Abstract:IoT devices are becoming popular. Meanwhile, researchers are actively working on improving the security of IoT devices. However, previous works ignore the insecurity caused by a special category of devices, i.e., the End-of-Life (EoL) devices. Once a product becomes End-of-Life, vendors tend to no longer maintain its firmware or software, including fixing bugs and patching vulnerabilities. This makes EoL devices susceptible to attacks. For instance, a report showed that an EoL model with thousands of active devices was exploited to redirect web traffic for malicious purposes. In this paper, we conduct the first empirical study to shed light on the (in)security of EoL devices. To this end, our study performs two types of analysis, including the liveness analysis and the vulnerability analysis . The first one aims to detect the scale of EoL devices that are still alive in the wild. The second one is to evaluate the vulnerabilities existing in (active) EoL devices. We applied our approach to a large number of EoL models from three vendors (i.e., D-Link, Tp-Link, and Netgear) and detect the alive devices in a time period of more than two years . Our study reveals some worrisome facts that were unknown by the community. For instance, there exist a large number (more than 3 million) of active EoL devices. Some devices (more than 1 million) are still alive even after five years since EoL. Furthermore, more than half of the vulnerabilities (182 of 294) are discovered after the EoL date. Although vendors may release security patches after the EoL date, the process is ad hoc and incomplete, with only limited functionality. Furthermore, these patches can have side effects, such as providing valuable information to attackers. In summary, more than 2 million active EoL devices are vulnerable, and nearly half of them are threatened by high-risk vulnerabilities. Attackers can achieve a minimum of 8.67 Tbps DDoS attack by exploiting OS command injection vulnerabilities and compromising a large number of active EoL devices. We believe these facts pose a clear call for more attention to deal with the security issues of EoL devices.

FirmVEA: Vulnerability Discovery Optimisation for IoT Firmware via Version Evolution Analysis

FirmCVI: Taint Analysis-Based Component Version Identification Method for Large-Scale IoT Firmware

A Large-Scale Empirical Analysis of the Vulnerabilities Introduced by Third-Party Components in IoT Firmware

Vulnerability Detection in IoT Firmware: A Survey

A Component Vulnerability Matching Approach for IoT Firmware.

Comprehensive IoT Firmware Characterization Based on a Large-Scale Firmware Dataset

An Empirical Study on the Insecurity of End-of-Life (eol) IoT Devices

AutoFirm: Automatically Identifying Reused Libraries inside IoT Firmware at Large-Scale

Detecting Authentication-Bypass Flaws in a Large Scale of IoT Embedded Web Servers.

One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware

A Search-based Firmware Code Analysis Method for IoT Devices

Faster and Better: Detecting Vulnerabilities in Linux-based IoT Firmware with Optimized Reaching Definition Analysis

Staged Method of Code Similarity Analysis for Firmware Vulnerability Detection

A lightweight IoT firmware vulnerability detection scheme based on homology detection

Toward Hybrid Static-Dynamic Detection of Vulnerabilities in IoT Firmware

Firmware Vulnerability Detection Algorithm Based on Matching Pattern-Specific Numerical Features With Structural Features

Large Scale Firmware Analysis For Open Source Components, Hard Coding and Weak Passwords

Firmware Fuzzing: the State of the Art

Enhancing IoT Security: A Full-System Simulation Dynamic Taint Analysis Framework for Firmware

Anatomist: Enhanced Firmware Vulnerability Discovery Based on Program State Abnormality Determination with Whole-System Replay

Identifying Privilege Separation Vulnerabilities in IoT Firmware with Symbolic Execution