Presented at
32C3 (2015),
Dec. 29, 2015, 11:30 a.m.
(60 minutes).
Embedded systems are omnipresent in our everyday life and are becoming
increasingly present in many computing and networked environments. For example,
they are at the core of various Common-Off-The-Shelf (COTS) devices such as
printers, video surveillance systems, home routers and virtually anything we
informally call electronics. The emerging phenomenon of the Internet-of-Things
(IoT) will make them even more widespread and interconnected. Cisco famously
predicted that there will be 50 billion connected embedded devices by 2020.
Given those estimations, the heterogeneity of technology and application fields,
and the current threat landscape, the security of all those devices becomes of
paramount importance. In addition to this, manual security analysis does not
scale. Therefore, novel, scalable and automated approaches are needed.
In this talk, we present several methods that make *the large scale
security analyses of embedded devices* a feasible task. We implemented
those techniques in a scalable framework that we tested on real world data.
First, we collected a large number of firmware images from Internet
repositories and then performed simple static analysis.
Second, since embedded devices often expose web interfaces for
remote administration, therefore we developed techniques for large scale
static and dynamic analysis of such interfaces.
Finally, identifying and classifying the firmware files, as well as
fingerprinting and identifying embedded devices is difficult, especially
at large scale.
Using these techniques, we were able to discover a large number of new
vulnerabilities in dozens of firmware packages, affecting a great variety of vendors and
device classes. We were also able to achieve high accuracy in fingerprinting and
classification of both firmware images and live devices.
This material is both important and innovative because it addresses the
more and more pressing matter of securing/hacking the IoT, hence the
embedded devices themselves. Moreover, it's envisioned that the topic will
go in the next few years from important to critically important.
This material is definitely innovative because it will provide technical
aspects of security research by combining several interesting
research directions:
- non-x86 emulation (and the caveats)
- some aspects of static and dynamic analysis
- machine learning
- device fingerprinting
This material is significant because it will present the results, knowledge
and insights that resulted from three years of experimentation and work
using systematic, methodological and academic approaches.
Audience will be presented with technical knowledge, demos, insights, lessons
learned and open challenges.
Presenters:
-
Andrei Costin
Andrei received his PhD degree from EURECOM in the field of "Software security in embedded systems".
At present, Andrei is mostly busy developing cutting edge security research for embedded systems as part of his FIRMWARE.RE project.
Andrei is a Computer Science graduate of the Politehnica University of Bucharest where he did his thesis work in Biometrics and Image Processing. While starting out his IT-career in the Computer Games industry, he has worked in the Telecom field and also was a senior developer at a specialized firm programming various GSM/UMTS/GPS sub-systems.
He is the author of the MiFare Classic Universal toolKit (MFCUK), the first publicly available (FOSS) card-only key cracking tool for the MiFare Classic RFID card family and is known as the "printer guy" for his "Hacking MFPs" and "Hacking PostScript" series of hacks & talks at various international conferences. Lately, he was spotted security-harassing airplanes with ADS-B hacks (though no planes were harmed during the experiments) and remotely hacking fireworks/demolition/pyrotechnic systems (though no fireworks show were spoiled and no buildings were demolished). He is passionate about security in a holistic fashion.
Recently, Andrei received his PhD degree from EURECOM in the field of "Software security in embedded systems".
At present, Andrei is mostly busy developing cutting edge security research for embedded systems as part of his FIRMWARE.RE project.
Links:
Similar Presentations: