Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces

Presented at Black Hat Asia 2016, Unknown date/time (Unknown duration).

Embedded devices are becoming more widespread, interconnected, and web-enabled than ever. However, recent studies showed that these devices are far from being secure. Moreover, many embedded systems rely on web interfaces for user interaction or administration. Unfortunately, web security is known to be difficult, and therefore the web interfaces of embedded systems represent a considerable attack surface. In this paper, we present the first fully automated framework that applies dynamic firmware analysis techniques to achieve, in a scalable manner, automated vulnerability discovery within embedded firmware images. We apply our framework to study the security of embedded web interfaces running in Commercial Off-The-Shelf (COTS) embedded devices, such as routers, DSL/cable modems, VoIP phones, IP/CCTV cameras. We introduce a methodology and implement a scalable framework for discovery of vulnerabilities in embedded web interfaces regardless of the vendor, device, or architecture. To achieve this goal, our framework performs full system emulation to achieve the execution of firmware images in a software-only environment, i.e., without involving any physical embedded devices. Then, we analyze the web interfaces within the firmware using both static and dynamic tools. We also present some interesting case studies, and discuss the main challenges associated with the dynamic analysis of firmware images and their web interfaces and network services. The observations we make in this paper shed light on an important aspect of embedded devices which was not previously studied at a large scale. Insights from this paper can help users, programmers and auditors in efficiently testing and securing their Internet-enabled embedded devices. We validate our framework by testing it on 1925 firmware images from 54 different vendors. We discover important vulnerabilities in 185 firmware images, affecting nearly a quarter of vendors in our dataset. We also perform comprehensive failure analysis. We show that by applying relatively easy fixes during corrective maintenance it is possible to remediate at least 61.3% of emulation failures and at least 25.2% of web interface launch failures. These experimental results demonstrate the effectiveness of our approach.


Presenters:

  • Andrei Costin - Firmware.RE
    Dr. Andrei Costin is a PhD graduate from EURECOM where he successfully defended his thesis on "Large Scale Security Analysis of Embedded Devices' Firmware." He is also a Computer Science graduate of the Politehnica University of Bucharest where he did his thesis work in Biometrics and Image Processing. While starting out his IT-career in the Computer Games industry, he has worked in the Telecom field and also was a senior developer at a specialized firm programming various GSM/UMTS/GPS sub-systems. He is the author of the MiFare Classic Universal toolKit (MFCUK), the first (and still only) publicly available FOSS card-only key cracking tool for the MiFare Classic RFID card family. He is also known as the "mister printer guy" for his "Hacking MFPs" and "Hacking PostScript" series of hacks & talks at various international conferences. Lately, he was spotted security-harassing airplanes with ADS-B hacks (though no planes were harmed during the experiments) and remotely hacking fireworks/demolition/pyrotechnic systems (though no fireworks shows were spoiled and no buildings were demolished). He is passionate about security in a holistic fashion. At present, he is busy developing cutting edge security research for embedded systems and firmwares as part of his FIRMWARE.RE project.

Links:

Similar Presentations: