Vulnerability scanning method for Web service in embedded firmware

Abstract

The invention provides a vulnerability scanning method for a Web service in embedded firmware. The method comprises the following steps: step 1, unpacking target firmware and separating and extracting a front-end file and a rear-end binary file; 2, performing correlation analysis on the front-end file and the rear-end binary file to identify a boundary binary file; wherein the boundary binary file is a binary file used for processing Web service data; 3, identifying an external data introduction point in the boundary binary file; step 4, filtering dangerous functions in the boundary binary file; and 5, performing coarse-grained taint analysis by taking an external data introduction point as a source point and taking the filtered danger function as a sink point.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a vulnerability scanning method for Web services in embedded firmware. Background Art

[0002] The functionality of IoT devices is mainly provided by firmware, which is the underlying software that controls the device hardware and plays a key role in ensuring that the device operates as expected. As more and more devices are connected to the IoT, attacks on firmware are becoming more common. Once attackers gain access, it is possible to remotely control the device, steal sensitive data, or even use the device as a springboard for further network attacks. Firmware usually restricts external users' access to the firmware, allowing only authorized users or system administrators to perform partial access and modification. In order to allow users to operate the device intuitively, the most common practice is to provide a specific terminal program or web interface. Therefore, the web interface is usually exposed as the surface of IoT devices and is subject to a large number of attacks.

[0003] In recent years, there have been many works on discovering firmware vulnerabilities, including static analysis and dynamic analysis. In dynamic analysis, the mainstream method is to discover vulnerabilities by gray-box fuzz testing through simulation technology or black-box fuzz testing on physical devices. Dynamic analysis technology can provide contextual information under running conditions, but given the complexity and variability of the IoT environment and the unavailability of source code and documents, whether black-box or gray-box testing methods are used, it is often difficult to fully explore the code execution path, which can easily lead to the omission of vulnerabilities. Compared with dynamic analysis, static analysis technology can achieve higher code coverage because it does not need to execute code in the actual running environment, making it a more practical and cost-effective method for detecting embedded firmware security.

[0004] According to the literature and the actual analysis results of existing vulnerabilities by researchers, the front-end input parameters of the firmware's Web service have a certain correlation with the data receiving point in the firmware boundary binary program. The vulnerabilities in the firmware are usually caused by the back-end binary file calling a dangerous function when processing the front-end data, thus triggering the so-called taint-type vulnerability. Whether the taint-type vulnerability in the firmware Web service can be discovered depends largely on a good data dependency analysis tool. In fact, to discover defects, the tool must construct a path for the pollution to propagate from the attacker-controlled source to the security-sensitive receiver.

[0005] Currently, there are two main obstacles to effectively analyzing Web services in embedded systems to detect vulnerabilities: 1) There are complex interactions and implicit dependencies between the front-end and the back-end, making it impossible to accurately determine the source of contamination. 2) In the process of data flow tracking, it is impossible to balance efficiency and accuracy. Summary of the invention

[0006] In order to accurately discover vulnerabilities of Web services in embedded firmware and improve the efficiency of vulnerability discovery, the present invention provides a vulnerability scanning method for Web services in embedded firmware.

[0007] The present invention provides a vulnerability scanning method for Web services in embedded firmware, comprising:

[0008] Step 1: Unpack the target firmware and separate the front-end files and back-end binary files;

[0009] Step 2: Perform correlation analysis on the front-end file and the back-end binary file to identify the boundary binary file; wherein the boundary binary file refers to the binary file used to process Web service data;

[0010] Step 3: Identify the external data introduction points in the boundary binary file;

[0011] Step 4: Filter dangerous functions in the boundary binary file;

[0012] Step 5: Take the external data introduction point as the source point and the filtered hazard function as the sink point to perform coarse-grained taint analysis.

[0013] Furthermore, step 2 specifically includes:

[0014] Extract HTML tags from the front-end file to obtain a first keyword set, extract HTTP header fields from the front-end file to obtain a second keyword set, extract transfer parameters from the front-end file to obtain a third keyword set, and merge the three keyword sets;

[0015] Extract strings from each backend binary file, and match the extracted strings with the merged keyword set;

[0016] The backend binary file that has three types of keywords and the largest number of matching keywords is used as the boundary binary file.

[0017] Furthermore, the HTML tag is a structural tag, and the HTTP header field is a common header field of HTTP / 1.1.

[0018] Furthermore, the transfer parameters are extracted from the front-end file to obtain a third type of keyword set, which specifically includes:

[0019] For front-end files in HTML and XML formats, regular expressions are used to extract transfer parameters as the third type of keywords;

[0020] For the front-end file in JavaScript format, it is parsed into an abstract syntax tree AST, and each Literal node of the AST is scanned to extract the value from the value attribute as the third type of keyword.

[0021] Furthermore, it also includes: using a preset filtering rule to filter out invalid keywords in the merged keyword set; the preset filtering rule specifically includes:

[0022] Remove strings with special characters;

[0023] If the string ends with "=", only the characters to the left of "=" are retained;

[0024] If a JavaScript-formatted front-end file is referenced by multiple HTML-formatted front-end files, the string extracted from the JavaScript-formatted front-end file will be deleted from the merged keyword set;

[0025] If a string is referenced by multiple front-end files, the string will be deleted from the merged keyword set.

[0026] Furthermore, the external data introduction point includes a request body parameter introduction function, an HTTP header introduction function and a configuration information setting function.

[0027] Furthermore, the process of identifying the request body parameter introduction function in the boundary binary file includes:

[0028] The functions with higher frequency of keyword references are selected as candidate functions;

[0029] If the candidate function uses the C standard library function, it is introduced into the function as a request body parameter; if the candidate function does not use the C standard library function, it is checked whether the candidate function is a strcmp-like function. If it is a strcmp-like function and has a return value or parameter position to save the value, it is introduced into the function as a request body parameter.

[0030] Furthermore, the process of identifying the request body parameter introduction function in the boundary binary file also includes:

[0031] If the candidate function does not use C standard library functions, then check the names of the candidate functions and mark the functions with keywords related to Web input in their names;

[0032] Correspondingly, it is preferred to check whether the marked candidate function is a strcmp-like function.

[0033] Furthermore, the process of identifying the HTTP header introduction function in the boundary binary file includes:

[0034] Identify the function location that references the HTTP header field, check whether the function is a strcmp-like function, and if it is a strcmp-like function, introduce the function as an HTTP header introduction function.

[0035] Furthermore, the process of identifying the configuration information setting function in the boundary binary file includes:

[0036] A first function and a second function that reference the same external keyword are identified from the imported library functions, and the first function and the second function are compared. If the two functions differ only in name, the first function and the second function are considered to be configuration information setting functions.

[0037] Furthermore, step 4 specifically includes:

[0038] For different types of hazard functions, filter rules corresponding to each type of hazard function are pre-written according to the parameter characteristics of each type of hazard function;

[0039] Dangerous functions in the boundary binary file are filtered using the filtering rules corresponding to each type of dangerous function.

[0040] Furthermore, in step 5, the taint propagation rules used in the taint analysis specifically include:

[0041] Define the functions involved in the function call path as inward propagation functions, define the dangerous functions as termination functions, and define other functions as downward propagation functions;

[0042] For the inward propagation function, trace the contaminated parameters into the function for propagation;

[0043] For the termination function, check whether the polluted parameter is a dangerous parameter, and output an alarm if it is;

[0044] For the downward propagation function, only its parameters and return values ​​are polluted without tracking the entry function, and the downward propagation continues in the original function.

[0045] Beneficial effects of the present invention:

[0046] (1) The present invention can reduce the pollution sources (source points) that need to be analyzed by accurately identifying the external data introduction function, can reduce the sink points that need to be analyzed based on dangerous function filtering, obtain sensitive function call paths from source points to sink points, and design lightweight pollution propagation rules for taint analysis. The present invention can discover vulnerabilities in real devices. Compared with the most advanced static analysis tool SaTC, the present invention is more accurate in identifying pollution sources, obtains fewer sensitive call paths, has higher efficiency in taint analysis, and can discover unknown vulnerabilities that SaTC cannot discover.

[0047] (2) The present invention analyzes the correlation relationship between the front-end and the back-end, and finds that the boundary binary file used for data interaction with the front-end has obvious features related to the HTTP service, and the data transmitted by the front-end is usually in the form of KEY-VALUE key-value pairs. The data is usually read by the external data introduction function of the key-value type in the boundary binary file through the index KEY. Therefore, the present invention introduces feature keywords strongly associated with the front-end to identify the boundary binary file, and analyzes and summarizes the features of the external data introduction function, which can accurately identify the external data introduction function as a pollution source. Therefore, in the identification of the boundary binary file and its pollution source, the present invention is more accurate than SaTC, and solves the problem that there are complex interactions and implicit dependencies between the front-end and the back-end, and the pollution source cannot be accurately determined.

[0048] (3) Existing work directly uses dangerous functions in the program as receivers. However, the amount of real firmware program code is huge, in which a large number of dangerous functions may be called. Blindly using dangerous functions as receivers for analysis is costly. Therefore, the present invention filters dangerous functions by designing filtering rules based on the abstract syntax tree (AST) nodes of the decompiled code, thereby obtaining more accurate sink points. By accurately identifying the filtered source points and sink points, the sensitive function call paths that need to be analyzed are reduced, thereby balancing the efficiency and accuracy of vulnerability identification.

[0049] (4) The accuracy and efficiency of taint analysis are limited by the complexity and size of the program. Existing work designs complex taint propagation rules. For large and complex programs, the analysis may become very time-consuming and the accuracy of the results may decrease. Therefore, the present invention designs a lightweight inter-function taint propagation specification on the basis of reducing sensitive function call paths, which greatly improves the efficiency of taint analysis and further balances the efficiency and accuracy of vulnerability identification. In addition, since the function call specification is simplified, path explosion can be avoided during the analysis process, so the present invention discovers more and deeper vulnerabilities than SaTC. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A schematic diagram of a flow chart of a vulnerability scanning method for embedded firmware Web services provided by an embodiment of the present invention;

[0051] Figure 2 A characteristic schematic diagram of a boundary binary file provided by an embodiment of the present invention;

[0052] Figure 3 A schematic diagram of a taint propagation specification provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution in the embodiment of the present invention will be clearly described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] The firmware of embedded devices is user-oriented. In order to facilitate the provision of operating system device hardware functions, the firmware of most embedded devices provides a Web interface for users to configure and manage. These Web interfaces are the main way for embedded devices to be attacked. The Web interface is generally composed of a front-end page and a back-end file. The front-end file builds a complete Web page and presents it to the user through a browser, providing the user with an interactive interface for operating the device. The back-end file is used to respond to Web requests from the front-end file and build the complete functions of the Web application by communicating with the front-end page. The front-end input parameters of the firmware's Web service have a certain correlation with the data receiving point in the firmware boundary binary program. The vulnerability in the firmware is usually that the back-end binary file calls a dangerous function when processing the front-end data, thereby causing the so-called taint vulnerability.

[0055] like Figure 1 As shown, an embodiment of the present invention provides a vulnerability scanning method for an embedded firmware Web service, comprising the following steps:

[0056] S101: unpacking the target firmware and extracting the front-end file and the back-end binary file separately;

[0057] S102: performing correlation analysis on the front-end file and the back-end binary file to identify a boundary binary file; wherein the boundary binary file refers to a binary file used to process Web service data;

[0058] It can be understood that there are many binary programs in the firmware, but there are few boundary binary programs that are actually used to process Web service data. The main function of the boundary binary program is to process Web service data. It contains the logic necessary to receive user requests from external sources, so it is more closely associated with the front-end script file than other types of programs. Therefore, the present invention analyzes the correlation between the front-end file and the back-end binary file, extracts the correlation features and combines them with the preset features, and then identifies the boundary binary file from a large number of back-end binary files.

[0059] S103: Identify the external data introduction point in the boundary binary file;

[0060] S104: filtering dangerous functions in the boundary binary file;

[0061] It is understandable that during the vulnerability analysis process, dangerous functions are used as sink functions at the execution end point, but not every call to a dangerous function is harmful, so harmless dangerous functions need to be filtered.

[0062] Specifically, the embodiments of the present invention mainly analyze dangerous functions that cause buffer overflow, command injection, and format string taint vulnerabilities, and find that taint vulnerabilities are caused by the specific parameter positions of dangerous functions being controllable by users. Therefore, the embodiments of the present invention believe that only when the dangerous parameter positions of these dangerous functions are controllable by users can vulnerabilities be caused.

[0063] S105: Taking the external data introduction point as the source point and the filtered hazard function as the sink point, a coarse-grained stain analysis is performed.

[0064] The vulnerability scanning method for embedded firmware Web services provided by the embodiment of the present invention can reduce the pollution sources (source points) that need to be analyzed by accurately identifying the external data introduction points, can reduce the sink points that need to be analyzed based on dangerous function filtering, obtain sensitive function call paths from source points to sink points, and perform coarse-grained taint analysis. The embodiment of the present invention can discover vulnerabilities in real devices. Compared with the most advanced static analysis tool SaTC, the embodiment of the present invention is more accurate in pollution source identification, obtains fewer sensitive call paths, has higher efficiency in taint analysis, and can discover unknown vulnerabilities that SaTC cannot discover.

[0065] In one embodiment, an implementable method of boundary binary identification based on front-end and back-end association is provided, which is specifically described as follows:

[0066] It can be understood that in the firmware backend, the boundary binary file exports the device functions to the frontend and accepts user input from the frontend for processing. After the boundary binary file receives the data packet sent by the frontend, it needs to parse the data packet and make a corresponding response. Therefore, the idea of ​​the embodiment of the present invention is to summarize the corresponding features to identify the boundary binary file.

[0067] Specifically, the boundary binary file may have the function of generating the corresponding front-end interface, such as Figure 2 As shown in (a), an HTML error page is generated because the URL cannot be found. Boundary binaries usually verify the HTTP request header, such as Figure 2 As shown in (b), the boundary binary file contains the string related to the HTTP header. The boundary binary file processes the parameters passed in the request body, such as Figure 2As shown in (c), the boundary binary file contains a key used to index the value. Therefore, the embodiment of the present invention mainly uses the above three features to identify the boundary binary file.

[0068] Specifically, the above three features of the boundary binary file all have corresponding feature keywords in the binary file, so the embodiment of the present invention adopts a keyword matching method to identify the boundary binary file. Among them, for the above features 1 and 2, the front-end HTML tags and HTTP header fields are collected as keywords for matching; for feature 3, it is necessary to extract the passing parameter keywords in the front-end file. Then, strings are extracted from each back-end binary file and try to match them with the pre-established feature keywords. Back-end files with three features are given priority, and then the back-end binary file with the maximum matching feature keyword is regarded as the boundary binary file. The above matching and identification process can be expressed as shown in (1):

[0069] Border=MAX((K1∪K2∪K3)∩Si)(1)

[0070] Among them, K1, K2 and K3 are keyword sets extracted from three features respectively, and Si is the keyword set extracted from the i-th backend binary file in the firmware.

[0071] In one embodiment, common HTML tags and HTTP / 1.1 common header fields are collected as keywords for feature 1 and feature 2, as shown in Table 1. For the keywords for feature 1, HTML tags include many types such as structure tags, text tags, list tags, etc., and since structure tags are the most commonly used and the most indispensable part of an HTML document, the embodiment of the present invention only selects structure tags as keywords. For the keywords for feature 2, the embodiment of the present invention collects HTTP / 1.1 common header fields as comprehensively as possible as keywords.

[0072] Table 1

[0073]

[0074] For the keywords of feature 3, the embodiment of the present invention analyzes the front-end script and extracts potential keywords requested by the user as keywords. At present, the front-end script files of IoT devices mainly include html, JavaScript, and xml, so the embodiment of the present invention takes these three types of files as the main analysis objects. Since HTML files have a standard format, regular expressions are used to extract keywords, such as the values ​​of id, name, and action attributes. XML-based services usually use a fixed format to mark input data in their XML files. Therefore, the embodiment of the present invention also uses regular expressions to extract keywords based on its format. The format of JavaScript is ever-changing, and regular expressions cannot correctly identify keywords. Therefore, the embodiment of the present invention parses the JavaScript file into an abstract syntax tree (AST) and scans each Literal node to extract values ​​from the value attribute.

[0075] Furthermore, it should be noted that the strings collected from HTML, XML and AST may contain many false keywords, which not only brings a great burden to the next step of string matching, but also introduces false positives in error detection. For example, the string targets commonly used in the front end do not have corresponding objects in the back end. Therefore, in order to filter invalid keywords, the embodiment of the present invention designs the following filtering rules based on experience:

[0076] Rule 1: Remove strings with special characters, such as ! and @; this is because these special characters will be escaped when the HTTP request is generated on the front end.

[0077] Rule 2: If the string ends with =, keep the left part and discard the right part. Figure 2 In the wanMTU=, only the parameter name will be reused on the backend.

[0078] After filtering using the above two rules, the candidate list may still contain many interference items that are not used as input keywords. In order to further reduce the complexity of subsequent modules, the embodiment of the present invention uses two heuristic methods to identify them and exclude them from the keyword set, namely, the subsequent rules 3 and 4.

[0079] Rule 3: If a JavaScript file is referenced by a large number of HTML files, the embodiment of the present invention will treat it as a common shared library, just like the chart library. Since library files usually do not contain input keywords, the embodiment of the present invention will ignore all candidates in such files.

[0080] Rule 4: If a keyword is referenced by multiple front-end files, such as Button and Cancel, it may be an ordinary string rather than an input keyword, so the embodiment of the present invention will also delete these keywords from the candidate list.

[0081] In one embodiment, an implementation method for identifying the introduction point of external data in a boundary binary file is provided, which is specifically described as follows:

[0082] It can be understood that the external data introduction function of the external data introduction point usually refers to a function that obtains a value by indexing the keyword in the user request. The external data introduction function can obtain the value of the key:value type data passed in by the front end, including the value of the HTTP header and the value corresponding to the parameter in the request body, corresponding to the key of feature 2 and feature 3 of the boundary binary file.

[0083] Based on the above-mentioned characteristics of the external data introduction function, the embodiment of the present invention divides the external data introduction function into three categories: request body parameter introduction function, HTTP header introduction function and configuration information setting function, and implements the extraction of the three types of external data introduction functions according to the relevant characteristics.

[0084] (I) Request body parameter introduction function

[0085] The request body parameter import function is usually a fixed function with the following characteristics:

[0086] (1) High frequency characteristics: The request body parameter introduction function is called multiple times in different places in the program. Specifically, the request body parameter introduction function usually references the parameter keyword (feature 3 keyword) shared by the front-end and back-end, and matches the data corresponding to the keyword from the external input data. The request body parameter introduction function usually references various keywords, so it will be called a large number of times in the program. Therefore, the present invention considers functions that reference parameter keywords more frequently as candidate functions.

[0087] (2) The request body parameter introduction function may use C standard library functions such as websGetVar, getenv, nvram_get, etc. Therefore, the embodiment of the present invention first checks whether the candidate function uses the C standard library function. If the standard library function is used, it is used as the request body parameter introduction function. If the standard library function is not used, the candidate function name is checked and the function with the keyword related to Web input (such as 'Web', 'http', 'get', 'var', etc.) in the name is marked.

[0088] (3) The external data import function is usually a function similar to strcmp or obtains the address index of the value corresponding to the keyword from the external input by calling a function similar to strcmp. The present invention uniformly refers to this type of function as a strcmp-like function. Therefore, the embodiment of the present invention checks whether the candidate function is a strcmp-like function. Preferably, the marked candidate functions are checked first. While checking, it is also checked whether the parameter position or return value of the function has a pointer to save the value. The embodiment of the present invention identifies the function with the characteristics of the strcmp-like function and the return value or parameter position that saves the value as the request body parameter import function.

[0089] (II) HTTP header import function

[0090] It can be understood that the HTTP header field is not used as frequently as the request body parameter in the boundary binary, so there may be no specific import function. Based on this, the embodiment of the present invention first identifies the function position that references the HTTP header field, and then checks whether the import function is a strcmp-like function. If it is a strcmp-like function, the embodiment of the present invention considers that the function at this location that references the HTTP header field is an external data import function.

[0091] (III) Configuration information setting function

[0092] It can be understood that the configuration information setting function is usually a library function and appears in pairs, usually performing setting the value of a certain parameter (referred to as a set function in the present invention) or obtaining a certain configuration parameter (referred to as a get function in the present invention).

[0093] Specifically, the set function sometimes obtains values ​​from external input data to set device parameters, and the get function sometimes reads configuration information from the device for processing, so the present invention can splice the data streams of the set function and the get function that reference the same external keyword to ensure the comprehensiveness of vulnerability exploration. The set function and the get function are the same in naming after removing set or get, so the embodiment of the present invention can use this feature to find the configuration information setting function from the imported library function.

[0094] The embodiment of the present invention introduces characteristic keywords that are strongly associated with the front end to identify boundary binary files, and analyzes and summarizes the characteristics of external data introduction functions, which can accurately identify external data introduction functions as pollution sources. Therefore, in the identification of boundary binaries and their pollution sources, the present invention is more accurate than SaTC.

[0095] In one embodiment, an implementation method for filtering dangerous functions in a boundary binary file is provided, which is specifically described as follows:

[0096] The idea of ​​the embodiment of the present invention is to filter the dangerous function based on the dangerous parameter position by writing rules to reduce the sink points in the vulnerability analysis process. In the process of writing rules, this embodiment only writes coarse-grained rules for simple filtering to prevent false negatives.

[0097] For example, for strcpy and strcpy-like functions, the rule "the second parameter is not a constant and does not come from the strlen function" can be used. For example, for strncpy and strncpy-like functions, the rule "the second parameter is not a constant and does not come from the strlen function and the third parameter is not a constant or is a constant but larger" can be used. For example, for formatted input functions such as sprintf and sprintf-like functions, you can check whether its parameter 1 is a constant string. If not, it may lead to the format string function. If it is a constant string, find the '%s' contained in the string and determine whether the corresponding parameter satisfies the requirement of not being a constant and not coming from strlen, and record the parameter position that may lead to the vulnerability.

[0098] This embodiment collects common risk functions for classification and compiles filtering rules based on their parameter characteristics. Table 2 only shows some examples of the rules compiled in the present invention.

[0099] Table 2

[0100]

[0101] The embodiment of the present invention filters dangerous functions by designing filtering rules based on the abstract syntax tree (AST) nodes of the decompiled code, thereby obtaining more accurate sink points, and reduces the sensitive function call paths that need to be analyzed by accurately identifying and filtering source points and sink points.

[0102] In one embodiment, the present invention provides an implementable method of lightweight stain analysis, which is described in detail as follows:

[0103] After identifying the external data introduction function and filtering the dangerous function, the present invention uses the external data introduction function that references the keywords of feature 2 and feature 3 as the source point and the dangerous function as the sink point to explore the vulnerability path. First, the function call path is generated for the source point and the sink point, and then the taint analysis is performed based on the function call path and the control flow graph within the function to discover potential vulnerabilities.

[0104] Specifically, the externally introduced function of the external data introduction point is taken as the root node, and the depth-first traversal is used to search for dangerous function calls on the function's call tree and generate a call sequence. If an external data introduction point does not have any function call sequence, it is considered that there is no reachable path from the function to the potentially dangerous function, so the pollution source can be deleted from the pollution source set.

[0105] In the process of taint analysis, the influence of the taint propagation specification of function calls on the efficiency and accuracy of the analysis is the main factor. In order to refine the taint propagation process, the embodiment of the present invention divides functions into three types: downward propagation functions, inward propagation functions and termination functions. This classification is based on the role and behavior of functions in the taint propagation process and how they affect the flow of tainted data. Inward propagation functions are defined as functions involved in the function call path. The characteristic of such functions is that they allow tracking of further internal propagation of tainted parameters. When a parameter is marked as tainted, the analysis process will go deep into the function to track the propagation path of the tainted data. Termination functions are regarded as potentially dangerous functions. For such functions, the focus of the analysis is to check whether there are tainted parameters. If such parameters exist, the analysis process will trigger an alarm to indicate potential security risks. For other functions, the present invention sets them as downward propagation functions. For the downward propagation functions that are propagated, the present invention does not track the entry function, but only pollutes its specific types (such as string type, pointer type, etc.) parameters and return values, and continues to propagate downward in the original function. The key value function in the pollution source is the initial downward propagation function. Figure 3 As shown, the data receiving function is in Func_A. From Func_A to the dangerous call point Func_sink, there is a call path Func_A->Func_B->Func_sink. The present invention considers the function Func_B on the call chain as an inward broadcast function. Func_B calls Func_D before calling Fink_sink, but Func_D is not on the call chain. Therefore, the present invention regards Func_D as a downward propagation function. Func_C and Func_E call paired configuration information setting functions. Therefore, the present invention continues to explore the data flowing from Func_A through Func_C and Func_E to Func_sink2.

[0106] Furthermore, considering the factors of efficiency and accuracy, in the control flow graph, the existence of loops due to statements such as loops will cause the path exploration to fall into an infinite loop. In order to avoid this phenomenon, the access status of each basic block in the control graph is recorded and the number of visits to each basic block is limited to once.

[0107] The embodiment of the present invention designs a lightweight inter-function pollution propagation specification based on reducing sensitive function call paths, which greatly improves the efficiency of taint analysis. In addition, since the function call specification is simplified, path explosion can be avoided during the analysis process. Therefore, the present invention discovers more and deeper vulnerabilities than SaTC.

[0108] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A vulnerability scanning method for Web services in embedded firmware, characterized in that: include: Step 1: Unpack the target firmware and separate the front-end files and back-end binary files; Step 2: Perform correlation analysis on the front-end file and the back-end binary file to identify the boundary binary file; wherein the boundary binary file refers to the binary file used to process Web service data; Step 3: Identify the external data introduction points in the boundary binary file; Step 4: Filter dangerous functions in the boundary binary file; Step 5: Take the external data introduction point as the source point and the filtered hazard function as the sink point to perform coarse-grained taint analysis.

2. A vulnerability scanning method for Web services in embedded firmware according to claim 1, characterized in that: Step 2 specifically includes: Extract HTML tags from the front-end file to obtain a first keyword set, extract HTTP header fields from the front-end file to obtain a second keyword set, extract transfer parameters from the front-end file to obtain a third keyword set, and merge the three keyword sets; Extract strings from each backend binary file, and match the extracted strings with the merged keyword set; The backend binary file that has three types of keywords and the largest number of matching keywords is used as the boundary binary file.

3. A vulnerability scanning method for Web services in embedded firmware according to claim 2, characterized in that: Also includes: Using preset filtering rules to filter out invalid keywords in the merged keyword set; The preset filtering rules specifically include: Remove strings with special characters; If the string ends with "=", only the characters to the left of "=" are retained; If a JavaScript-formatted front-end file is referenced by multiple HTML-formatted front-end files, the string extracted from the JavaScript-formatted front-end file will be deleted from the merged keyword set; If a string is referenced by multiple front-end files, the string will be deleted from the merged keyword set.

4. A vulnerability scanning method for Web services in embedded firmware according to claim 2, characterized in that: The external data introduction point includes a request body parameter introduction function, an HTTP header introduction function and a configuration information setting function.

5. A vulnerability scanning method for Web services in embedded firmware according to claim 4, characterized in that: The process of identifying the request body parameter introduction function in the boundary binary file includes: The functions with higher frequency of keyword references are selected as candidate functions; If the candidate function uses the C standard library function, it is introduced into the function as a request body parameter; if the candidate function does not use the C standard library function, it is checked whether the candidate function is a strcmp-like function. If it is a strcmp-like function and has a return value or parameter position to save the value, it is introduced into the function as a request body parameter.

6. A vulnerability scanning method for Web services in embedded firmware according to claim 5, characterized in that: The process of identifying the request body parameter introduction function in the boundary binary file also includes: If the candidate function does not use C standard library functions, then check the names of the candidate functions and mark the functions with keywords related to Web input in their names; Correspondingly, it is preferred to check whether the marked candidate function is a strcmp-like function.

7. A vulnerability scanning method for Web services in embedded firmware according to claim 4, characterized in that: The process of identifying the HTTP header import function in the boundary binary file includes: Identify the function location that references the HTTP header field, check whether the function is a strcmp-like function, and if it is a strcmp-like function, introduce the function as an HTTP header introduction function.

8. A vulnerability scanning method for Web services in embedded firmware according to claim 4, characterized in that: The process of identifying the configuration information setting function in the boundary binary file includes: A first function and a second function that reference the same external keyword are identified from the imported library functions, and the first function and the second function are compared. If the two functions differ only in name, the first function and the second function are considered to be configuration information setting functions.

9. A vulnerability scanning method for Web services in embedded firmware according to any one of claims 1 to 8, characterized in that: Step 4 specifically includes: For different types of hazard functions, filter rules corresponding to each type of hazard function are pre-written according to the parameter characteristics of each type of hazard function; Dangerous functions in the boundary binary file are filtered using the filtering rules corresponding to each type of dangerous function.

10. A vulnerability scanning method for Web services in embedded firmware according to claim 9, characterized in that: In step 5, the taint propagation rules used in the taint analysis specifically include: Define the functions involved in the function call path as inward propagation functions, define the dangerous functions as termination functions, and define other functions as downward propagation functions; For the inward propagation function, trace the contaminated parameters into the function for propagation; For the termination function, check whether the polluted parameter is a dangerous parameter, and output an alarm if it is; For the downward propagation function, only its parameters and return values ​​are polluted without tracking the entry function, and the downward propagation continues in the original function.

Images