , JIA Y , XING L , et al . Shattered chain of trust:understanding security risks in cross-cloud IoT access delegation [C ] // USENIX Security Symposium . 2020 : 1183 - 1200 .

FERNANDES E , RAHMATI A , JUNG J , et al . Decentralized action integrity for trigger-action IoT platforms [C ] // Proceedings 2018 Network and Distributed System Security Symposium . 2018 : 1 - 16 .

ZHANG L , CHEN J , DIAO W , et al . {CryptoREX}:large-scale analysis of cryptographic misuse in {IoT} Devices [C ] // 22nd International Symposium on Research in Attacks,Intrusions and Defenses (RAID 2019) . 2019 : 151 - 164 .

ALMAKHDHUB N S , CLEMENTS A A , BAGCHI S , et al . μRAI:securing embedded systems with return address integrity [C ] // Proceedings 2020 Network and Distributed System Security Symposium . 2020 : 1 - 18 .

YAO Y , ZHOU W , JIA Y , et al . Identifying privilege separation vulnerabilities in IoT firmware with symbolic execution [C ] // European Symposium on Research in Computer Security . 2019 : 638 - 657 .

ZHOU J , DU Y , SHEN Z , et al . Silhouette:efficient protected shadow stacks for embedded systems [C ] // USENIX Security Symposium . 2020 : 1219 - 1236 .

MU C , YANG M , CHEN Z , et al . Research on RSA padding identification method in IoT firmwares [C ] // Journal of Physics:Conference Series . 2020 :012061.

Vulnerabilities in foscam IP cameras report [R ] .

THOMAS S L , CHOTHIA T , GARCIA F D . Stringer:measuring the importance of static data comparisons to detect backdoors and undocumented functionality [C ] // European Symposium on Research in Computer Security . 2017 : 513 - 531 .

SHOSHITAISHVILI Y , WANG R , HAUSER C , et al . Firmaliceautomatic detection of authentication bypass vulnerabilities in binary firmware [C ] // NDSS . 2015 : 1 - 8 .

WANG F , SHOSHITAISHVILI Y . Angr-the next generation of binary analysis [C ] // 2017 IEEE Cybersecurity Development (SecDev) . 2017 : 8 - 9 .

ZHENG Y , DAVANIAN A , YIN H , et al . FIRM-AFL:greybox fuzzing of IoT firmware via augmented process emulation [C ] // 28th USENIX Security Symposium (USENIX Security 19) . 2019 : 1099 - 1114 .

ZADDACH J , BRUNO L , FRANCILLON A , et al . AVATAR:A framework to support dynamic security analysis of embedded systems' firmwares [C ] // NDSS . 2014 : 1 - 16 .

CHEN J Y , DIAO W R , ZHAO Q C , et al . IoTFuzzer:discovering memory corruptions in IoT through app-based fuzzing [C ] // Proceedings 2018 Network and Distributed System Security Symposium . 2018 : 1 - 15 .

REDINI N , MACHIRY A , WANG R , et al . Karonte:detecting insecure multi-binary interactions in embedded firmware [C ] // 2020 IEEE Symposium on Security and Privacy . 2020 : 1544 - 1561 .

CHEN L , WANG Y , CAI Q , et al . Sharing more and checking less:Leveraging common input keywords to detect bugs in embedded systems [C ] // 30th USENIX Security Symposium (USENIX Security 21) . 2021 : 303 - 319 .

MU C , WANG X , YANG M , et al . Vulnerability analysis for iot devices of multi-agent systems:a cryptographic function identification approach [C ] // Proceedings of 2021 5th Chinese Conference on Swarm Intelligence and Cooperative Control . 2023 : 1510 - 1519 .

DAVIDSON D , MOENCH B , RISTENPART T , et al . {FIE} on firmware:Finding vulnerabilities in embedded systems using symbolic execution [C ] // 22nd USENIX Security Symposium (USENIX Security 13) . 2013 : 463 - 478 .

NETHERCOTE N , SEWARD J . Valgrind:a framework for heavyweight dynamic binary instrumentation [J ] . ACM Sigplan Notices , 2007 , 42 ( 6 ): 89 - 100 .

DUONG T , RIZZO J . Here come the⊕ninjas [J ] . Unpublished manuscript , 2011 ,320.

CHEN D D , EGELE M , WOO M , et al . Towards automated dynamic analysis for linux-based embedded firmware [C ] // Pro- ceedings 2016 Network and Distributed System Security Symposium . 2016 : 1 - 16 .

Views

537

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research progress on detection of software vulnerabilities based on code similarity

Scenario-aware access control model

Deep learning vulnerability detection method based on optimized inter-procedural semantics of programs

Network security of the National Natural Science Foundation of China: today and prospects

Access control relationship prediction method based on GNN dual source learning

Related Author

DONG Weiyu

TANG Yonghe

LIU Chunling

LI Qinghao

Aodi LIU

Na WANG

Wenjuan WANG

Xuehui DU

Related Institution

Information Engineering University

School of Computer Science and Engineering, Huazhong University of Science and Technology

School of Cyber Science and Engineering, Huazhong University of Science and Technology

Hubei Key Laboratory of Distributed System Security

Services Computing Technology and System Lab, National Engineering Research Center for Big Data Technology

⁰