FirmCVI: Taint Analysis-Based Component Version Identification Method for Large-Scale IoT Firmware

Ying Zhang,Bo Yu

DOI: https://doi.org/10.1109/icpads60453.2023.00137

2023-01-01

Abstract:In recent years, numerous attacks on IoT device firmware caused by component vulnerabilities have occurred, they has attracted a great deal of attention from security researchers. Thus, identifying the component and version information in IoT device firmware is of great significance for conducting large-scale IoT device firmware vulnerability correlation analysis, security risk assessment and emergency response of the IoT. Existing methods may not dig deeper into the features of version information, resulting in missing recognition information, leading to insufficient recognition accuracy. Alternatively, existing methods rely on features such as CFG, which makes it difficult to accurately match components between different versions, leading to recognition errors. For these reasons, in this paper, we propose a taint analysis-based version identification method for IoT firmware components. Firstly, we use the feature information extracted from the binary file as the source point for taint analysis, then we perform reverse flow analysis based on the data flow of function calls, and then we find the memory address of the version information as the sink to identify the version information of the component. To evaluate our approach, we collected 312,330 firmware components from 10161 real firmware from 11 different vendors covering various architectures such as MIPS, ARM, X86, and PowerPC and various operating systems such as Linux and FreeBSD (32/64 bit). The experiments demonstrate that the FirmCVI does not require manually building a large-scale database, and achieves an average identification accuracy of up to 96.07% for IoT device firmware component versions, false positives within 5%. And the average time taken to identify component versions is about 0.19 seconds, which is 10 times more efficient than existing version identification tools. It provides powerful data and technical support for IOT device firmware vulnerability correlation analysis.