Device for detecting firmware tampering vulnerability based on static analysis technology

Abstract

The invention discloses a device for detecting firmware tampering vulnerabilities based on a static analysis technology, and belongs to the field of information security. The system specifically comprises a firmware updating security detection module and a verification algorithm security detection module. When one piece of firmware is detected, firstly, the firmware is unpacked by using an unpacking layer of the firmware update security detection module to obtain a file system input analysis layer, and an input source function and a firmware update function of the device for receiving user data through an HTTP protocol are found. Path exploration is carried out through symbolic execution and taint analysis, and when Source is reachable to Sink, a data link from an input source function to a firmware updating function is found; variable constraints are collected in the path exploration process, constraint analysis is carried out, whether control variables can be influenced by taint variables controlled by a user or not is judged, and finally a detection result report is generated. And the verification algorithm security detection module is used for identifying the type of the file verification algorithm. According to the invention, the detection efficiency is improved, and the labor cost of detection is reduced.

Description

Technical Field

[0001] The invention provides a device for detecting firmware tampering vulnerabilities based on static analysis technology, belonging to the field of system security in information security. Background Art

[0002] In the era of the Internet of Everything, various physical devices equipped with firmware have multiple functions and can provide users with various intelligent services. Firmware is a set of instructions or programs installed on electronic devices or computer hardware, which is responsible for managing the basic functions of the device, such as communicating with other devices, processing input and output, and controlling the operation of the device.

[0003] Generally, users cannot modify or change the firmware directly. However, some devices provide the option of firmware upgrade, which allows users to fix errors, add new features, or improve device performance by updating the firmware. For example, for a home router, after logging into the backend management interface of the home router, the user finds the firmware upload / update button in the "Settings" option and clicks it. The firmware to be updated is then uploaded to the router from the local computer, and the user waits for the router to refresh itself. Although this option is convenient for users, it expands the attack surface of the device, making the firmware vulnerable to tampering attacks during the upgrade process.

[0004] Firmware tampering attacks such as Figure 1 As shown in the figure, when a legitimate user is uploading firmware for updating, an attacker intercepts the firmware update package, implants a malicious backdoor, and then repackages and uploads it to the device. The device accepts the tampered firmware, and the attacker gains the ability to control the device through the set backdoor. This shows that due to the weak security protection of a certain aspect of the firmware and the existence of defects and vulnerabilities in this aspect of the firmware, the firmware tampering attack carried out by the attacker can be successful.

[0005] Recently, a large number of firmware tampering vulnerabilities have been exposed in IoT devices, such as CVE-2023-23120. TRENDnetTV-IP651WI network camera firmware version v1.07.01 and earlier versions are vulnerable to firmware tampering attacks because the cyclic redundancy check (CRC) algorithm is used for integrity check during the firmware update process and HTTP unencrypted communication is used. An attacker can modify the new firmware image and bypass the checksum verification by attacking the man-in-the-middle (MITM). In CVE-2023-23119, the UbiquitiairFiber AF2X Radio firmware is vulnerable to firmware modification attacks because the cyclic redundancy check (CRC) algorithm is used for integrity check during firmware updates. In CVE-2023-23110, CVE-2022-46432, CVE-2022-46424, and CVE-2022-38955, the data integrity of uploaded firmware images in certain Netgear products is ensured by a fixed checksum number, allowing an attacker to perform a man-in-the-middle attack, modify the firmware image uploaded by the user, and bypass the checksum verification.

[0006] In the earlier period, relevant scholars' research direction of firmware tampering attacks was mainly on commonly used embedded devices and industrial system equipment.

[0007] Initially, the diversity of embedded device hardware and firmware was considered an insurmountable obstacle to the widespread exploitation of vulnerabilities.

[0008] In 2013, Cui et al. conducted a case study on HP-RFU (Remote Firmware Update) laser printer firmware tampering. The vulnerability allowed arbitrary injection of malware into the printer firmware through standard printed documents, and used such techniques to complete network reconnaissance, data infiltration and spread to general-purpose computers and other embedded device types. Concept printer. In the same year, Basnight et al. studied the vulnerability of PLC to firmware tampering attacks, introduced a general firmware analysis method, and used a proof-of-concept experiment to demonstrate firmware tampering attacks, that is, how to update and upload legitimate firmware to Allen-Bradley controllogix L61 PLC.

[0009] In 2015, Charalambos et al. introduced how attackers can inject malicious tripping commands into relay controllers through firmware tampering attacks to disrupt the operation of circuit breakers (CBs), and developed a real scenario of power systems to illustrate the hazards of firmware tampering attacks.

[0010] In 2017, Jaewoo et al. investigated the firmware update process of devices such as Apple Watch and Huawei smartwatch, analyzed the vulnerabilities of the communication protocols in the devices, and then verified the feasibility of firmware tampering attacks.

[0011] The above literature fully demonstrates the serious harm that firmware tampering attacks bring to embedded devices. After a firmware tampering attack is successful, arbitrary and persistent changes are made to the device, causing serious consequences such as functional failure, device crash, and malicious backdoor implantation.

[0012] While relevant scholars are studying firmware tampering attacks, they are also promoting the detection of firmware tampering attacks.

[0013] At present, according to the different detection objects, it can be divided into device firmware legitimacy detection and SDK detection. Among them, device firmware legitimacy detection is mainly based on hardware detection technology, and SDK detection is mainly based on static analysis technology.

[0014] The device firmware legitimacy detection mainly detects whether the firmware currently running on the device has been tampered with after being attacked.

[0015] Dane et al. have developed a detection technology based on current consumption analysis to address the problem of firmware tampering in solid-state drives (SSDs) to determine whether the currently running firmware has been tampered with.

[0016] Wang et al. proposed ConFirm, a low-cost technology for detecting firmware tampering in embedded control system software. It can detect whether the firmware currently running on the device is tampered with malicious firmware by measuring the number of low-level hardware events that occur during software execution.

[0017] The purpose of SDK detection is to analyze SDKs that implement update functions but are vulnerable to firmware tampering attacks, and then find firmware that uses these SDKs and has potential attack risks and IoT devices that use these firmware.

[0018] Muhammad et al. proposed a comprehensive method to identify vulnerable firmware update SDKs in IoT devices at scale, and used the method to analyze 23 popular IoT devices (and their corresponding companion apps) to identify vulnerable devices and the SDKs used by such devices to implement update functionality. In addition, by fingerprinting each vulnerable SDK and using the fingerprints to perform large-scale analysis of the companion apps from the Google Play Store, 61 mainstream IoT devices that may use insecure firmware update mechanisms and 1,356 apps that rely on vulnerable SDKs were eventually identified.

[0019] Despite the continuous progress in the research and detection of firmware tampering attacks, Internet devices still face serious harm from firmware tampering attacks.

[0020] Among the existing methods, hardware-based firmware tampering attack detection technology is mainly used to detect whether the firmware running on a real device is maliciously tampered with, but it cannot prevent firmware tampering attacks, that is, detect whether a normal device has a firmware tampering vulnerability.

[0021] Although static SDK detection can analyze SDKs that implement update functions but are vulnerable to firmware tampering attacks, and then find devices with potential attack risks that use these SDKs, the false positive rate is too high, a lot of manual detection time is consumed, and the detection accuracy is low.

[0022] At present, when security personnel are digging for firmware tampering vulnerabilities, they mainly purchase real physical machines for manual vulnerability digging; taking CVE-2023-23120 as an example, after the security personnel install and start the real physical machine, they first implement a man-in-the-middle attack as an attacker. After the success, the security personnel download the new firmware image from the supplier's server as a user and upload it through the device's web interface. At this time, observe whether the web interface uses the HTTP protocol and whether the attacker can intercept the firmware package uploaded by the user. After intercepting the firmware package uploaded by the user, first check what algorithm is used for the firmware file verification. Here, the TRENDnet TV-IP651WI network camera firmware is based on the CRC32 algorithm for integrity verification.

[0023] After the attacker unpacks the firmware and implants the malicious backdoor, there are two ways to repackage the firmware: one is to rewrite the file header checksum by reversing the file checksum algorithm used by the firmware update function in the firmware file system; the other is to create a malicious firmware image with the same CRC32 value as the original firmware image through collision. Finally, during the firmware update process, the legitimate firmware is replaced through a man-in-the-middle attack, thereby refreshing the malicious firmware to the device, and the device is implanted with an attacker's malicious backdoor; at this point, a firmware tampering vulnerability is discovered.

[0024] It can be seen that the key point of the firmware tampering vulnerability lies in the security of the user-device communication protocol and the vulnerability of the file verification algorithm. Summary of the invention

[0025] In view of the above problems, the present invention proposes a device for detecting firmware tampering vulnerabilities based on static analysis technology, which detects the integrity and security of the firmware by detecting whether the firmware verification method is a simple verification algorithm; at the same time, it detects whether encrypted communication or legal verification is used for the interaction between the user and the device background in the firmware file upload function, thereby proposing a new automated detection idea for detecting firmware tampering attacks, improving detection efficiency and reducing the labor cost of detection.

[0026] The device for detecting firmware tampering vulnerabilities based on static analysis technology includes two modules: a firmware update security detection module and a verification algorithm security detection module;

[0027] The firmware update security detection module is used to detect whether an insecure communication method is used when executing a firmware update;

[0028] The verification algorithm security detection module is used to detect whether the firmware uses a simple verification algorithm, and finally generate a detection result report on whether the firmware has a firmware tampering vulnerability.

[0029] The firmware update security detection module includes: an unpacking layer and an analysis layer;

[0030] When detecting a firmware, the unpacking layer is first used to unpack the firmware to obtain the file system, from which binary files or functions related to the firmware update function are obtained to perform security detection of the communication protocol.

[0031] Then, the file system is input into the analysis layer to find the input source function and firmware update function of the device to accept user data through the HTTP protocol.

[0032] Then, path exploration is performed through symbolic execution and taint analysis. When the path from Source to Sink is reachable, it proves that there is a data link from the input source function to the firmware update function in the firmware. When the data link is executed normally in the program, the direction of program execution is controlled by controlling variables. Therefore, variable constraints are collected during path exploration, and constraint analysis is performed to determine whether the control variables from the input source to the firmware update function can be affected by the taint variables controlled by the user, and finally a detection result report is generated.

[0033] The verification algorithm security detection module uses various tools to analyze the file header of the entire firmware to identify the type of file verification algorithm. For those vulnerable file verification algorithms, attackers can collide with them to change the data inside the firmware without changing the file checksum, thereby bypassing the verification mechanism of the firmware update.

[0034] Furthermore, the firmware unpacking refers to extracting various components in the firmware file for analysis, modification or research.

[0035] Firmware is usually stored in compressed form, including the device's operating system, drivers, configuration files, etc. The unpacking layer integrates the Binwalk firmware unpacking tool and some dependent unpacking plug-in libraries.

[0036] The process of the Binwalk firmware unpacking tool to unpack and extract firmware is as follows:

[0037] First, the tool determines the file type and format by scanning the file header and signature of the firmware file; then, it extracts the components in the firmware and matches the continuous byte sequences in the scanned firmware file with the predefined algorithm pattern.

[0038] During the unpacking process, Binwalk also tracks the flow of data within the firmware, identifying possible file or component boundaries.

[0039] Further, in the analysis layer, it is mainly divided into three parts: Source, Sink search, reachability analysis and constraint analysis;

[0040] 1) In the process of searching for Source and Sink, search by identifying the function name;

[0041] For functions whose function names are restored by disassembling, related functional functions are found by searching using preset function name rules; for example, Angr and IDA Pro are two engineering software tools.

[0042] For functions whose names cannot be restored, binary code similarity analysis is used to calculate the similarity between these functions and the input source functions, and then the density-based DBSCAN clustering algorithm is used to group binaries with close scores. Then, the cluster containing the binaries with the highest parsing scores in the firmware sample is selected, and all binaries belonging to this cluster are regarded as the initial set of network-oriented binaries.

[0043] Similarly, binary code similarity analysis is used to find the set of binary files responsible for the firmware update function.

[0044] 2) The reachability analysis is used to determine which code blocks in the program can be executed, specifically, a reachability analysis that more comprehensively considers the program's path and data flow through symbolic execution and taint analysis;

[0045] Symbolic execution obtains the input for executing a specific code area by analyzing the program. Specifically, when using symbolic execution to analyze a program, symbolic values ​​are used as input. When the target code is reached, the analyzer obtains the corresponding path constraints, and then uses the constraint solver to obtain the specific value that can trigger the target code.

[0046] Taint analysis is abstracted into triples<sources,sinks,sanitizers> Among them, source refers to the taint source, which means directly introducing untrusted data or confidential data into the system; sink refers to the taint sink, which means directly generating security-sensitive operations (violating data integrity) or leaking private data to the outside world (violating data confidentiality); sanitizer refers to harmless processing, which means making data propagation no longer harmful to the information security of the software system by means of data encryption or removal of harmful operations.

[0047] Use taint analysis technology to mark the data of interest (usually from the external input of the program, assuming that all input is dangerous) as tainted data, and then further perform control flow analysis by tracking the flow of information related to the tainted data.

[0048] The specific process of reachability analysis is as follows:

[0049] Using symbolic execution technology, the program is loaded and symbolically executed to derive the path constraints of the program. For conditional statements, symbolic branch conditions are generated to form path constraints. At the same time, taint analysis is assisted to identify the propagation path of sensitive data in the program. The symbolic branch conditions generated in symbolic execution are combined with the data flow information of taint analysis to understand whether the data can affect the execution path of the program, and those code blocks that can access or process sensitive data are marked as reachable code blocks. In addition, for each program control branch condition, a path that meets the condition is selected based on the results of symbolic execution and the data flow information of taint analysis.

[0050] In reachability analysis, corresponding path constraints will be generated during symbolic execution. At this time, a constraint solver is needed to solve the symbolic path constraints to generate a specific execution path.

[0051] 3) Constraint analysis is the path constraints generated during symbolic execution, which are solved using a constraint solver to generate a specific execution path.

[0052] First, the symbolic variables are solved and whether they are tainted variables, that is, variables that can be controlled or influenced by external inputs, is detected. If so, it is considered that the device transmits firmware via HTTP and executes the firmware update function under the influence of external inputs.

[0053] Furthermore, the fragile file verification refers to ensuring that the file has not been tampered with or damaged during transmission or storage by verifying and comparing the file.

[0054] The vulnerability detection of the file verification algorithm uses software such as Binwalk and Firmware Mod Kit; by scanning the firmware verification code information contained in the file header information of the firmware file, it is detected whether the firmware uses CRC verification.

[0055] The advantages of the present invention are:

[0056] 1. A device for detecting firmware tampering vulnerabilities based on static analysis technology. Based on static detection technology and function similarity recognition technology, it can effectively detect the risk of firmware being tampered with, provide monitoring and protection of firmware integrity, thereby ensuring the normal operation of the device and the security of data. At the same time, it realizes automated detection, greatly reduces the labor cost of detection and improves the efficiency of detection.

[0057] 2. A device for detecting firmware tampering vulnerabilities based on static analysis technology. It does not require additional hardware to support detection. Unlike passive detection, it can actively detect whether the device has defects that are susceptible to firmware tampering attacks based on the firmware of the IoT device, and update the device to a more secure version before the device is attacked by firmware tampering.

[0058] 3. A device for detecting firmware tampering vulnerabilities based on static analysis technology, which has a wider range of applications and is fully automated; it carries out detection around the two vulnerable points of firmware tampering attack devices, and uses firmware static analysis technology to achieve full automation of the entire process of the firmware update security detection module and the verification algorithm security detection module, greatly saving labor costs and time. In addition, since the detection process does not rely on IoT device data sets, this solution has a wider range of applicability. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is a schematic diagram of the principle of firmware tampering attack in the prior art;

[0060] Figure 2 This is a general framework diagram of a device for detecting firmware tampering vulnerabilities based on static analysis technology of the present invention;

[0061] Figure 3 This is a schematic diagram of a fully automated firmware tampering vulnerability detection process by the firmware tampering attack model of the present invention;

[0062] Figure 4 A schematic diagram of a firmware analysis and unpacking tool used in the present invention to detect the vulnerability of a file verification algorithm;

[0063] Figure 5 A schematic diagram of the process of using the binwalk unpacking tool for the firmware update security detection module of the present invention;

[0064] Figure 6This is a schematic diagram of a specific workflow for searching for sources and sinks in the analysis layer in an embodiment of the present invention. Figure 7 It is a flowchart of reachability analysis and constraint analysis in an embodiment of the present invention. DETAILED DESCRIPTION

[0065] In order to facilitate those skilled in the art to understand and implement the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. Obviously, the described embodiments are only partial embodiments of the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work should fall within the scope of protection of the present invention.

[0066] The present invention proposes a device for detecting firmware tampering vulnerabilities based on static analysis technology. The goal is to model firmware tampering vulnerabilities. According to the previous experience of mining firmware tampering vulnerabilities, the whole process is abstracted and summarized to propose a detection idea for firmware tampering vulnerabilities. The process of mining firmware tampering vulnerabilities by security personnel is automated, and an automated tool for firmware tampering vulnerability detection is developed.

[0067] The purpose is as follows:

[0068] (1) Check the security of the communication protocol between users and devices

[0069] The present invention designs an efficient and accurate method and detection idea for detecting the security issues of the communication protocol between the user and the device when using the firmware update function, that is, detecting whether encrypted communication or legal verification is used for the interaction between the user and the device background in the firmware file update function.

[0070] (2) Automated detection tools for firmware tampering vulnerabilities

[0071] In the prior art, firmware tampering attacks are basically carried out manually to mine for vulnerabilities in the firmware, which greatly reduces the efficiency of vulnerability mining. Another purpose of the present invention is to integrate the firmware verification algorithm detection technology with the firmware update function network communication security detection technology to jointly develop an automated tool that can realize firmware tampering vulnerability detection, so as to reduce the labor cost of detection and improve the efficiency of detection.

[0072] There are two key points in firmware tampering attacks. One is that the user uses HTTP to transmit the firmware when communicating with the device during firmware updates, and the other is to use a simple verification algorithm to verify the file integrity. In simple terms, as long as a communication protocol such as HTTP is used, the attacker can use a man-in-the-middle attack to intercept the firmware. As long as the file verification algorithm uses a simple verification algorithm such as CRC, malicious firmware with the same CRC value as the original firmware can be created through collision.

[0073] The overall framework is as follows Figure 2 As shown:

[0074] The device for detecting firmware tampering vulnerabilities based on static analysis technology includes two modules: a firmware update security detection module and a verification algorithm security detection module;

[0075] The firmware update security detection module is used to detect whether an insecure communication method is used when executing a firmware update;

[0076] The verification algorithm security detection module is used to detect whether the firmware uses a simple verification algorithm, and finally generate a detection result report on whether the firmware has a firmware tampering vulnerability.

[0077] The firmware update security detection module includes: an unpacking layer and an analysis layer;

[0078] (1) Unpacking layer

[0079] To detect whether a firmware has a tampering vulnerability, you must first unpack the firmware to obtain the corresponding file system, which makes it easy to find binary files or functions related to the firmware update function to perform security testing on the communication protocol.

[0080] (2) Analysis layer

[0081] In the analysis layer, we first need to find the network data input source and data processing function from the file system extracted from the firmware unpacking. In the current scenario, we need to find the input source function and firmware update function that the device uses the HTTP protocol to accept user data. Then, we perform path exploration through symbolic execution and taint analysis to determine the reachability from Source to Sink. If Source to Sink is reachable, it proves that there is a data link from the input source to the firmware update function in the firmware. When the program is executed normally, there will be some control variables to control the direction of program execution in such a data link. Therefore, in the process of path exploration, variable constraints are collected and constraint analysis is performed to determine whether the control variables from the input source to the firmware update function can be affected by the taint variables that can be controlled by the user, and finally generate a detection result report.

[0082] In the verification algorithm security detection module, various tools are used to analyze the file header of the entire firmware to identify which file verification algorithm is used. For those vulnerable file verification algorithms, attackers can collide with them to change the data inside the firmware without changing the file checksum, thereby bypassing the verification mechanism of the firmware update.

[0083] Furthermore, the firmware unpacking refers to extracting the various components in the firmware file for analysis, modification or research. The firmware is usually stored in a compressed form, including the device's operating system, driver, configuration files, etc. The unpacking layer integrates the Binwalk firmware unpacking tool and some dependent unpacking plug-in libraries.

[0084] Binwalk is a common tool for firmware unpacking. It is an open source tool specifically used to analyze and extract firmware files. It uses a series of technologies and algorithms to unpack and extract firmware, specifically:

[0085] The first is file signature scanning technology. Binwalk determines the file type and format by scanning the file header and signature of the firmware file. It uses a predefined file signature database that contains signatures of various firmware and file types. By matching specific byte patterns in the file, Binwalk can identify different components in the firmware.

[0086] The second is the extraction tool. Once the type and format of the firmware is determined, Binwalk will use the corresponding extraction tool to extract the components in the firmware. Known firmware formats and structures can be used to locate and extract operating system images, file systems, configuration files, drivers, etc. For compressed or encrypted components, Binwalk can also use corresponding decompression or decryption algorithms to process them.

[0087] Then there is algorithm matching. Binwalk uses an algorithm matching technique to detect and extract other files or components embedded in the firmware. It scans the continuous byte sequence in the firmware file and matches it with predefined algorithm patterns. These algorithm patterns can be characteristic patterns of common compression algorithms (such as gzip, zlib) or encryption algorithms (such as AES, RSA).

[0088] Finally, there is data flow analysis. During the unpacking process, Binwalk also performs data flow analysis to further extract useful information. It tracks the flow of data in the firmware and identifies possible file or component boundaries. By analyzing the data flow, Binwalk can find and extract more components during the unpacking process.

[0089] Unpacking the firmware can help the firmware detection system gain an in-depth understanding of the internal structure and content of the firmware, so as to collect detection sets and perform static analysis.

[0090] As for the security of the communication protocol between users and devices, users mainly communicate with devices through HTTP or HTTPS. Among them, HTTP is a plain text transmission protocol, and data is sent in plain text during transmission, which makes HTTP very vulnerable to man-in-the-middle attacks. Attackers can intercept HTTP requests and responses and view, modify or tamper with the data during transmission. HTTPS is a secure version that protects communications by encrypting data using TLS / SSL. This encryption makes man-in-the-middle attacks more difficult.

[0091] In the above firmware tampering vulnerability CVE examples, the vulnerable firmware devices basically use HTTP to communicate with users, which makes it easy for attackers to intercept the firmware packages sent by users to the devices for updating using man-in-the-middle attacks, thereby tampering with and repackaging the firmware. Therefore, the key to detecting the security of the communication protocol between users and devices is to detect whether the communication method used by the firmware update function in the firmware is an unsafe communication method such as HTTP.

[0092] Further, in the analysis layer, it is mainly divided into three parts: Source, Sink search, reachability analysis and constraint analysis;

[0093] (I) Source and Sink Search

[0094] (1) Function name recognition

[0095] In the process of searching for Source and Sink, firstly, we search for functions whose names can be restored by disassembling by using the function name rule. Among them, the following tools can support the work of binary file disassembly:

[0096] Angr is a powerful binary analysis framework that can be used for symbolic execution and static analysis, including function identification. Function identification refers to the automatic identification of all functions in a binary file so that more accurate and useful processing can be performed in subsequent analysis. Angr supports loading binary files and then creating a control flow graph (CFG graph) based on the loaded binary file. The control flow graph is a key component of function identification. It represents the control flow transfer relationship between functions in a binary file. Angr provides a variety of CFG creation methods. After creating the CFG graph, you can obtain Angr's analysis results for the binary file, including the identified function name and function address.

[0097] IDA Pro is a powerful binary reverse engineering software that can be used to analyze and disassemble various binary files, including executable files and library files. In IDA Pro, function identification is an important step. It provides automatic function identification to quickly locate and understand functions in binary files. At the same time, there are also some IDA plug-ins for function identification.

[0098] After disassembling the binary file using the above tools, you can find related function names using the preset function name rules.

[0099] (2) Binary Similarity Analysis and Clustering Algorithm

[0100] For those functions whose names cannot be restored, binary code similarity analysis is used to obtain the similarity between these functions and the input source functions, and then the density-based DBSCAN clustering algorithm is used to group binaries with close scores. Then, the cluster containing the binaries with the highest parsing scores in the firmware sample is selected, and all binaries belonging to this cluster are regarded as the initial set of network-oriented binaries.

[0101] Similarly, we can also find the set of binary files responsible for the firmware update function through binary code similarity analysis; the following tools can support the work of binary code similarity analysis:

[0102] FLIRT (Fast Library Identification and Recognition Technology) is a library identification and recognition technology developed by Hex-Rays. It is a function of IDA Pro (Interactive Disassembler Professional) that is used to automatically identify and process functions in binary files, especially standard library and third-party library functions. The main principle of FLIRT is to extract the characteristics of functions from the target library file (usually a dynamic link library or a static library) and generate a special binary file called a "library label file". After loading the target binary file in IDA Pro, FLIRT will run automatically and try to identify functions from the library label file. The goal of FLIRT is to quickly identify the functions used in the binary file and name them as the corresponding library functions, thereby helping reverse engineers understand and analyze the code more easily.

[0103] Diaphora (full name: Diaphora Binary Diffing) is an open source binary file comparison tool developed by Joxean Koret and Ricardo J. Rodríguez. Diaphora can perform instruction-level comparisons. It leverages the power of IDA Pro to automatically analyze two binary files and extract features of functions, code blocks, and other structures to find similarities and differences between them. This enables it to find different code snippets more accurately and help users identify functions.

[0104] BinDiff is a powerful binary code analysis tool, mainly used to compare and analyze two different versions of binary files, such as two different versions of executable files, dynamic link libraries (DLLs), etc. BinDiff uses a variety of technologies, including instruction sequence comparison, function identification, and control flow graph comparison. It also takes into account code insertion and deletion to improve the accuracy of similarity analysis.

[0105] FIT learns the semantics in binary codes and uses a neural network model to screen out potentially vulnerable functions. It then performs bipartite graph matching on the three-layer features between two binary functions. If the similarity threshold is exceeded, the two functions are considered to have similar vulnerabilities.

[0106] (II) Accessibility Analysis

[0107] Reachability analysis is used to determine which code blocks in a program can be reached by execution. In static reachability analysis, the analyzer examines the code without actually executing the program and tries to determine which code blocks are likely to be executed.

[0108] In the current scenario, reachability analysis is needed to determine whether the input source function of the device that receives user data through the HTTP protocol can reach the firmware update function. The present invention uses technologies such as symbolic execution and taint analysis to implement a reachability analysis solution that more comprehensively considers the program path and data flow.

[0109] Symbolic execution is a program analysis technique that analyzes a program to get the input that makes a specific code area execute. As the name implies, when a program is analyzed using symbolic execution, the program uses symbolic values ​​as input instead of the specific values ​​used when executing the program. When the target code is reached, the analyzer can get the corresponding path constraints, and then use the constraint solver to get the specific value that can trigger the target code.

[0110] Taint analysis can be abstracted into a triple<sources,sinks,sanitizers> In the form of, source is the taint source, which means directly introducing untrusted data or confidential data into the system; sink is the taint sink, which means directly generating security-sensitive operations (violating data integrity) or leaking private data to the outside world (violating data confidentiality); sanitizer is harmless processing, which means encrypting data or removing harmful operations so that data propagation no longer poses a threat to the information security of the software system.

[0111] Using taint analysis technology, you can mark the data of interest (usually from external input of the program, assuming that all inputs are dangerous) as tainted data. Then, by tracking the flow of information related to the tainted data, you can know whether they will affect certain key program operations, and then perform further control flow analysis.

[0112] The specific process of reachability analysis is as follows:

[0113] Using symbolic execution technology, the program is loaded and symbolically executed to derive the path constraints of the program. For conditional statements, symbolic branch conditions are generated to form path constraints. At the same time, taint analysis is assisted to identify the propagation path of sensitive data in the program. The symbolic branch conditions generated in symbolic execution are combined with the data flow information of taint analysis to understand whether the data can affect the execution path of the program, and those code blocks that can access or process sensitive data are marked as reachable code blocks. In addition, for each program control branch condition, the path that meets the conditions is selected based on the results of symbolic execution and the data flow information of taint analysis. In this way, the results of symbolic execution and taint analysis can be comprehensively considered to more accurately determine the reachable path.

[0114] (III) Constraint Analysis

[0115] In reachability analysis, the symbolic execution process generates corresponding path constraints, and a constraint solver is needed to solve the symbolic path constraints to generate a specific execution path. This can help determine which paths are feasible, thus guiding reachability analysis.

[0116] In the constraint analysis phase, it is necessary to review the symbolic variables of the constraint solution in the reachability analysis process and detect whether these symbolic variables are tainted variables, that is, variables that can be controlled or influenced by external input. If so, it is considered that the device can transmit firmware via HTTP and perform firmware update functions under the influence of external input.

[0117] Furthermore, in the vulnerability detection of the file verification algorithm, file verification is a process of verifying the integrity and accuracy of a file, and ensures that the file has not been tampered with or damaged during transmission or storage by verifying and comparing the file.

[0118] Common file verification algorithms include CRC32, MD5, SHA-1, SHA-256, etc. In the above firmware tampering vulnerability examples, most vulnerable firmware uses the CRC32 algorithm. Although this algorithm is very useful in error detection, it cannot reliably verify data integrity (that is, the data has not changed at all) because the CRC polynomial is a linear structure, and it is very easy to intentionally change the data while maintaining the CRC unchanged, that is, there is a possibility of collision.

[0119] For the vulnerability detection of file verification algorithms, it is only necessary to determine whether the firmware verification algorithm is an unsafe algorithm such as CRC32. Figure 4 As shown, there are several firmware analysis and unpacking tools that provide this support:

[0120] Binwalk is a powerful open source tool that is mainly used to find embedded files, firmware, file systems, etc. in binary files, and perform extraction and analysis. It is particularly suitable for the field of reverse engineering and digital forensics, and has functions such as file signature scanning, embedded file extraction, entropy analysis, file type analysis, and firmware analysis.

[0121] Firmware Mod Kit (FMK) is an open source tool designed to help reverse engineers and security researchers analyze, parse and modify embedded device firmware. The tool is mainly used to process firmware files, enabling users to browse, extract, replace and modify components in them, thereby achieving control and reverse analysis of embedded devices.

[0122] like Figure 4 As shown in the figure, Binwalk and FMK can scan the file header information of the firmware file. The file header information generally contains the firmware's checksum information, so at this time you can detect whether the firmware uses CRC checksum. In addition, some firmware will have official custom file header information, such as netgear header. At this time, you can use the official open source toolkit to view the checksum method.

[0123] Example:

[0124] The specific process of this example is as follows:

[0125] Step 1: Environment configuration: Use some common commands to check whether the system environment configuration meets the requirements, and equip the corresponding versions of tools and operating environment.

[0126] The environment configuration includes system configuration and tool configuration. The specific configuration is shown in Table 1, and the Python environment configuration is shown in Table 2:

[0127] Table 1

[0128]

[0129] Table 2

[0130]

[0131] The model training deployment DockerFile for this example is shown in Table 3 and Table 4:

[0132] Table 3

[0133]

[0134] Table 4

[0135]

[0136] Step 2: Detect IoT device firmware in .bin file format with a complete file system.

[0137] Step 3: Use the verification algorithm security detection module to obtain the detection result, and return the detected verification header information and the matched unsafe verification algorithm information;

[0138] In the verification algorithm security detection module described in this example, the verification header and extension header of the firmware are deeply analyzed and extracted, and the functions of binwalk and FMK tools are encapsulated and integrated. By parsing the fields of the verification header and extension header, the corresponding verification algorithm used is extracted. Further, matching is performed based on the known unsafe verification algorithm set, and finally a detailed module detection report is generated. The report contains the detected verification header information and detailed information of the matched unsafe verification algorithm.

[0139] Step 4: After inputting a complete firmware, an unpacked folder is generated under the original firmware folder to extract the binary files separated from the firmware.

[0140] like Figure 5As shown, binwalk is used as an unpacking tool in the firmware update security detection module. It is a tool for searching a given binary image file for embedded files and code. Specifically, it is designed to identify files and code embedded within firmware images. Binwalk uses the libmagic library, so it is compatible with magic signatures created by Unix file utilities. Binwalk also includes a custom magic signature plug-in, which contains improved magic signatures for common files in firmware images such as compressed / archive files, firmware headers, Linux kernels, boot loaders, file systems, etc., which can help binwalk identify more files and enhance file extraction capabilities.

[0141] Step 5: The analysis layer is as follows:

[0142] (I) Source and sink search

[0143] like Figure 6 As shown in the figure, this module is mainly divided into function extraction layer and search layer; for each binary file in the file system, source and sink search is performed, and after static analysis, binary similarity analysis and clustering, the binary file set of source and sink is obtained. It contains function name information, address information, function call information, register usage information, some feature information, etc.

[0144] The function extraction layer first uses Angr to load each binary file in the file system, and uses built-in tools to disassemble and convert it into IR intermediate language, then generates a CFG graph of the binary file, and then extracts function information (function name, address, used registers, etc.) and some other features from all detected functions in Angr combined with the CFG graph.

[0145] In the search layer, after the model receives the extracted function information and features, it performs binary code similarity analysis with the internal function library through the GMN model and outputs the score. For those functions with a score exceeding 0.9, the density-based DBSCAN clustering algorithm is used to group binary files with close scores using similarity scores and feature values ​​such as keywords and control branches, and finally outputs the source and sink sets to be used.

[0146] 2. Reachability Analysis and Constraint Analysis

[0147] The reachability analysis module outputs three results, namely, path reachability results, tainted variable sets, and constraint sets. Path reachability results include source and sink information, and control flow information. The tainted variable set is the set of symbolic variables covered by taint analysis during the path exploration process, including symbolic variable names, types, sizes, expressions, and possible symbolic registers. The constraint set is the symbolic constraints of each symbolic variable during the path exploration process, which is essentially a pair of symbolic expressions. The output result is in the form of all symbolic variables and the corresponding symbolic constraints consisting of a set of symbolic expressions.

[0148] Given a source and a sink, reachability analysis is performed by the angr tool starting from the sink to perform symbolic path exploration, and each time a source is encountered, taint analysis assigns new taint labels to register locations that receive data from the source. The tool's taint analysis propagates taint information along the program data flow, and it detains memory locations (by removing their taint labels) when register locations are overwritten by untainted data or when their possible values ​​are constrained. At the same time, symbolic constraints generated by source inputs or related tainted variables on the path are collected during path exploration and form a constraint set.

[0149] The constraint analysis module analyzes the tainted variable set and the constraint set, and combines the detection rules to output whether the path control flow is controllable by external input. It returns True or False to output the reachability report after the path exploration is completed, and uses the tainted variable set and constraint set collected in the process as the input of constraint analysis for constraint solving. In the vulnerability analysis process, in the constraint analysis link, it is necessary to review the symbolic variables of the constraint solving in the reachability analysis process and detect whether these symbolic variables are tainted variables, that is, variables that can be controlled or affected by external input. If so, it is considered that the device can transmit firmware through HTTP and perform firmware update functions under the influence of external input.

[0150] Finally, the results of the constraint analysis and the reachability report are summarized into a result output report.

[0151] The final result report returns whether there is a firmware tampering vulnerability in the firmware, and returns the detected verification header information, the matched unsafe verification algorithm information, and the reachability path information from the source to the sink that is controllable by the external input.

[0152] The key points to be protected in the present invention are as follows:

[0153] ●Automated detection method for firmware tampering attacks based on static analysis technology and binary code similarity technology

[0154] like Figure 3As shown, the present invention summarizes and proposes a firmware tampering attack model, and applies firmware static analysis technology and binary code similarity analysis technology based on this model, fully automates the firmware tampering vulnerability detection process, and develops a corresponding firmware tampering vulnerability automated detection tool, which greatly improves the detection efficiency of firmware tampering vulnerabilities.

[0155] Source and Sink search

[0156] This technology is mainly used to find the input source function and firmware update function of the device to accept user data through HTTP. For those functions whose function names can be identified, they are searched according to the preset function name rules. For those functions whose function names cannot be identified, the similarity between these functions and the input source functions is obtained by using binary code similarity analysis, and then the density-based DBSCAN clustering algorithm is used to group binary files with close scores to obtain the Source and Sink sets.

[0157] Constraint analysis detection rules

[0158] Review the symbolic variables of constraint solving in the reachability analysis process, and use preset detection rules to detect whether these symbolic variables are tainted variables, that is, variables that can be controlled or influenced by external inputs, to determine whether the device can transmit firmware through HTTP and perform firmware update functions under the influence of external inputs.

Claims

1. A device for detecting firmware tampering vulnerabilities based on static analysis technology, characterized in that: It includes two modules: firmware update security detection module and verification algorithm security detection module; The firmware update security detection module is used to detect whether an insecure communication method is used when executing a firmware update; The verification algorithm security detection module is used to detect whether the firmware uses a simple verification algorithm, and finally generate a detection result report on whether the firmware has a firmware tampering vulnerability.

2. The device for detecting firmware tampering vulnerabilities based on static analysis technology according to claim 1, characterized in that: The firmware update security detection module includes: an unpacking layer and an analysis layer; When detecting a firmware, the unpacking layer is first used to unpack the firmware to obtain the file system, from which binary files or functions related to the firmware update function are obtained to perform security detection of the communication protocol; Then, the file system is input into the analysis layer to find the input source function and firmware update function of the device to accept user data through HTTP protocol; Next, path exploration is performed through symbolic execution and taint analysis. When the path from Source to Sink is reachable, it proves that there is a data link from the input source function to the firmware update function in the firmware. When the data link is executed normally in the program, the direction of program execution is controlled by controlling variables. Therefore, variable constraints are collected during path exploration, and constraint analysis is performed to determine whether the control variables from the input source to the firmware update function can be affected by the taint variables controlled by the user, and finally a detection result report is generated.

3. The device for detecting firmware tampering vulnerabilities based on static analysis technology according to claim 1, characterized in that: The verification algorithm security detection module uses various tools to analyze the file header of the entire firmware to identify the type of file verification algorithm. For those vulnerable file verification algorithms, attackers can collide with them to change the data inside the firmware without changing the file checksum, thereby bypassing the verification mechanism of the firmware update.

4. The device for detecting firmware tampering vulnerabilities based on static analysis technology according to claim 2, characterized in that: The firmware unpacking refers to extracting the various components in the firmware file for analysis, modification or research; Firmware is usually stored in a compressed form and contains the device's operating system, drivers, and configuration files; The unpacking layer integrates the Binwalk firmware unpacking tool and some dependent unpacking plug-in libraries.

5. The device for detecting firmware tampering vulnerabilities based on static analysis technology as claimed in claim 4, characterized in that: The process of the Binwalk firmware unpacking tool to unpack and extract firmware is as follows: First, the tool determines the file type and format by scanning the file header and signature of the firmware file. Then, it extracts the components in the firmware and matches the continuous byte sequence in the scanned firmware file with the predefined algorithm pattern. During the unpacking process, Binwalk also tracks the flow of data within the firmware, identifying possible file or component boundaries.

6. The device for detecting firmware tampering vulnerabilities based on static analysis technology as claimed in claim 2, characterized in that: The analysis layer is divided into three parts: Source, Sink search, reachability analysis and constraint analysis; 1) In the process of searching for Source and Sink, search by identifying the function name; For functions whose function names are restored by disassembling, relevant function names are searched by using the preset function name rules. For functions whose names cannot be restored, we use binary code similarity analysis to calculate the similarity between these functions and the input source functions, and then use the density-based DBSCAN clustering algorithm to group binary files with close scores; then, we select the cluster containing the binary files with the highest parsing score in the firmware sample, and regard all the binary files belonging to this cluster as the initial set of network-oriented binary files; 2) The reachability analysis is used to determine which code blocks in the program can be executed, specifically, a reachability analysis that more comprehensively considers the program's path and data flow through symbolic execution and taint analysis; The specific process is: Use symbolic execution technology to load the program and perform symbolic execution to derive the path constraints of the program. For conditional statements, generate symbolic branch conditions to form path constraints. At the same time, assist in taint analysis to identify the propagation path of sensitive data in the program. Combine the symbolic branch conditions generated in symbolic execution with the data flow information of taint analysis to understand whether the data can affect the execution path of the program, and mark those code blocks that can access or process sensitive data as reachable code blocks. In addition, for each program control branch condition, a path that satisfies the condition is selected based on the results of symbolic execution and the data flow information of taint analysis; 3) Constraint analysis is to solve the path constraints generated during symbolic execution using a constraint solver to generate a specific execution path; First, the symbolic variables are solved and whether they are tainted variables, that is, variables that can be controlled or influenced by external inputs, is detected. If so, it is considered that the device transmits firmware via HTTP and executes the firmware update function under the influence of external inputs.

7. The device for detecting firmware tampering vulnerabilities based on static analysis technology as claimed in claim 6, characterized in that: In the process of searching for Source and Sink, the binary file set responsible for the firmware update function is found through binary code similarity analysis.

8. The device for detecting firmware tampering vulnerabilities based on static analysis technology as claimed in claim 6, characterized in that: The symbolic execution obtains the input for executing a specific code region by analyzing the program. Specifically, when a program is analyzed using symbolic execution, the symbolic value is used as input. When the target code is reached, the analyzer obtains the corresponding path constraint, and then obtains the specific value that can trigger the target code through the constraint solver. The taint analysis is abstracted into triples<sources,sinks,sanitizers> ,in, Source refers to the taint source, which directly introduces untrusted data or confidential data into the system; sink refers to the taint sink, which directly generates security-sensitive operations or leaks private data to the outside world; sanitizer refers to harmless processing, which means that data transmission no longer poses a threat to the information security of the software system by encrypting data or removing harmful operations; Use taint analysis technology to mark the data of interest as tainted data, and then further perform control flow analysis by tracking the flow of information related to the tainted data.

9. The device for detecting firmware tampering vulnerabilities based on static analysis technology as claimed in claim 3, characterized in that: The fragile file verification refers to ensuring that the file has not been tampered with or damaged during transmission or storage by verifying and comparing the file.

10. The device for detecting firmware tampering vulnerabilities based on static analysis technology according to claim 3, characterized in that: The vulnerability detection of the file verification algorithm adopts Binwalk and Firmware Mod Kit; by scanning the firmware verification code information contained in the file header information of the firmware file, it is detected whether the firmware uses CRC verification.

Images