Detecting Vulnerability on IoT Device Firmware: A Survey

Xiaotao Feng; Xiaogang Zhu; Qing-Long Han; Wei Zhou; Sheng Wen; Yang Xiang

doi:10.1109/JAS.2022.105860

Volume 10 Issue 1

Jan. 2023

IEEE/CAA Journal of Automatica Sinica

JCR Impact Factor: 15.3, Top 1 (SCI Q1)

CiteScore: 23.5, Top 2% (Q1)
Google Scholar h5-index: 77， TOP 5

Turn off MathJax

Article Contents

Article Navigation > IEEE/CAA Journal of Automatica Sinica > 2023 > 10(1): 25-41

X. T. Feng, X. G. Zhu, Q.-L. Han, W. Zhou, S. Wen, and Y. Xiang, “Detecting vulnerability on IoT device firmware: A survey,” IEEE/CAA J. Autom. Sinica, vol. 10, no. 1, pp. 25–41, Jan. 2023. doi: 10.1109/JAS.2022.105860

Citation:

X. T. Feng, X. G. Zhu, Q.-L. Han, W. Zhou, S. Wen, and Y. Xiang, “Detecting vulnerability on IoT device firmware: A survey,” IEEE/CAA J. Autom. Sinica, vol. 10, no. 1, pp. 25–41, Jan. 2023. doi: 10.1109/JAS.2022.105860

Citation:

PDF( 1753 KB)

Detecting Vulnerability on IoT Device Firmware: A Survey

doi: 10.1109/JAS.2022.105860

Xiaotao Feng^1
,,
Xiaogang Zhu^1
,,
Qing-Long Han^{1
,
,},
Wei Zhou^1
,,
Sheng Wen^1
,,
Yang Xiang^1
,

School of Science, Computing and Engineering Technologies, Swinburne University of Technology, Hawthorn VIC 3122, Australia

More Information

Author Bio:
Xiaotao Feng is a Ph.D. candidate of computer science and engineering at the Swinburne University of Technology, Australia. He received the B.Eng. degree in computer science and engineering from South-West University and Deakin University, Australia in 2018. He is working on the exploitation of security vulnerabilities at Swinburne University of Technology, Australia. His research interests include software testing and IoT firmware security. He has published one paper on ACM Conference on Computer and Communications Security (CCS) 2021 about detecting vulnerabilities in IoT firmware. He also published some papers on ACM ASIA Conference on Computer and Communications Security (ASIACCS) and top journals, such as IEEE Transactions on Dependable and Secure Computing (TDSC) as the second author

Xiaogang Zhu (Member, IEEE) received the Ph.D. degree in computer science and engineering at Swinburne University of Technology. He received the B.Eng. degree from Xidian University in 2012 and M.Eng degree from Xi’an Jiaotong University in 2015. Currently, he is a Research Fellow at Swinburne University of Technology, and focuses on searching vulnerabilities in programs. His research interests include detecting techniques such as fuzzing, machine learning and symbolic execution. He has published papers on top journals, such as IEEE Transactions on Dependable and Secure Computing (TDSC), and conferences such as ACM Conference on Computer and Communications Security (CCS), and IEEE/ACM International Conference on Software Engineering (ICSE)

Qing-Long Han (Fellow, IEEE) received the B.Sc. degree in mathematics from Shandong Normal University, in 1983, and the M.Sc. and Ph.D. degrees in control engineering from East China University of Science and Technology, in 1992 and 1997, respectively. Professor Han is Pro Vice-Chancellor (Research Quality) and a Distinguished Professor at Swinburne University of Technology, Australia. He held various academic and management positions at Griffith University and Central Queensland University, Australia. His research interests include networked control systems, multi-agent systems, time-delay systems, smart grids, unmanned surface vehicles, and neural networks. Professor Han was awarded the 2021 Norbert Wiener Award (the Highest Award in Systems Science and Engineering, and Cybernetics) and the 2021 M.A. Sargent Medal (the Highest Award of the Electrical College Board of Engineers Australia). He was the recipient of the 2021 IEEE/CAA Journal of Automatica Sinica Norbert Wiener Review Award, the 2020 IEEE Systems, Man, and Cybernetics (SMC) Society Andrew P. Sage Best Transactions Paper Award, the 2020 IEEE Transactions on Industrial Informatics Outstanding Paper Award, and the 2019 IEEE SMC Society Andrew P. Sage Best Transactions Paper Award. Professor Han is a Member of the Academia Europaea (the Academy of Europe). He is a Fellow of the International Federation of Automatic Control and a Fellow of the Institution of Engineers Australia. He is a Highly Cited Researcher in both Engineering and Computer Science (Clarivate Analytics). He has served as an AdCom Member of IEEE Industrial Electronics Society (IES), a Member of IEEE IES Fellows Committee, and Chair of IEEE IES Technical Committee on Networked Control Systems. He is Co-Editor-in-Chief of IEEE Transactions on Industrial Informatics, Deputy Editor-in-Chief of IEEE/CAA Journal of Automatica Sinica, Co-Editor of Australian Journal of Electrical and Electronic Engineering, an Associate Editor for 12 international journals, including the IEEE Transactions on Cybernetics, IEEE Industrial Electronics Magazine, Control Engineering Practice, and Information Sciences, and a Guest Editor for 14 Special Issues

Wei Zhou received the B.Eng. and M.Eng. degrees from Central South University, in 2005 and 2008, respectively, all in CS, and the Ph.D. degree from the School of Engineering and IT, University of New South Wales, Australia in 2016. She is now a Research Fellow at Swinburne University of Technology. Her research interests include computer networks, network security, and fingerprint biometric

Sheng Wen (Senior Member, IEEE) received the degree in computer science from the Central South University of China in 2012, and the Ph.D. degree from the School of Information Technology, Deakin University, Australia, in 2015. Since then, he has been a Lecturer with Deakin University, and then Associate Professor in Swinburne University of Technology, Australia. His research interests include modeling of virus spread, information dissemination, and defense strategies for the internet threats. He is also interested in the techniques of AI security and fuzzing on software. Since 2018, he is serving as the deputy director of Swinburne Cybersecurity Laboratory, Australia. He is also serving as the editors for several academic journals such as soft computing

Yang Xiang (Fellow, IEEE) received the Ph.D. in computer science from Deakin University, Australia. He is currently a Full Professor and the Dean of Digital Research, Swinburne University of Technology, Australia. His research interests include cyber security, which covers network and system security, data analytics, distributed systems, and networking. He is also leading the Blockchain initiatives at Swinburne. In the past 20 years, he has published more than 300 research papers in many international journals and conferences. He is the Editor-in-Chief of the Springer Briefs on Cyber Security Systems and Networks. He serves as the Associate Editor of IEEE Transactions on Dependable and Secure Computing, IEEE Internet of Things Journal, and ACM Computing Surveys. He served as the Associate Editor of IEEE Transactions on Computers and IEEE Transactions on Parallel and Distributed Systems. He is the Coordinator, Asia for IEEE Computer Society Technical Committee on Distributed Processing (TCDP)
Corresponding author: Qing-Long Han, e-mail: qhan@swin.edu.au
Received Date: 2022-05-28
Revised Date: 2022-07-01
Accepted Date: 2022-07-14

Available Online: 2022-08-23

Abstract

Abstract

Internet of things (IoT) devices make up 30% of all network-connected endpoints, introducing vulnerabilities and novel attacks that make many companies as primary targets for cybercriminals. To address this increasing threat surface, every organization deploying IoT devices needs to consider security risks to ensure those devices are secure and trusted. Among all the solutions for security risks, firmware security analysis is essential to fix software bugs, patch vulnerabilities, or add new security features to protect users of those vulnerable devices. However, firmware security analysis has never been an easy job due to the diversity of the execution environment and the close source of firmware. These two distinct features complicate the operations to unpack firmware samples for detailed analysis. They also make it difficult to create visual environments to emulate the running of device firmware. Although researchers have developed many novel methods to overcome various challenges in the past decade, critical barriers impede firmware security analysis in practice. Therefore, this survey is motivated to systematically review and analyze the research challenges and their solutions, considering both breadth and depth. Specifically, based on the analysis perspectives, various methods that perform security analysis on IoT devices are introduced and classified into four categories. The challenges in each category are discussed in detail, and potential solutions are proposed subsequently. We then discuss the flaws of these solutions and provide future directions for this research field. This survey can be utilized by a broad range of readers, including software developers, cyber security researchers, and software security engineers, to better understand firmware security analysis.
- Firmware emulation,
- internet of things (IoT) firmware,
- network fuzzing,
- security,
- static analysis

FullText(HTML)

References(116)

References

[1]	P. Gandhi, S. Khanna, and S. Ramaswamy, “Which industries are the most digital (and why)?” [Online]. Available: https://hbr.org/2016/04/a-chart-that-shows-which-industries-are-the-most-digital-and-why, Accessed on: Apr. 1, 2016.
[2]	K. Wiles, “First all-digital nuclear reactor system in the U.S. installed at Purdue University,” [Online]. Available: https://www.purdue.edu/newsroom/releases/2019/Q3/first-all-digital-nuclear-reactor-control-system-in-the-u.s.-installed-at-purdue-university.html, Accessed on: Jul. 8, 2019.
[3]	O. Friha, M. A. Ferrag, L. Shu, L. Maglaras, and X. C. Wang, “Internet of things for the future of smart agriculture: A comprehensive survey of emerging technologies,” IEEE/CAA J. Autom. Sinica, vol. 8, no. 4, pp. 718–752, Apr. 2021. doi: 10.1109/JAS.2021.1003925
[4]	M. A. Ferrag, L. Shu, and K. K. R. Choo, “Fighting COVID-19 and future pandemics with the internet of things: Security and privacy perspectives,” IEEE/CAA J. Autom. Sinica, vol. 8, no. 9, pp. 1477–1499, Sept. 2021. doi: 10.1109/JAS.2021.1004087
[5]	StatInvestor, “Internet of things-number of connected devices worldwide 2015–2025,” [Online]. Available: https://statinvestor.com/ata/33967/iot-number-of-connected-devices-worldwide/. Access on: Feb. 10, 2022.
[6]	C. Brook, “Travel routers, NAS devices among easily hacked IoT devices,” [Online]. Available: https://threatpost.com/travel-routers-nas-devices-among-easily-hacked-iot-devices/124877/, Accessed on: Apr. 10, 2017.
[7]	R. Ackerman Jr, “Lack of IoT security could undermine growth,” [Online]. Available: https://www.rsaconference.com/library/blog/lack-of-iot-security-could-undermine-growth, Accessed on: Jan. 20, 2021.
[8]	Keen Security Lab of Tencent, “Car hacking research: Remote attack tesla motors,” [Online]. Available: https://keenlab.tencent.com/en/2016/09/19/Keen-Security-Lab-of-Tencent-Car-Hacking-Research-Remote-Attack-to-Tesla-Cars/, Accessed on: Sept. 19, 2016.
[9]	C. Valasek and C. Miller, “Remote exploitation of an unaltered passenger vehicle,” [Online]. Available: https://ioactive.com/pdfs/IOActive_Remote_Car_Hacking.pdf. Access on: Sept. 11, 2021.
[10]	Johnk, “$20M in bounties paid and $100M in sight,” [Online]. Available: https://www.hackerone.com/ethical-hacker/20m-bounties-paid-and-100m-sight, Accessed on: Aug. 30, 2017.
[11]	CISO Mag, “Tesla offers US$1 Million and a car as bug bounty reward,” [Online]. Available: https://www.trustedsec.com/news/ciso-mag-tesla-offers-us1-million-and-a-car-as-bug-bounty-reward/, Accessed on: Jan. 13, 2020.
[12]	M. Fernando, R. I. Augusto, and M. Jemimah, “Mirai botnet exploit weaponized to attack IoT devices via CVE-2020-5902,” Security Intelligence Blog, Tech. Rep., [Online]. Available: https://www.trendmicro.com/en_us/research/20/g/mirai-botnet-attack-iot-devices-via-cve-2020-5902.html, Accessed on: Jul. 28, 2020.
[13]	Paloalto, “2020 unit 42 IoT threat report,” [Online]. Available: https://iotbusinessnews.com/download/white-papers/UNIT42-IoT-Threat-Report.pdf. Access on: Sept. 10, 2021.
[14]	J. Zhang, L. Pan, Q.-L. Han, C. Chen, S. Wen, and Y. Xiang, “Deep learning based attack detection for cyber-physical system cybersecurity: A survey,” IEEE/CAA J. Autom. Sinica, vol. 9, no. 3, pp. 377–391, Mar. 2022. doi: 10.1109/JAS.2021.1004261
[15]	Y. Miao, C. Chen, L. Pan, Q.-L. Han, J. Zhang, and Y. Xiang, “Machine learning-based cyber attacks targeting on controlled information: A survey,” ACM Comput. Surv., vol. 54, no. 7, p. 139, Sept. 2022.
[16]	G. J. Lin, S. Wen, Q.-L. Han, J. Zhang, and Y. Xiang, “Software vulnerability detection using deep neural networks: A survey,” Proc. IEEE, vol. 108, no. 10, pp. 1825–1848, Oct. 2020. doi: 10.1109/JPROC.2020.2993293
[17]	J. Y. Qiu, J. Zhang, W. Luo, L. Pan, S. Nepal, and Y. Xiang, “A survey of android malware detection with deep neural models,” ACM Comput. Surv., vol. 53, no. 6, p. 126, Nov. 2020.
[18]	N. Sun, J. Zhang, P. Rimba, S. Gao, L. Y. Zhang, and Y. Xiang, “Data-driven cybersecurity incident prediction: A survey,” IEEE Commun. Surv. Tutorials, vol. 21, no. 2, pp. 1744−1772, Dec. 2018.
[19]	D. Davidson, B. Moench, S. Jha, and T. Ristenpart, “FIE on firmware: Finding vulnerabilities in embedded systems using symbolic execution,” in Proc. 22nd USENIX Conf. Security, Washington, USA, 2013, pp. 463−478.
[20]	Y. David and E. Yahav, “Tracelet-based code search in executables,” in Proc. 35th ACM SIGPLAN Conf. Programming Language Design and Implementation, New York, USA, 2014, pp. 349−360.
[21]	Y. Shoshitaishvili, R. Y. Wang, C. Hauser, C. Kruegel, and G. Vigna, “Firmalice-automatic detection of authentication bypass vulnerabilities in binary firmware,” in Proc. 22nd Annu. Network and Distributed System Security Symp., San Diego, USA, 2015.
[22]	D. D. Chen, M. Woo, D. Brumley, and M. Egele, “Towards automated dynamic analysis for Linux-based embedded firmware,” in Proc. 23rd Annu. Network and Distributed System Security Symp., San Diego, USA, 2016.
[23]	Z. M. Jiang, J. J. Bai, K. J. Lu, and S. M. Hu, “Fuzzing error handling code using context-sensitive software fault injection,” in Proc. 29th USENIX Conf. Security Symp., USENIX Association, 2020, pp. 146.
[24]	F. Corno, L. De Russis, and J. Sáenz, “On the challenges novice programmers experience in developing IoT systems: A survey,” J. Syst. Softw., vol. 157, p. 110389, Nov. 2019. doi: 10.1016/j.jss.2019.07.101
[25]	A. Makhshari and A. Mesbah, “IoT bugs and development challenges,” in Proc. IEEE/ACM 43rd Int. Conf. Software Engineering, Madrid, Spain, 2021, pp. 460−472.
[26]	B. L. R. Stojkoska and K. V. Trivodaliev, “A review of internet of things for smart home: Challenges and solutions,” J. Cleaner Prod., vol. 140, pp. 1454–1464, Jan. 2017. doi: 10.1016/j.jclepro.2016.10.006
[27]	F. Corno, L. De Russis, and J. Sáenz, “How is open source software development different in popular IoT projects?” IEEE Access, vol. 8, pp. 28337–28348, Feb. 2020. doi: 10.1109/ACCESS.2020.2972364
[28]	M. Muench, J. Stijohann, F. Kargl, A. Francillon, and D. Balzarotti, “What you corrupt is not what you crash: Challenges in fuzzing embedded devices,” in Proc. 25th Annu. Network and Distributed System Security Symp., San Diego, USA, 2018.
[29]	O. Alrawi, C. Lever, M. Antonakakis, and F. Monrose, “Sok: Security evaluation of home-based IoT deployments,” in Proc. IEEE Symp. Security and Privacy (SP), San Francisco, USA, 2019, pp. 1362−1380.
[30]	C. Wright, W. A. Moeglein, S. Bagchi, M. Kulkarni, and A. A. Clements, “Challenges in firmware re-hosting, emulation, and analysis,” ACM Comput. Surv., vol. 54, no. 1, pp. 5, Jan. 2022.
[31]	A. Qasem, P. Shirani, M. Debbabi, L. Y. Wang, B. Lebel, and B. L. Agba, “Automatic vulnerability detection in embedded devices and firmware: Survey and layered taxonomies,” ACM Comput. Surv., vol. 54, no. 2, p. 25, Mar. 2022.
[32]	K. Arakadakis, P. Charalampidis, A. Makrogiannakis, and A. Fragkiadakis, “Firmware over-the-air programming techniques for IoT networks-a survey,” ACM Comput. Surv., vol. 54, no. 9, p. 178, Dec. 2022.
[33]	A. A. Clements, E. Gustafson, T. Scharnowski, P. Grosen, D. Fritz, C. Kruegel, G. Vigna, S. Bagchi, and M. Payer, “HALucinator: Firmware re-hosting through abstraction layer emulation,” in Proc. 29th USENIX Conf. Security Symp., USENIX Association, 2020, pp. 68.
[34]	B. Feng, A. Mera, and L. Lu, “P2IM: Scalable and hardware-independent firmware testing via automatic peripheral interface modeling,” in Proc. 29th USENIX Conf. Security Symp., USENIX Association, 2020, pp. 70.
[35]	X. G. Zhu, X. T. Feng, X. Z. Meng, S. Wen, S. Camtepe, Y. Xiang, and K. Ren, “CSI-Fuzz: Full-speed edge tracing using coverage sensitive instrumentation,” IEEE Trans. Dependable Secure Comput., vol. 19, no. 2, pp. 912–923, Mar.–Apr. 2022.
[36]	X. G. Zhu and M. Böhme, “Regression Greybox fuzzing,” in Proc. ACM SIGSAC Conf. Computer and Communications Security, New York, USA, 2021, pp. 2169−2182.
[37]	X. G. Zhu, S. Wen, S. Camtepe, and Y. Xiang, “Fuzzing: A survey for roadmap,” ACM Comput. Surv., to be published. DOI: 10.1145/3512345.
[38]	K. P. Zhang, X. Xiao, X. G. Zhu, R. X. Sun, M. H. Xue, and S. Wen, “Path transitions tell more: Optimizing fuzzing schedules via runtime program states,” in Proc. 44th Int. Conf. Software Engineering, Pittsburgh, PA, USA: IEEE, May 2022, pp. 1658−1668.
[39]	X. G. Zhu, X. T. Feng, T. Y. Jiao, S. Wen, Y. Xiang, S. Camtepe, and J. L. Xue, “A feature-oriented corpus for understanding, evaluating and improving fuzz testing,” in Proc. ACM Asia Conf. Computer and Communications Security, Auckland, New Zealand, May 2019, pp. 658−663.
[40]	V. J. M. Manès, H. S. Han, C. Han, S. K. Cha, M. Egele, E. J. Schwartz, and M. Woo, “The art, science, and engineering of fuzzing: A survey,” IEEE Trans. Softw. Eng., vol. 47, no. 11, pp. 2312–2331, Nov. 2021. doi: 10.1109/TSE.2019.2946563
[41]	S. Rawat, V. Jain, A. Kumar, L. Cojocar, C. Giuffrida, and H. Bos, “Vuzzer: Application-aware evolutionary fuzzing,” in Proc. 24th Annu. Network and Distributed System Security Symp., San Diego, USA, 2017.
[42]	G. Klees, A. Ruef, B. Cooper, S. Y. Wei, and M. Hicks, “Evaluating fuzz testing,” in Proc. ACM SIGSAC Conf. Computer and Communications Security, Toronto, Canada, 2018, pp. 2123−2138.
[43]	lcamtuf, “American fuzzy lop,” [Online]. Available: https://lcamtuf.coredump.cx/afl/.
[44]	C. Miller, “Fuzz by number – more data about fuzzing than you ever wanted to know,” [Online]. Available: https://www.ise.io/wp-content/uploads/2019/11/cmiller_cansecwest2008.pdf, Accessed on: Mar. 28, 2008.
[45]	C. Cadar, D. Dunbar, and D. Engler, “KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs,” in Proc. 8th USENIX Conf. Operating Systems Design and Implementation, San Diego, California, USA, 2008, pp. 209−224.
[46]	V. Chipounov, V. Kuznetsov, and G. Candea, “S2E: A platform for in-vivo multi-path analysis of software systems,” in Proc. 16th Int. Conf. Architectural Support for Programming Languages and Operating Systems, Newport Beach, USA, 2011, pp. 265−278.
[47]	F. Bellard, “QEMU, a fast and portable dynamic translator,” in Proc. USENIX Annu. Technical Conf., Anaheim, USA, 2005, pp. 41.
[48]	J. Feist, L. Mounier, and M. L. Potet, “Statically detecting use after free on binary code,” J. Comput. Virol. Hack. Techn., vol. 10, no. 3, pp. 211–217, 2014. doi: 10.1007/s11416-014-0203-1
[49]	J. J. Bai, Y. P. Wang, J. Yin, and S. M. Hu, “Testing error handling code in device drivers using characteristic fault injection,” in Proc. USENIX Annu. Technical Conf., Denver, USA, 2016, pp. 635−647.
[50]	P. Y. Liu, S. L. Ji, X. H. Zhang, Q. M. Dai, K. J. Lu, L. R. Fu, W. Z. Chen, P. Cheng, W. H. Wang, and R. Beyah, “IFIZZ: Deep-state and efficient fault-scenario generation to test IoT firmware,” in Proc. 36th IEEE/ACM Int. Conf. Automated Software Engineering, Melbourne, Australia, 2021, pp. 805−816.
[51]	A. Ruef and A. Dinaburg, “Static translation of x86 instruction semantics to LLVM with McSema,” [Online]. Available: https://infocondb.org/con/recon/recon-2014/static-translation-of-x86-instruction-semantics-to-llvm-with-mcsema. 2014.
[52]	Hex-Ray, “A powerful disassembler and a versatile debugger,” [Online]. Available: https://hex-rays.com/ida-pro/. Access on: Apr. 4, 2022.
[53]	OllyDbg, “OllyDbg is a 32-bit assembler level analysing debugger for Microsoft^® Windows^®,” [Online]. Available: https://www.ollydbg.de/. Access on: Jun. 20, 2022.
[54]	G. Hernandez, F. Fowze, D. Tian, T. Yavuz, and K. R. B. Butler, “FirmUSB: Vetting USB device firmware using domain informed symbolic execution,” in Proc. ACM SIGSAC Conf. Computer and Communications Security, Dallas, USA, 2017, pp. 2245–2262.
[55]	“lifting-bits/remill” [Online]. Available: https://github.com/lifting-bits/remill. 2018.
[56]	Angr, “Angr,” [Online]. Available: http://angr.io/. 2018.
[57]	M. J. Renzelmann, A. Kadav, and M. M. Swift, “SymDrive: Testing drivers without devices,” in Proc. 10th USENIX Symp. Operating Systems Design and Implementation, Hollywood, USA, 2012, pp. 279–292.
[58]	M. Kammerstetter, C. Platzer, and W. Kastner, “Prospect: Peripheral proxying supported embedded code testing,” in Proc. 9th ACM Symp. Information, Computer and Communications Security, Kyoto, Japan, 2014, pp. 329–340.
[59]	J. Zaddach, L. Bruno, A. Francillon, and D. Balzarotti, “Avatar: A framework to support dynamic security analysis of embedded systems’ firmwares,” in Proc. 21st Annu. Network and Distributed System Security Symp., San Diego, USA, 2014.
[60]	K. Koscher, T. Kohno, and D. Molnar, “SURROGATES: Enabling near-real-time dynamic analyses of embedded systems,” in Proc. 9th USENIX Conf. Offensive Technologies, Washington, USA, 2015, pp. 7.
[61]	A. Costin, A. Zarras, and A. Francillon, “Automated dynamic firmware analysis at scale: A case study on embedded web interfaces,” in Proc. 11th ACM Asia Conf. Computer and Communications Security, Xi’an, China, 2016, pp. 437–448.
[62]	M. Muench, D. Nisi, A. Francillon, and D. Balzarotti, “Avatar²: A multi-target orchestration platform,” in Proc. Workshop Binary Analysis Research, San Diego, USA, 2018.
[63]	E. Gustafson, M. Muench, C. Spensky, N. Redini, A. Machiry, Y. Fratantonio, D. Balzarotti, A. Francillon, Y. R. Choe, C. Kruegel, and G. Vigna, “Toward the analysis of embedded firmware through automated re-hosting,” in Proc. 22nd Int. Symp. Research in Attacks, Intrusions and Defenses, Beijing, China, 2019, pp. 135–150.
[64]	P. Srivastava, H. Peng, J. Li, H. Okhravi, H. Shrobe, and M. Payer, “FirmFuzz: Automated IoT firmware introspection and analysis,” in Proc. 2nd Int. ACM Workshop Security and Privacy for the Internet-of-Things, London, UK, 2019, pp. 15–21.
[65]	Y. W. Zheng, A. Davanian, H. Yin, C. Y. Song, H. S. Zhu, and L. M. Sun, “FIRM-AFL: High-throughput greybox fuzzing of IoT firmware via augmented process emulation,” in Proc. 28th USENIX Conf. Security Symp., Santa Clara, USA, 2019, pp. 1099–1114.
[66]	D. Song, F. Hetzelt, D. Das, C. Spensky, Y. Na, S. Volckaert, G. Vigna, C. Kruegel, J. P. Seifert, and M. Franz, “PeriScope: An effective probing and fuzzing framework for the hardware-OS boundary,” in Proc. 26th Annu. Network and Distributed System Security Symp., San Diego, USA, 2019.
[67]	C. Cao, L. Guan, J. Ming, and P. Liu, “Device-agnostic firmware execution is possible: A concolic execution approach for peripheral emulation,” in Proc. Annu. Computer Security Applications Conf., Austin, USA, 2020, pp. 746–759.
[68]	M. Kim, D. Kim, E. Kim, S. Kim, Y. Jang, and Y. Kim, “FirmAE: Towards large-scale emulation of IoT firmware for dynamic analysis,” in Proc. Annu. Computer Security Applications Conf., Austin, USA, 2020, pp. 733–745.
[69]	E. Johnson, M. Bland, Y. F. Zhu, J. Mason, S. Checkoway, S. Savage, and K. Levchenko, “Jetset: Targeted firmware rehosting for embedded systems,” in Proc. 30th USENIX Security Symp., USENIX Association, 2021, pp. 321–338.
[70]	M. H. Jiang, L. Ma, Y. J. Zhou, Q. Liu, C. Zhang, Z. Wang, X. P. Luo, L. Wu, and K. Ren, “ECMO: Peripheral transplantation to Rehost embedded Linux kernels,” in Proc. New York, USA, ACM SIGSAC Conf. Computer and Communications Security, New York, USA, 2021, pp. 734–748.
[71]	A. Mera, B. Feng, L. Lu, and E. Kirda, “DICE: Automatic emulation of DMA input channels for dynamic firmware analysis,” in Proc. New York, USA, IEEE Symp. Security and Privacy, San Francisco, USA, 2021, pp. 1938–1954.
[72]	W. Zhou, L. Guan, P. Liu, and Y. Q. Zhang, “Automatic firmware emulation through invalidity-guided knowledge inference,” in Proc. 30th USENIX Security Symp., USENIX Association, 2021, pp. 2007–2024.
[73]	S. Eschweiler, K. Yakdan, and E. Gerhards-Padilla, “DiscovRE: Efficient cross-architecture identification of bugs in binary code,” in Proc. 23rd Annu. Network and Distributed System Security Symp., San Diego, USA, 2016.
[74]	Q. Feng, R. D. Zhou, C. C. Xu, Y. Cheng, B. Testa, and H. Yin, “Scalable graph-based bug search for firmware images,” in Proc. ACM SIGSAC Conf. Computer and Communications Security, Vienna, Austria, 2016, pp. 480–491.
[75]	X. J. Xu, C. Liu, Q. Feng, H. Yin, L. Song, and D. Song, “Neural network-based graph embedding for cross-platform binary code similarity detection,” in Proc. ACM SIGSAC Conf. Computer and Communications Security, Dallas, USA, 2017, pp. 363–376.
[76]	J. Gao, X. Yang, Y. Fu, Y. Jiang, and J. G. Sun, “VulSeeker: A semantic learning based vulnerability seeker for cross-platform binary,” in Proc. 33rd IEEE/ACM Int. Conf. Automated Software Engineering, Montpellier, France, 2018, pp. 896–899.
[77]	Y. David, N. Partush, and E. Yahav, “FirmUp: Precise static detection of common vulnerabilities in firmware,” ACM SIGPLAN Notices, vol. 53, no. 2, pp. 392–404, Feb. 2018. doi: 10.1145/3296957.3177157
[78]	N. Redini, A. Machiry, R. Y. Wang, C. Spensky, A. Continella, Y. Shoshitaishvili, C. Kruegel, and G. Vigna, “Karonte: Detecting insecure multi-binary interactions in embedded firmware,” in Proc. IEEE Symp. Security and Privacy, San Francisco, USA, 2020, pp. 1544–1561.
[79]	L. R. Fu, S. L. Ji, K. J. Lu, P. Y. Liu, X. H. Zhang, Y. X. Duan, Z. H. Zhang, W. Z. Chen, and Y. J. Wu, “CPscan: Detecting bugs caused by code pruning in IoT kernels,” in Proc. ACM SIGSAC Conf. Computer and Communications Security, New York, USA, 2021, pp. 794–810.
[80]	L. B. Chen, Y. B. Wang, Q. P. Cai, Y. F. Zhan, H. Hu, J. Q. Linghu, Q. S. Hou, C. Zhang, H. Duan, and Z. Xue, “Sharing more and checking less: Leveraging common input keywords to detect bugs in embedded systems,” in Proc. 30th USENIX Security Symp., USENIX Association, 2021, pp. 303–319.
[81]	T. Kim, V. Kumar, J. Rhee, J. Z. Chen, K. Kim, C. H. Kim, D. Y. Xu, and D. Tian, “PASAN: Detecting peripheral access concurrency bugs within bare-metal embedded applications,” in Proc. 30th USENIX Security Symp., USENIX Association, 2021, pp. 249–266.
[82]	Z. Q. Wang, Y. Q. Zhang, and Q. X. Liu, “RPFuzzer: A framework for discovering router protocols vulnerabilities based on fuzzing,” KSII Trans. Internet Inf. Syst., vol. 7, no. 8, pp. 1989–2009, Aug. 2013. doi: 10.3837/tiis.2013.08.014
[83]	J. Pereyda, “Boofuzz: Network protocol fuzzing for humans,” [Online]. Available: https://boofuzz.readthedocs.io/en/stable/. Access on: Oct. 17, 2019.
[84]	J. Y. Chen, W. R. Diao, Q. C. Zhao, C. S. Zuo, Z. Q. Lin, X. F. Wang, W. C. Lau, M. H. Sun, R. H. Yang, and K. H. Zhang, “IoTFuzzer: Discovering memory corruptions in IoT through app-based fuzzing,” in Proc. 25th Annu. Network and Distributed System Security Symp., San Diego, USA, 2018.
[85]	Y. Zhang, W. Huo, K. P. Jian, J. Shi, H. L. Lu, L. Q. Liu, C. Wang, D. D. Sun, C. Zhang, and B. X. Liu, “SRFuzzer: An automatic fuzzing framework for physical SOHO router devices to discover multi-type vulnerabilities,” in Proc. 35th Annu. Computer Security Applications Conf., San Juan, USA, 2019, pp. 544–556.
[86]	N. Redini, A. Continella, D. Das, G. De Pasquale, N. Spahn, A. Machiry, A. Bianchi, C. Kruegel, and G. Vigna, “Diane: Identifying fuzzing triggers in apps to generate under-constrained inputs for IoT devices,” in Proc. IEEE Symp. Security and Privacy, San Francisco, USA, 2021, pp. 484–500.
[87]	X. T. Feng, R. X. Sun, X. G. Zhu, M. H. Xue, S. Wen, D. X. Liu, S. Nepal, and Y. Xiang, “Snipuzz: Black-box fuzzing of IoT firmware via message snippet inference,” in Proc. ACM SIGSAC Conf. Computer and Communications Security, New York, USA, 2021, pp. 337–350.
[88]	Y. Zhang, W. Huo, K. Jian, J. Shi, L. Q. Liu, Y. Y. Zou, C. Zhang, and B. X. Liu, “ESRFuzzer: An enhanced fuzzing framework for physical SOHO router devices to discover multi-type vulnerabilities,” Cybersecurity, vol. 4, no. 1, p. 24, 2021. doi: 10.1186/s42400-021-00091-9
[89]	T. Kamiya, S. Kusumoto, and K. Inoue, “CCfinder: A multilinguistic token-based code clone detection system for large scale source code,” IEEE Trans. Softw. Eng., vol. 28, no. 7, pp. 654–670, Jul. 2002. doi: 10.1109/TSE.2002.1019480
[90]	Z. Li, S. Lu, S. Myagmar, and Y. Zhou, “CP-miner: Finding copy-paste and related bugs in large-scale software code,” IEEE Trans. Softw. Eng., vol. 32, no. 3, pp. 176–192, Mar. 2006. doi: 10.1109/TSE.2006.28
[91]	L. X. Jiang, G. Misherghi, Z. D. Su, and S. Glondu, “DECKARD: Scalable and accurate tree-based detection of code clones,” in Proc. 29th Int. Conf. Software Engineering, Minneapolis, USA, 2007, pp. 96–105.
[92]	Evozi Team, “Droidsniff,” [Online]. Available: https://github.com/evozi/DroidSniff. Access on: Feb. 6, 2022.
[93]	Riccardo Ghetta and Juan Toledo, “EtherApe,” [Online]. Available: https://etherape.sourceforge.io/. Access on: Jun. 13, 2022.
[94]	NETRESEC AB, “NetworkMiner,” [Online]. Available: https://www.netresec.com/?page=NetworkMiner. Access on: Feb. 8, 2022.
[95]	S. Shah, “ARM-X firmware emulation framework,” [Online]. Available: https://firmwaresecurity.com/2019/10/23/arm-x-firmware-emulation-framework/, Accessed on: Oct. 23, 2019.
[96]	K. Cong, L. Lei, Z. K. Yang, and F. Xie, “Automatic fault injection for driver robustness testing,” in Proc. Int. Symp. Software Testing and Analysis, Baltimore, USA, 2015, pp. 361–372.
[97]	V. Kuznetsov, V. Chipounov, and G. Candea, “Testing closed-source binary device drivers with DDT,” in Proc. USENIX Conf. Annu. Technical Conf., Boston, USA, 2010, pp. 12.
[98]	M. Böhme, V. T. Pham, and A. Roychoudhury, “Coverage-based greybox fuzzing as Markov Chain,” IEEE Trans. Softw. Eng., vol. 45, no. 5, pp. 489–506, May 2019. doi: 10.1109/TSE.2017.2785841
[99]	C. Lemieux and K. Sen, “FairFuzz: A targeted mutation strategy for increasing Greybox fuzz testing coverage,” in Proc. 33rd IEEE/ACM Int. Conf. Automated Software Engineering, Montpellier, France, 2018, pp. 475–485.
[100]	N. Artenstein, “Broadpwn: Remotely compromising Android and iOS via a bug in Broadcom’s Wi-Fi chipsets,” [Online]. Available: https://www.blackhat.com/us-17/briefings/schedule/#broadpwn-remotely-compromising-android-and-ios-via-a-bug-in-broadcoms-wi-fi-chipsets-7603, Access on: Oct. 20, 2019.
[101]	F. Yamaguchi, A. Maier, H. Gascon, and K. Rieck, “Automatic inference of search patterns for taint-style vulnerabilities,” in Proc. IEEE Symp. Security and Privacy, San Jose, USA, 2015, pp. 797–812.
[102]	P. Shirani, L. Collard, B. L. Agba, B. Lebel, M. Debbabi, L. Y. Wang, and A. Hanna, “BINARM: Scalable and efficient detection of vulnerabilities in firmware images of intelligent electronic devices,” in Proc. 15th Int. Conf. Detection of Intrusions and Malware, and Vulnerability Assessment, Saclay, France, 2018, pp. 114–138.
[103]	J. Pewny, B. Garmany, R. Gawlik, C. Rossow, and T. Holz, “Cross-architecture bug search in binary executables,” in Proc. IEEE Symp. Security and Privacy, San Jose, USA, 2015, pp. 709–724.
[104]	J. Bromley, J. W. Bentz, L. Bottou, I. Guyon, Y. Lecun, C. Moore, E. Säckinger, and R. Shah, “Signature verification using a “Siamese” time delay neural network,” Int. J. Pattern Recognit. Artif. Intell., vol. 7, no. 4, pp. 669–688, Aug. 1993. doi: 10.1142/S0218001493000339
[105]	T. L. Wang, T. Wei, Z. Q. Lin, and W. Zou, “IntScope: Automatically detecting integer overflow vulnerability in X86 binary using symbolic execution,” in Proc. Network and Distributed System Security Symp., San Diego, USA, 2009.
[106]	P. Chen, Y. Wang, Z. Xin, B. Mao, and L. Xie, “BRICK: A binary tool for run-time detecting and locating integer-based vulnerability,” in Proc. 4th Int. Conf. Availability, Reliability and Security, Fukuoka, Japan, 2009, pp. 208–215.
[107]	M. Neugschwandtner, P. Milani Comparetti, I. Haller, and H. Bos, “The BORG: Nanoprobing binaries for buffer overreads,” in Proc. 5th ACM Conf. Data and Application Security and Privacy, San Antonio, USA, 2015, pp. 87–97.
[108]	S. Harit, “Breaking bad: Stealing patient data through medical devices,” 2017. [Online]. Available: https://www.blackhat.com/eu-17/briefings/schedule/#breaking-bad-stealing-patient-data-through-medical-devices-8578, Accessed on: Dec. 6, 2017.
[109]	M. R. Yan, J. H. Li, and G. Harpak, “Security research on Mercedes-Benz: From hardware to car control,” Aug. 2020. [Online]. Available: https://i.blackhat.com/USA-20/Thursday/us-20-Yan-Security-Research-On-Mercedes-Benz-From-Hardware-To-Car-Control.pdf. Access on: Oct. 20, 2019.
[110]	A. Cui, M. Costello, and S. J. Stolfo, “When firmware modifications attack: A case study of embedded exploitation,” in Proc. 20th Annu. Network and Distributed System Security Symp., San Diego, USA, 2013.
[111]	V. Kovah, “Finding new Bluetooth low energy exploits via reverse engineering multiple vendors’ firmwares,” [Online]. Available: https://i.blackhat.com/USA-20/Wednesday/us-20-Kovah-Finding-New-Bluetooth-Low-Energy-Exploits-Via-Reverse-Engineering-Multiple-Vendors-Firmwares.pdf. Access on: Feb. 3, 2022.
[112]	Smartthing developer. “Build connected IoT experiences for millions of SmartThings users,” [Online]. Available: https://smartthings.developer.samsung.com/. Access on: Sept. 10, 2021.
[113]	Philips developer. “The latest from Philips Hue,” [Online]. Available: https://www.philips-hue.com/en-us. Access on: Sept. 10, 2021.
[114]	N. Stephens, J. Grosen, C. Salls, A. Dutcher, R. Y. Wang, J. Corbetta, Y. Shoshitaishvili, C. Kruegel, and G. Vigna, “Driller: Augmenting fuzzing through selective symbolic execution,” in Proc. 23rd Annu. Network and Distributed System Security Symp., San Diego, USA, 2016.
[115]	M. Böhme, V. T. Pham, M. D. Nguyen, and A. Roychoudhury, “Directed Greybox fuzzing,” in Proc. ACM SIGSAC Conf. Computer and Communications Security, Dallas, USA, 2017, pp. 2329–2344.
[116]	H. X. Chen, Y. X. Xue, Y. K. Li, B. H. Chen, X. F. Xie, X. H. Wu, and Y. Liu, “Hawkeye: Towards a desired directed grey-box fuzzer,” in Proc. ACM SIGSAC Conf. Computer and Communications Security, Toronto, Canada, 2018, pp. 2095–2108.

Supplements(0)

Cited By

Proportional views

Proportional views

通讯作者: 陈斌, bchen63@163.com

1.
沈阳化工大学材料科学与工程学院沈阳 110142

Figures(2) / Tables(1)

Get Citation

PDF

XML

Article Metrics

Article views (3111) PDF downloads(625)

Highlights

We collect different techniques which are commonly used in existing vulnerability detection of IoT firmware
We propose a taxonomy which classifies vulnerability detection of IoT firmware into different categories by test perspectives. Moreover, we list challenges and corresponding solutions of different vulnerability detection categories
We discuss the limitations of existing vulnerability detections and the future directions for readers to follow

Detecting Vulnerability on IoT Device Firmware: A Survey

doi: 10.1109/JAS.2022.105860

Abstract

References

Proportional views

Catalog

通讯作者: 陈斌, bchen63@163.com

Article Metrics

Highlights

Export File

Citation

Format

Content