Abstract:The rapid expansion of the open-source community has shortened the software development cycle, but the spread of vulnerabilities has been accelerated, especially in the field of the Internet of Things. In recent years, the frequency of attacks against connected devices is increasing exponentially; thus, the vulnerabilities are more serious in nature. The state-of-the-art firmware security inspection technologies, such as methods based on machine learning and graph theory, find similar applications depending on the known vulnerabilities but cannot do anything without detailed information about the vulnerabilities. Moreover, model training, which is necessary for the machine learning technologies, requires a significant amount of time and data, resulting in low efficiency and poor extensibility. Aiming at the above shortcomings, a high-efficiency similarity analysis approach for firmware code is proposed in this study. First, the function control flow features and data flow features are extracted from the functions of the firmware and of the vulnerabilities, and the features are used to calculate the SimHash of the functions. The mass storage and fast query capabilities of the SimHash are implemented by the pigeonhole principle. Second, the similarity function pairs are analyzed in detail within and among the basic blocks. Within the basic blocks, the symbolic execution is used to generate the basic block semantic information, and the constraint solver is used to determine the semantic equivalence. Among the basic blocks, the local control flow graphs are analyzed to obtain their similarity. Then, we implemented a prototype and present the evaluation. The evaluation results demonstrate that the proposed approach can implement large-scale firmware function similarity analysis. It can also get the location of the real-world firmware patch without vulnerability function information. Finally, we compare our method with existing methods. The comparison results demonstrate that our method is more efficient and accurate than the Gemini and StagedMethod. More than 90% of the firmware functions can be indexed within 0.1 s, while the search time of 100,000 firmware functions is less than 2 s.

Large Scale Firmware Analysis For Open Source Components, Hard Coding and Weak Passwords

A Search-based Firmware Code Analysis Method for IoT Devices

A Large-Scale Empirical Analysis of the Vulnerabilities Introduced by Third-Party Components in IoT Firmware

Comprehensive IoT Firmware Characterization Based on a Large-Scale Firmware Dataset

One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware

Toward Hybrid Static-Dynamic Detection of Vulnerabilities in IoT Firmware

Detecting Authentication-Bypass Flaws in a Large Scale of IoT Embedded Web Servers.

Firmware Fuzzing: the State of the Art

An Empirical Study on the Insecurity of End-of-Life (eol) IoT Devices

Vulnerability Detection in IoT Firmware: A Survey

Towards Fine-grained Fingerprinting of Firmware in Online Embedded Devices.

Security Enhancement on Firmware for the Internet of Things

A Review of IoT Firmware Vulnerabilities and Auditing Techniques

Implementing a High-Efficiency Similarity Analysis Approach for Firmware Code

Enhancing IoT Security: A Full-System Simulation Dynamic Taint Analysis Framework for Firmware

Forensic analysis and security assessment of IoT camera firmware for smart homes

Staged Method of Code Similarity Analysis for Firmware Vulnerability Detection

FirmVEA: Vulnerability Discovery Optimisation for IoT Firmware via Version Evolution Analysis

FirmCVI: Taint Analysis-Based Component Version Identification Method for Large-Scale IoT Firmware

Identifying Privilege Separation Vulnerabilities in IoT Firmware with Symbolic Execution

Security Analysis of Vendor Customized Code in Firmware of Embedded Device.