Abstract:To reduce the development costs, IoT vendors tend to construct IoT kernels by customizing the Linux kernel. Code pruning is common in this customization process. However, due to the intrinsic complexity of the Linux kernel and the lack of long-term effective maintenance, IoT vendors may mistakenly delete necessary security operations in the pruning process, which leads to various bugs such as memory leakage and NULL pointer dereference. Yet detecting bugs caused by code pruning in IoT kernels is difficult. Specifically, (1) a significant structural change makes precisely locating the deleted security operations (DSO ) difficult, and (2) inferring the security impact of a DSO is not trivial since it requires complex semantic understanding, including the developing logic and the context of the corresponding IoT kernel. In this paper, we present CPscan, a system for automatically detecting bugs caused by code pruning in IoT kernels. First, using a new graph-based approach that iteratively conducts a structure-aware basic block matching, CPscan can precisely and efficiently identify theDSOs in IoT kernels. Then, CPscan infers the security impact of a DSO by comparing the bounded use chains (where and how a variable is used within potentially influenced code segments) of the security-critical variable associated with it. Specifically, CPscan reports the deletion of a security operation as vulnerable if the bounded use chain of the associated security-critical variable remains the same before and after the deletion. This is because the unchanged uses of a security-critical variable likely need the security operation, and removing it may have security impacts. The experimental results on 28 IoT kernels from 10 popular IoT vendors show that CPscan is able to identify 3,193DSO s and detect 114 new bugs with a reasonably low false-positive rate. Many such bugs tend to have a long latent period (up to 9 years and 5 months). We believe CPscan paves a way for eliminating the bugs introduced by code pruning in IoT kernels. We will open-source CPscan to facilitate further research.

Securing Operating Systems Through Fine-Grained Kernel Access Limitation for IoT Systems

Shrinking the Kernel Attack Surface Through Static and Dynamic Syscall Limitation

Edge-Centric Programming for IoT Applications with Automatic Code Partitioning

Dtee: A Declarative Approach to Secure IoT Applications Using TrustZone

EdgeProg: Edge-centric Programming for IoT Applications

EC: Embedded Systems Compartmentalization via Intra-Kernel Isolation

Identifying Privilege Separation Vulnerabilities in IoT Firmware with Symbolic Execution

Research on Technology of Embedded System Security Protection Component

Refined Characterization of Internet of Things Applications in Power Systems

CPscan: Detecting Bugs Caused by Code Pruning in IoT Kernels

One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware

argXtract: Deriving IoT Security Configurations via Automated Static Analysis of Stripped ARM Binaries

Security-Critical Energy-Aware Task Scheduling for Heterogeneous Real-Time MPSoCs in IoT

Method to Efficiently Protect Applications from Untrusted OS Kernel

A Survey of the Security Analysis of Embedded Devices

Secure Edge-Aided Computations for Social Internet-of-Things Systems

STEC-IoT: A Security Tactic by Virtualizing Edge Computing on IoT

FirmSolo: Enabling dynamic analysis of binary Linux-based IoT kernel modules

Reasoning about inter-procedural security requirements in IoT applications

A Secure and Fine-Grained Scheme for Data Security in Industrial IoT Platforms for Smart City

A Large-Scale Empirical Analysis of the Vulnerabilities Introduced by Third-Party Components in IoT Firmware