Hard-coded backdoor detection method based on semantic conflict

Anxiang HU; Da XIAO; Shichen GUO; Shengli LIU

doi:10.11959/j.issn.2096-109x.2023015

您当前的位置：

首页 >

文章列表页 >

Hard-coded backdoor detection method based on semantic conflict

Papers | 更新时间：2024-06-03

- Hard-coded backdoor detection method based on semantic conflict
- Chinese Journal of Network and Information Security Vol. 9, Issue 1, Pages: 150-157(2023)
- 作者机构：
  
  1. 数学工程与先进计算国家重点实验室，河南郑州 450001
  2. 郑州工业应用技术学院信息工程学院，河南郑州 451100
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2023015
  CLC： TP393
- Online First：2023-02，
  
  Published：25 February 2023
- 稿件说明：
移动端阅览
Anxiang HU, Da XIAO, Shichen GUO, et al. Hard-coded backdoor detection method based on semantic conflict[J]. Chinese Journal of Network and Information Security, 2023, 9(1): 150-157.
DOI：

Anxiang HU, Da XIAO, Shichen GUO, et al. Hard-coded backdoor detection method based on semantic conflict[J]. Chinese Journal of Network and Information Security, 2023, 9(1): 150-157. DOI： 10.11959/j.issn.2096-109x.2023015.

摘要

路由器安全问题主要聚焦于内存型漏洞的挖掘与利用，对后门的检测与发现的研究较少。硬编码后门是较常见的后门之一，设置简单方便，仅仅需要少量代码就能实现，然而却难以被发现，往往造成严重的危害和损失。硬编码后门的触发过程离不开字符串比较函数，因此硬编码后门的检测借助于字符串比较函数，主要分为静态分析方法和符号执行方法。前者自动化程度较高，但存在较高的误报率，检测效果不佳；后者准确率高，但无法自动化大规模检测固件，面临着路径爆炸甚至无法约束求解的问题。针对上述问题，在静态分析的基础上，结合污点分析的思想，提出了基于语义冲突的硬编码后门检测方法——Stect。Stect从常用的字符串比较函数出发，结合MIPS和ARM体系结构的特点，利用函数调用关系、控制流图和分支选择依赖的字符串，提取出具有相同起点和终点的路径集合，如果验证成功的路径集合中的字符串具有语义冲突，则判定路由器固件中存在硬编码后门。为了评估 Stect 对路由器硬编码后门的检测效果，对收集的1 074个设备固件进行了测试，并与其他的后门检测方法进行了对比。实验结果表明，相比现有的后门检测方法Costin和Stringer，Stect具有更好的检测效果：从数据集中成功检测出8个固件后门口令，召回率达到88.89%。

Abstract

The current router security issues focus on the mining and utilization of memory-type vulnerabilities

but there is low interest in detecting backdoors.Hard-coded backdoor is one of the most common backdoors

which is simple and convenient to set up and can be implemented with only a small amount of code.However

it is difficult to be discovered and often causes serious safety hazard and economic loss.The triggering process of hard-coded backdoor is inseparable from string comparison functions.Therefore

the detection of hard-coded backdoors relies on string comparison functions

which are mainly divided into static analysis method and symbolic execution method.The former has a high degree of automation

but has a high false positive rate and poor detection results.The latter has a high accuracy rate

but cannot automate large-scale detection of firmware

and faces the problem of path explosion or even unable to constrain solution.Aiming at the above problems

a hard-coded backdoor detection algorithm based on string text semantic conflict (Stect) was proposed since static analysis and the think of stain analysis.Stect started from the commonly used string comparison functions

combined with the characteristics of MIPS and ARM architectures

and extracted a set of paths with the same start and end nodes using function call relationships

control flow graphs

and branching selection dependent strings.If the strings in the successfully verified set of paths have semantic conflict

it means that there is a hard-coded backdoor in the router firmware.In order to evaluate the detection effect of Stect

1 074 collected device images were tested and compared with other backdoor detection methods.Experimental results show that Stect has a better detection effect compared with existing backdoor detection methods including Costin and Stringer: 8 hard-coded backdoor images detected from image data set

and the recall rate reached 88.89%.

关键词

Keywords

references

PAGANINI P . Netgear,Linksys and many other wireless routers have a backdoor security affairs [EB ] .

张雄 , 李舟军 . 模糊测试技术研究综述 [J ] . 计算机科学 , 2016 , 43 ( 5 ): 1 - 26 .

ZHANG X , LI Z J . Survey of fuzz testing technology [J ] . Computer Science , 2016 , 43 ( 5 ): 1 - 26 .

SZOR P . The art of computer virus research and defense [J ] . Choice Reviews Online , 2005 , 43 ( 3 ): 15 - 16 .

HEFFNER C . Reverse engineering a d-link backdoor [EB ] .

忽朝俭 , 薛一波 , 赵粮 , 等 . 无文件系统嵌入式固件后门检测 [J ] . 通信学报 , 2013 , 34 ( 8 ): 140 - 145 .

HU C J , XUE Y B , ZHAO L , et al . Backdoor detection in embedded system firmware without file system [J ] . Journal on Communications , 2013 , 34 ( 8 ): 140 - 145 .

COSTIN A , ZADDACH J , FRANCILLON A , et al . A large scale analysis of the security of embedded firmwares [C ] // Proceedings of the 23rd USENIX Security Symposium . 2014 : 95 - 110 .

THOMAS S L , CHOTHIA T , GARCIA F D . Stringer:measuring the importance of static data comparisons to detect backdoors and undocumented functionality [M ] // Lecture Notes in Computer Science (Including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) . 2017 .

SHOSHITAISHVILI Y , WANG R , HAUSER C , et al . Firmaliceautomatic detection of authentication bypass vulnerabilities in binary firmware [C ] // Proceedings 2015 Network and Distributed System Security Symposium . 2015 : 8 - 11 .

ZYXEL NETWORKS . Zyxel security advisory for hardcoded credential vulnerability | Zyxel [EB ] .

MUENCH M , STIJOHANN J , KARGL F , et al . What you corrupt is not what you crash:Challenges in fuzzing embedded devices [C ] // Network and Distributed System Security Symposium . 2018 .

CHEN D D , EGELE M , WOO M , et al . Towards automated dynamic analysis for Linux-based embedded firmware [C ] // Proceedings of Network and Distributed System Security Sumposium . 2016 .

HEFFNER C . Binwalk:Firmware analysis tool [R ] . 2010 .

HEMEL A , KALLEBERG K T , VERMAAS R , et al . Finding software license violations through binary code clone detection [J ] . Proceedings-International Conference on Software Engineering , 2011 : 63 - 72 .

EAGLE C . IDA Pro [R ] . 2012 .

SHOSHITAISHVILI Y , WANG R , SALLS C , et al . SOK:(state of) the art of war:Offensive techniques in binary analysis [C ] // 2016 IEEE Symposium on Security and Privacy (SP) . 2016 : 138 - 157 .

Views

457

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

No data

Related Author

No data

Related Institution

No data

⁰