An automated security detection method for print service systems and devices

Abstract

The application belongs to the technical field of vulnerability detection, and discloses an automatic security detection method for a printing service system and equipment, which comprises the following steps: unpacking the firmware of a printer device; analyzing a file system obtained after unpacking the firmware, and locating boundary binaries therein; performing static analysis on the obtained boundary binaries, and discovering dangerous control flows related to device configuration operation; performing path exploration and constraint solving on the discovered dangerous control flows by using a symbolic execution technique; verifying whether a vulnerability satisfies a triggering condition by using a taint analysis; and finally giving an alarm.

Description

Technical Field

[0001] This invention belongs to the technical field of vulnerability detection, specifically relating to an automated security detection method for printing service systems and devices. Background Technology

[0002] As remote work becomes increasingly prevalent, traditional printers are gradually being replaced by network printers. The characteristics of network printers—carrying large amounts of sensitive data and having open network service ports—make them highly valuable targets for attackers. Printers with security vulnerabilities can suffer from attacks such as denial-of-service attacks, print job control, information leakage, and arbitrary code execution. However, security research on printers has not received sufficient attention, and there are still no automated security analysis methods specifically for print services.

[0003] To this end, this invention designs and implements an automated security detection method for printing service systems and devices, which can automatically detect security issues in printer device firmware. Summary of the Invention

[0004] This invention provides an automated security detection method for printing service systems and devices, which can effectively detect buffer overflow and command injection vulnerabilities in the firmware of embedded systems such as printers, thereby improving security.

[0005] This invention can be achieved through the following technical solutions:

[0006] An automated security detection method for print service systems and equipment includes the following steps:

[0007] S1, unpack the firmware of the printer device;

[0008] S2 analyzes the file system obtained after unpacking the firmware and locates the boundary binary;

[0009] S3. Static analysis is performed on the obtained boundary binary to identify dangerous control flows related to device configuration operations.

[0010] S4 uses symbolic execution techniques to explore paths and solve constraints for the discovered dangerous control flows, verifies whether the vulnerability meets the triggering conditions through taint analysis, and finally issues an alert.

[0011] Furthermore, the function that stores the device configuration data obtained from network communication data packets is defined as the configuration setting function `config_setter`, and the function that searches for and reads previously stored device configuration data is defined as the configuration reading function `config_getter`.

[0012] A function list containing source, sink, config_setter, and config_getter functions is established. Based on the function call graph, using static analysis, starting from the source function that receives external data, the function call path containing the sink function is searched. During the process, the control flow from the source function to the config_setter function and from the config_getter function to the sink function is spliced ​​together, thereby identifying the control flow related to device configuration operations in the boundary binary as the dangerous control flow.

[0013] Furthermore, if the parameter of the sink function is a constant string, the value of the register corresponding to the parameter of the sink function is calculated using the member function getRegisterValue in the SymbolicPropogator class of the Ghidra software analysis tool. If it does, the control flow of the sink function is determined to be a dangerous control flow.

[0014] Furthermore, for dangerous control flows, a virtual node containing config_setter and config_getter function calls is created to connect the two control flows that are interrupted by the data sharing operation. Then, dynamic symbolic execution technology is used for path exploration and constraint solving.

[0015] Furthermore, dynamic symbolic execution technology based on the Angr framework is adopted. When exploring the path, the program is divided into basic blocks. In the initial state, the ip register is set to the address of the first basic block of the function where the source call point is located in the dangerous control flow. Then, single-step execution is continuously performed until the exploration of all basic blocks is completed.

[0016] (1) When the contents of the ip register contain a symbolic variable, determine whether the symbolic variable has a tainted attribute. If it does, mark all parameters of the current function call as tainted; otherwise, skip directly.

[0017] (2) When the address of the successor basic block is less than or equal to the address of the current basic block, it is determined that a loop structure has been encountered during the symbol execution process. Then, it is determined whether the number of loops has reached the preset value. If it has, the loop structure is exited and the next basic block is explored.

[0018] Furthermore, boundary binary files are identified by calling communication functions and referencing protocol strings. The judgment criteria are set as follows: for each binary file, the number of communication function calls is recorded as nc, and the number of protocol string references is recorded as ns, both initially set to zero. First, the destination address of each function call instruction in the code segment is checked. If the called function is in the specified communication function list, then nc = nc + 1. Next, the string in the data segment is checked to see if it is in the specified protocol string. If it is, then ns = ns + the cross-reference count of the protocol string. Finally, based on the calculated score = (1 + kc * nc) * (1 + ks * ns), where kc = 3 and ks = 1, the binary file with the highest score value is taken as the boundary binary file.

[0019] The beneficial technical effects of this invention are as follows:

[0020] The automated security detection method for printing service systems and devices provided by this invention can effectively detect buffer overflows and command injection vulnerabilities in the firmware of embedded systems such as printers. Compared with other existing analysis methods, this invention innovatively summarizes the characteristics of IoT devices during device configuration operations, effectively handles the problem of data sharing functions interrupting security-sensitive control flows, and optimizes for some characteristics of network printing services. The time cost of the entire automated analysis process is reasonable, saving a significant amount of manual analysis costs for vulnerability discovery. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the overall process of the present invention;

[0022] Figure 2 This is a schematic diagram of the overall structure of the present invention;

[0023] Figure 3 This is a schematic diagram of the function call graph provided by the present invention. Detailed Implementation

[0024] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings and preferred embodiments.

[0025] In addition to common vulnerabilities similar to those on PC platforms, embedded systems such as printers also suffer from a unique type of security vulnerability stemming from device configuration operations. When managing and using IoT devices, it's often necessary to configure parameters such as DNS server addresses and print service network port numbers. Normally, the system uses authentication or authorization mechanisms to restrict users managing the devices. However, if the system's authentication before receiving data is insufficient, and if it insecurely uses carefully crafted device configuration data from an attacker, it can lead to security issues such as command injection and buffer overflows.

[0026] Based on a thorough summary of the characteristics of the aforementioned device configuration vulnerabilities, this invention designs a technical solution capable of automating security analysis of printing service systems and devices, such as... Figure 1-2 As shown, it includes the following steps:

[0027] Step S1: Unpack the firmware of the printer device. This can be done using the Binwalk framework.

[0028] Binwalk is a widely used firmware unpacking tool that can scan firmware images and identify common embedded file formats and file systems, thereby extracting individual files from the firmware for further analysis. The command "binwalk -Me$firmware" can be directly invoked in the code, where the "-e" option indicates automatic extraction of known file types from the firmware, and the "-M" option indicates recursive scanning of extracted files. Binwalk will continuously unpack sub-files until all files are extracted. However, Binwalk only supports parsing most common formats. Some firmware uses vendor-defined formats, so extensions are needed to support the parsing of special firmware formats, such as HP's BDL format firmware and Xerox's DLM format firmware. In summary, when performing the "firmware unpacking module," the first step is to identify whether the firmware format belongs to a special format supported by this invention. If so, a targeted unpacking operation is performed directly; if identification fails, the firmware is then handed over to Binwalk for general automated unpacking processing. This ensures accurate extraction of binary files from the firmware for further analysis.

[0029] Step S2: Analyze the file system obtained after unpacking the firmware and locate the boundary binary;

[0030] Boundary binary is identified by calling communication functions and referencing protocol strings.

[0031] The judgment is primarily based on the following criteria: For each binary file, the number of communication function calls is denoted as nc, and the number of protocol string references is denoted as ns, both initially set to zero. First, the destination address of each function call instruction in the code segment is checked. If the called function is in the specified communication function list, then nc = nc + 1. Next, the string in the data segment is checked to see if it is in the specified protocol string. If it is, then ns = ns + the cross-reference count of the protocol string. Finally, based on the calculated score = (1 + kc * nc) * (1 + ks * ns), where kc = 3 and ks = 1, the binary file with the highest score value is taken as the boundary binary. The details are as follows:

[0032] If a binary program calls a communication function and also references a protocol string in its code segment, it is preferentially treated as a boundary binary.

[0033] For binary data that does not meet the above conditions, sort them by the number of times the communication function is called; the more times it is called, the more likely it is to be a boundary binary. In the absence of function symbol information, sort the binary data by the number of times the protocol string is referenced; the more times it is referenced, the more likely it is to be a boundary binary.

[0034] Step S3 involves performing static analysis on the obtained boundary binary program to identify dangerous control flows related to device configuration operations. This process effectively reassembles control flows interrupted by data sharing operations, enabling a more comprehensive security analysis. Data sharing operations refer to data set / get operations based on NVRAM, environment variables, configuration files, etc. This analysis can be implemented using the Ghidra reverse engineering framework to discover potential vulnerability triggering paths, i.e., dangerous control flows.

[0035] Specifically, a function list containing source, sink, config_setter, and config_getter functions is established. Based on the function call graph, using static analysis, starting from the source function that receives external data, function call paths containing the sink function are searched. During this process, the control flows from the source function to the config_setter function and from the config_getter function to the sink function are spliced ​​together, thereby identifying dangerous control flows related to device configuration operations in the boundary binary.

[0036] Existing methods for security testing of embedded system firmware generally start with the `source` function call that receives external data and use a constructed function call graph to check for direct or indirect calls to the `sink` function. However, in some cases, the source data of the taint and the security-sensitive operation are not connected by a continuous function call path. Data-sharing functions can interrupt the control flow between them, and existing detection methods cannot effectively handle such complex situations. Therefore, this invention innovatively summarizes the characteristics of device configuration-related control flows, defining the function that stores configuration data obtained from network communication packets as the configuration setting function (`config_setter`), and the function that searches for and reads previously stored device configuration data as the configuration getting function (`config_getter`), thus constructing a function call graph. When the program implements device configuration functions, it first obtains external data through the `source` function, then stores this data using the configuration setting function; in another control flow, it obtains configuration data through the configuration getting function, and then calls some `sink` functions during the specific configuration process. In this case, the present invention will concatenate the control flow from source to config_setter and the control flow from config_getter to sink, and perform security analysis. This will enable a more comprehensive discovery of potential vulnerabilities and thus obtain accurate detection results.

[0037] Before using Ghidra scripts to detect dangerous call paths, a list of functions requiring special attention during the detection process should be identified. This list includes four categories of functions: source, sink, config_setter, and config_getter. The latter two categories are for reading and writing device configuration data. Programs typically share data and configure device parameters through the following methods:

[0038] (1) NVRAM: This is a type of non-volatile memory that can retain data for a long time after power failure. It is often used to store device settings and some sensitive user information. After receiving configuration parameters, the program can store data through the nvram_set class function; before performing device configuration operations, it can retrieve configuration parameters through the nvram_get class function.

[0039] (2) Environment variables: The operating system uses environment variables to specify parameters of the runtime environment, such as the path to a temporary folder. Programs can set environment variable values ​​using functions like `set_env`, and then retrieve the operating system's environment information using `get_env`, thereby configuring the device.

[0040] (3) Configuration files: Embedded system service programs also frequently record configuration parameters in files, which often end with the ".conf" suffix. Through file read / write functions such as fread and fwrite, the device's service program can obtain and set the relevant configuration parameters.

[0041] The read and write operations of each of the above device configuration methods often occur in pairs. They can be linked together by matching the keyword strings used in function calls, thereby discovering more security-sensitive operations that are indirectly affected by external data.

[0042] Based on the function call graph, the security analysis script starts from the source function call point and explores using a depth-first search approach. During the traversal, if a sink function is encountered, a dangerous call path is directly output. If a configuration setting function `config_setter` is encountered, the control flow transfer caused by configuration setting and configuration reading needs to be handled. That is, the function call graph is explored again from the corresponding configuration reading function `config_getter` until the sink function call is found. Finally, the two control flows from source to `config_setter` and from `config_getter` to sink are concatenated to obtain function call path information in the form of "source→…→config_setter→config_getter→…→sink", which is output as a complete dangerous path.

[0043] During the detection process, it is also necessary to filter out cases where the parameters of the sink function are constant strings, as such sink calls generally do not cause security issues.

[0044] When a function parameter is a complex expression, it is difficult to determine whether the parameter is constant using static analysis. Ghidra provides a class called SymbolicPropogator, which uses the member function getRegisterValue to calculate the value in the parameter register. If the value is the address of a constant string in the data segment, then the current sink function call can be considered safe.

[0045] Furthermore, a single source function call typically contains multiple dangerous paths leading to the sink function. Based on the source function call address, the resulting control flow is categorized, and each dangerous call path is recorded in the following format: [source-call-site]:(call-site,callee)→(call-site,callee)→…→(call-site,sink). The function call graph generated during the detection process is stored locally as a JSON file, saving time during subsequent analysis.

[0046] Step S4: For the discovered dangerous control flow, use dynamic symbolic execution technology to explore paths and solve constraints, verify whether the vulnerability meets the triggering conditions through taint analysis, and finally issue an alert.

[0047] This analysis is implemented using the binary analysis framework Angr. It performs taint analysis on the previously obtained dangerous control flow of the device configuration class to accurately verify the existence of vulnerabilities, such as whether the parameters of the sink function use external input data and whether path constraints are satisfied. The general analysis process is as follows: First, based on the source function call points obtained from the previous static analysis, the received data is marked as taint sources; second, taint propagation is performed in conjunction with the previously obtained control flow information to achieve specific data flow analysis; when the sink function call is encountered during propagation, it is determined whether its parameters are affected by input tainted variables and whether the current position meets the conditions for vulnerability exploitation, and finally, an alert is issued.

[0048] For dangerous control flows, a virtual node containing config_setter and config_getter function calls is created to connect the two control flows that are interrupted by the data sharing operation. Then, dynamic symbolic execution technology is used for path exploration and constraint solving.

[0049] Because there is no actual function call or jump relationship between the `config_setter` and `config_getter` functions matched based on the constant string in the danger control flow of device configuration, a virtual node needs to be created to connect the function call relationships before and after them. This virtual node contains both configuration setting and configuration reading operations. After completing this operation, regular symbolic exploration can proceed.

[0050] The initial state setup for dynamic symbolic execution is relatively simple: just set the IP register to the address of the first basic block of the function where the source call point is located. The Angr framework will automatically set the stack top address of the SP register. After starting single-step execution via the step() function, you will encounter a call instruction that calls the source function. After determining that a certain parameter or return value is a taint source based on the source function type, the apply_taint function is called to symbolize the input data and mark it as a taint source. That is, the symbolic variable marked with "taint" is stored in the memory address corresponding to the input data.

[0051] During symbolic path exploration, the program is executed in units of basic blocks. Each execution state corresponds to a basic block. The execution state starts with the first basic block of the function containing the source point, and single-step execution is performed continuously. Jumps between basic blocks can be conditional jumps, unconditional jumps, function calls, or function returns. When multiple successor states are encountered, the successor state is selected and executed in sequence. This process is recursively repeated until all branches are covered. Upon detecting a basic block, it is first checked whether it satisfies the path constraints. If it does not, the exploration under the current path ends. If the current basic block calls the sink function and meets the conditions for triggering a vulnerability, the exploration also ends and an alert is issued.

[0052] If the current basic block calls the configuration setting function (config_setter), then the execution state needs to be transferred to its corresponding virtual node. The virtual node will then transfer the execution state to the code following the corresponding configuration reading function (config_getter) based on the current execution status.

[0053] When a setter corresponds to multiple getters, the symbolic execution engine will explore the function call subgraph corresponding to each getter in turn. During state transition, it is necessary to set the IP register to the call address of the corresponding getter function, and also to collect the constraints of the configuration data at the setter and add them to the data pointed to by the return pointer of the getter function in order to accurately propagate taint attributes.

[0054] This invention also takes into account some special cases during execution, such as symbolic jump addresses and loop handling, as detailed below:

[0055] (1) When the contents of the ip register contain symbolic variables, the symbolic execution engine may not know which instruction to execute next because the ip register does not contain a specific address value. Angr calls this situation an unconstrained state. Symbolic exploration should skip this state directly. However, if the symbolic variables in the ip register have tainted attributes, then all parameters of the current function call should be tainted.

[0056] (2) When the address of the successor basic block is less than or equal to the address of the current basic block, it can be basically determined that a loop structure has been encountered during symbolic execution. The number of times the loop structure is executed can be recorded by using the addresses before and after the backward jump. Then, a preset value is given. When the number of times the same loop body is executed exceeds the preset value, it will no longer be executed. This can prevent symbolic exploration from getting stuck in an infinite loop.

[0057] After discovering the sink function, it is necessary to verify whether the vulnerability meets the triggering conditions, that is, whether the parameters of the sink function are affected by the tainted source. For buffer overflow vulnerabilities, in addition to requiring the source data to be tainted, it is also necessary to be able to calculate the length of the buffer to ensure that the length of the source data is greater than the capacity of the destination buffer. The calculation method is as follows.

[0058] (1) Stack buffer length calculation: Given a function, first traverse all instructions in its function body, record the address offset of each local variable reference, and then sort these address offsets in ascending order to obtain offset_list. When calculating the size of the variable at offset A, find the offset B corresponding to the next variable in offset_list, and the difference between the two address values ​​gives the size of the stack variable.

[0059] (2) Heap Buffer Length Calculation: Given the address addr of a heap buffer, symbolic execution is performed starting from the entry point of the function that might allocate the heap variable, and addr is tainted. At each malloc function encountered, its return value is checked to see if it points to tainted data. If so, it means that the current heap memory allocation operation corresponds to the target heap buffer. The parameters of malloc are constrained, and the resulting value is the size of the heap buffer.

[0060] While specific embodiments of the present invention have been described above, those skilled in the art should understand that these are merely illustrative examples. Various changes or modifications can be made to these embodiments without departing from the principles and essence of the present invention. Therefore, the scope of protection of the present invention is defined by the appended claims.

Claims

1. An automated security detection method for printing service systems and equipment, characterized in that... Includes the following steps: S1, unpack the firmware of the printer device; S2 analyzes the file system obtained after unpacking the firmware and locates the boundary binary; S3. Static analysis is performed on the obtained boundary binary to identify dangerous control flows related to device configuration operations. S4. For the discovered dangerous control flow, symbolic execution technology is used to explore paths and solve constraints. Taint analysis is used to verify whether the vulnerability meets the triggering conditions, and finally an alert is issued. The function that stores device configuration data obtained from network communication data packets is defined as the configuration setting function `config_setter`, and the function that searches for and reads previously stored device configuration data is defined as the configuration reading function `config_getter`. A function list containing source, sink, config_setter, and config_getter functions is established. Based on the function call graph, using static analysis, starting from the source function that receives external data, the function call path containing the sink function is searched. During the process, the control flow from the source function to the config_setter function and from the config_getter function to the sink function is spliced ​​together, thereby identifying the control flow related to device configuration operations in the boundary binary as the dangerous control flow.

2. The automated security detection method for printing service systems and equipment according to claim 1, characterized in that: If the parameter of the sink function is a constant string, the getRegisterValue member function of the SymbolicPropogator class in the Ghidra software analysis tool is used to calculate whether the value of the register corresponding to the sink function parameter points to the address where the constant string is located. If so, the control flow of the sink function is determined to be a dangerous control flow.

3. The automated security detection method for printing service systems and equipment according to claim 1, characterized in that: For dangerous control flows, a virtual node containing config_setter and config_getter function calls is created to connect the two control flows that are interrupted by the data sharing operation. Then, dynamic symbolic execution technology is used for path exploration and constraint solving.

4. The automated security detection method for printing service systems and equipment according to claim 3, characterized in that: The program employs dynamic symbolic execution technology based on the Angr framework. During path exploration, the program is divided into basic blocks. In the initial state, the ip register is set to the address of the first basic block of the function where the source call point is located in the dangerous control flow. Then, single-step execution is performed continuously until all basic blocks are explored. (1) When the contents of the ip register contain a symbolic variable, determine whether the symbolic variable has a tainted attribute. If it does, mark all parameters of the current function call as tainted; otherwise, skip directly. (2) When the address of the successor basic block is less than or equal to the address of the current basic block, it is determined that a loop structure was encountered during the symbol execution process. Then it is determined whether the number of loops has reached the preset value. If it has, the loop structure is exited and the next basic block is explored.

5. The automated security detection method for a printing service system and equipment according to claim 1, characterized in that: Boundary binary files are identified by calling communication functions and referencing protocol strings. The criteria are set as follows: for each binary file, the number of communication function calls is denoted as nc, and the number of protocol string references is denoted as ns, both initially set to zero. First, the destination address of each function call instruction in the code segment is checked. If the called function is in the specified communication function list, then nc = nc + 1. Next, the string in the data segment is checked to see if it is in the specified protocol string. If it is, then ns = ns + the cross-reference count of the protocol string. Finally, based on the calculated score = (1 + kc * nc) * (1 + ks * ns), where kc = 3 and ks = 1, the binary file with the highest score value is taken as the boundary binary file.

Images