A Large Scale Analysis of the Security of Embedded Firmwaress3.eurecom.fr/slides/usenixsec14_costin.slides.pdf · Andrei Costin 72 References [1] A. Costin, J. Zaddach, A. Francillon,
Post on 04-Aug-2020
2 Views
Preview:
Transcript
A Large Scale Analysis of the Securityof Embedded Firmwares
A. Costin, J. Zaddach, A. Francillon, D. Balzarotti
EURECOM, France
20th August 2014
USENIX Security '14 – San Diego, USA
Andrei Costin2
Embedded Systems Are Everywhere
By Wilgengebroed on Flickr [CC-BY-2.0]
Andrei Costin3
Smarter & More Complex
By Wilgengebroed on Flickr [CC-BY-2.0]
Andrei Costin4
Heavily Interconnected
By Wilgengebroed on Flickr [CC-BY-2.0]
Andrei Costin5
Many Examples of Insecure Embedded Systems
● Routers
Andrei Costin6
Many Examples of Insecure Embedded Systems
● Routers● Printers
Andrei Costin7
Many Examples of Insecure Embedded Systems
● Routers● Printers● VoIP
Andrei Costin8
Many Examples of Insecure Embedded Systems
● Routers● Printers● VoIP● Cars
Andrei Costin9
Many Examples of Insecure Embedded Systems
● Routers● Printers● VoIP● Cars● Drones
Andrei Costin10
Many Examples of Insecure Embedded Systems
● Routers● Printers● VoIP● Cars● Drones● ...
Andrei Costin11
Many Examples of Insecure Embedded Systems
● Routers● Printers● VoIP● Cars● Drones● ...
● Each of above is a result of an individual analysis● Manual and tedious efforts, Does not scale
Andrei Costin12
The Goal
Perform a large scale analysis to provide a better
undestanding of the problem
Andrei Costin13
The Problem WithLarge Scale Analysis
● Heterogeneity of● Hardware, architectures, OSes● Users, requirements● Security goals
Andrei Costin14
The Problem WithLarge Scale Analysis
● Heterogeneity of● Hardware, architectures, OSes● Users, requirements● Security goals
● Manual analysis does not scale, it requires● Finding and downloading the firmwares● Unpacking and performing initial analysis● Re-discovering the same or similar bug in other
firmwares
Andrei Costin15
Previous Approaches
● Test on real devices [Bojinov09CCS]● Accurate results● Does not scale well
Andrei Costin16
Previous Approaches
● Test on real devices [Bojinov09CCS]● Accurate results● Does not scale well
● Scan devices on the Internet● Large scale testing [Cui10ACSAC]
– Can only test for known vulnerabilities– Blackbox approach
● More is too intrusive [Census2012]
Andrei Costin17
Our Approach to TheLarge Scale Analysis
● Collect a large number of firmware images
Andrei Costin18
Our Approach to TheLarge Scale Analysis
● Collect a large number of firmware images● Perform broad but simple static analysis
Andrei Costin19
Our Approach to TheLarge Scale Analysis
● Collect a large number of firmware images● Perform broad but simple static analysis● Correlate across firmwares
Andrei Costin20
Our Approach to TheLarge Scale Analysis
● Collect a large number of firmware images● Perform broad but simple static analysis● Correlate across firmwares● Advantages
● No intrusive online testing, no devices involved● Scalable
Andrei Costin21
Our Approach to TheLarge Scale Analysis
● Collect a large number of firmware images● Perform broad but simple static analysis● Correlate across firmwares● Advantages
● No intrusive online testing, no devices involved● Scalable
● But many challenges
Andrei Costin22
Mainstream SystemsHave Centralized Updates
Andrei Costin23
Challenge: Embedded SystemsHave No Centralized Updates
Andrei Costin24
Collecting a Dataset
● No large scale firmware dataset yet● As opposed to existing datasets in security or other
CS research areas
Andrei Costin25
Collecting a Dataset
● No large scale firmware dataset yet● As opposed to existing datasets in security or other
CS research areas
● We collected a subset of the firmwares available for download
Andrei Costin26
Collecting a Dataset
● No large scale firmware dataset yet● As opposed to existing datasets in security or other
CS research areas
● We collected a subset of the firmwares available for download
● Many firmwares are not publicly available● Not intended to have an upgrade● Require product purchase and registration
Andrei Costin27
Collecting a Dataset
● No large scale firmware dataset yet● As opposed to existing datasets in security or other
CS research areas
● We collected a subset of the firmwares available for download
● Many firmwares are not publicly available● Not intended to have an upgrade● Require product purchase and registration
● www.firmware.re project
Andrei Costin28
Challenge:Firmware Identification
Clearly a Firmware
Andrei Costin29
Challenge:Firmware Identification
Clearly a Firmware Clearly not a Firmware
Andrei Costin30
Challenge:Firmware Identification
Clearly a Firmware Clearly not a Firmware
Uncertain
Andrei Costin31
Challenge:Firmware Identification
● E.g., upgrade by printing a PS document
Andrei Costin32
Challenge:Unpacking & Custom Formats
● How to reliably unpack and learn formats?
Andrei Costin33
Challenge:Unpacking & Custom Formats
● How to reliably unpack and learn formats?● E.g., vendor provides a .ZIP 'firmware package'
● .ZIP→.EXE+.PS– .EXE→self-extracting archive
● Extract more or not?● Turns out to contain a printer driver inside
Andrei Costin34
Challenge:Unpacking & Custom Formats
● How to reliably unpack and learn formats?● E.g., vendor provides a .ZIP 'firmware package'
● .ZIP→.EXE+.PS– .EXE→self-extracting archive
● Extract more or not?● Turns out to contain a printer driver inside
– .PS→ASCII85 stream→ELF file that could be:● A complete embedded system software● An executable performing the firmware upgrade● A firmware patch
Andrei Costin35
Challenge:Unpacking & Custom Formats
● How to reliably unpack and learn formats?● E.g., vendor provides a .ZIP 'firmware package'
● .ZIP→.EXE+.PS– .EXE→self-extracting archive
● Extract more or not?● Turns out to contain a printer driver inside
– .PS→ASCII85 stream→ELF file that could be:● A complete embedded system software● An executable performing the firmware upgrade● A firmware patch
● Often, a firmware image→just 'data' binary blob
Andrei Costin36
Our Approach to Unpacking & Custom Formats
● We compared existing tools● Used BAT (Binary Analysis Toolkit)
● Extended it with multiple custom unpackers● Continuous development effort
Andrei Costin37
Our Approach to Unpacking & Custom Formats
● We compared existing tools● Used BAT (Binary Analysis Toolkit)
● Extended it with multiple custom unpackers● Continuous development effort
● Often, a firmware image→just 'data' binary blob● File carving required● Bruteforce at every offset with all known unpackers
Andrei Costin38
Our Approach to Unpacking & Custom Formats
● We compared existing tools● Used BAT (Binary Analysis Toolkit)
● Extended it with multiple custom unpackers● Continuous development effort
● Often, a firmware image→just 'data' binary blob● File carving required● Bruteforce at every offset with all known unpackers
● Heuristics for detecting when to stop
Andrei Costin39
Challenge:Scalability & Computational Limits
● Unpacking and file carving is very CPU intensive
Andrei Costin40
Challenge:Scalability & Computational Limits
● Unpacking and file carving is very CPU intensive
● Results in millions of unpacked files ● Manual analysis infeasible● One-to-one fuzzy hash comparison is CPU
intensive
Andrei Costin41
Challenge:Results Confirmation
● An issue found statically● May not apply to a real-device● Cannot guarantee exploitability● E.g., vulnerable daemon present but never started
Andrei Costin42
Challenge:Results Confirmation
● An issue found statically● May not apply to a real-device● Cannot guarantee exploitability● E.g., vulnerable daemon present but never started
● Issue confirmation is difficult● Requires advanced analysis (static & dynamic)● Often requires real embedded devices● Does not scale well in heterogeneous environments
Andrei Costin43
Architecture
Internet
Crawl
Firmware Datastore
Andrei Costin44
Architecture
Internet Public Web Interface
Crawl Submit
Firmware Datastore
Andrei Costin45
Architecture
Internet Public Web Interface
Crawl Submit
Firmware Datastore
FirmwareAnalysis Cloud
Andrei Costin46
Architecture
Internet Public Web Interface
Crawl Submit
Firmware Datastore
Master
FirmwareAnalysis Cloud
Andrei Costin47
Architecture
Internet Public Web Interface
Crawl Submit
Firmware Datastore
Master
Workers
Distribute
UnpackingStatic AnalysisFuzzy Hashing
FirmwareAnalysis Cloud
Password Hash Cracker
Andrei Costin48
Architecture
Internet Public Web Interface
Crawl Submit
Firmware Datastore
Master
Workers
Distribute
UnpackingStatic AnalysisFuzzy Hashing
Firmware Analysis & Reports DB
FirmwareAnalysis Cloud
Password Hash Cracker
Andrei Costin49
Architecture
Internet Public Web Interface
Crawl Submit
Firmware Datastore
Master
Workers
Distribute
UnpackingStatic AnalysisFuzzy Hashing
Firmware Analysis & Reports DB
FirmwareAnalysis Cloud
Password Hash Cracker
Data Enrichment
Correlation Engine
Andrei Costin50
Crawler
● 759 K collected files, 1.8 TB of disk space
Andrei Costin51
Crawler
● 759 K collected files, 1.8 TB of disk space● FTP-index engines
Andrei Costin52
Crawler
● 759 K collected files, 1.8 TB of disk space● FTP-index engines and GCSE
Andrei Costin54
Unpacking
● 759 K total files collected
● 172 K filtered interesting files
● 32 K analyzed
● 26 K unpacked (fully or partially)
● 1.7 M resulted files after unpacking
Filter non firmware
Random selection
Successful unpack
Unpacked files
Andrei Costin55
Static Analysis
● Correlation/clustering● Fuzzy hashes, Private SSL keys, Credentials
● Misconfigurations● Web-server configs, Credentials, Code repositories
● Data enrichment● Version banners● Keywords (e.g., telnet, shell, UART, backdoor)
Andrei Costin56
Example: Correlation
● Correlation via fuzzy-hashes (ssdeep, sdhash)● E.g., Vulnerability Propagation
Firmware 1
Andrei Costin57
Example: Correlation
● Correlation via fuzzy-hashes (ssdeep, sdhash)● E.g., Vulnerability Propagation
Firmware 1
Andrei Costin58
Example: Correlation
● Correlation via fuzzy-hashes (ssdeep, sdhash)● E.g., Vulnerability Propagation
Firmware 1
Firmware 2
Firmware 3
95%
99%
0%
Firmware 4
Firmware 5
Andrei Costin59
Example: Correlation
● Correlation via fuzzy-hashes (ssdeep, sdhash)● E.g., Vulnerability Propagation
Firmware 1
Firmware 2
Firmware 3
95%
99%
0%
Firmware 4
Firmware 5
Andrei Costin60
Example: Correlation
● Correlation via fuzzy-hashes (ssdeep, sdhash)● E.g., Vulnerability Propagation
Firmware 1
Firmware 2
Firmware 3
95%
99%
0%
Firmware 4
Firmware 5
Andrei Costin61
Private RSA keys
● SSL keys correlation + vulnerability propagation
Example: RSA Keys
Andrei Costin62
Analysis & Reports Database
Private RSA keys
● SSL keys correlation + vulnerability propagation
Example: RSA Keys
Andrei Costin63
Analysis & Reports Database
Private RSA keys
VendorA Device1
● SSL keys correlation + vulnerability propagation
Example: RSA Keys
Andrei Costin64
Analysis & Reports Database
Private RSA keys
VendorA
HTTPS Ecosystem Scans
1 key → ~30.000 IPs
Device1
Check ZMap IP addresses
● SSL keys correlation + vulnerability propagation
Example: RSA Keys
Andrei Costin65
Analysis & Reports Database
Private RSA keys
VendorA
HTTPS Ecosystem Scans
1 key → ~30.000 IPs
VendorB
SAME private RSASAME self-signed SSL certificateDIFFERENT vendor
Device1
Device2
Check ZMap IP addresses
● SSL keys correlation + vulnerability propagation
Example: RSA Keys
Andrei Costin66
Analysis & Reports Database
Private RSA keys
VendorA
HTTPS Ecosystem Scans
1 key → ~30.000 IPs
VendorB
SAME private RSASAME self-signed SSL certificateDIFFERENT vendor
Device1
Device2
Check ZMap IP addresses
Common Vulnerable Components
● SSL keys correlation + vulnerability propagation
Example: RSA Keys
Andrei Costin67
Results: Summary
● 38 new vulnerabilities (CVE)
● Correlated them to 140 K online devices
● Affected 693 firmware files by at least one vuln
Andrei Costin68
Contributions Summary
● First large-scale static analysis of firmwares● Described the main challenges associated ● Shown the advantages of performing a large-
scale analysis of firmware images● Implemented a framework and several efficient
static techniques
Andrei Costin69
Conclusions
● A broader view on firmwares● Not only beneficial● But necessary for discovery and analysis of
vulnerabilities
● Correlation reveals firmware relatioship● Shows how vulnerabilities reappear across different
products● Could allow seeing how firmwares evolve/get fixed
Andrei Costin70
Conclusions
● There are plenty of latent vulnerabilities
● Security● Tradeoff with cost and time-to-market● Clearly not a priority for some vendors
Andrei Costin71
Thank You!Questions?
{name.surname}@eurecom.fr
Andrei Costin72
References● [1] A. Costin, J. Zaddach, A. Francillon, D. Balzarotti,
”A Large-Scale Analysis of the Security of Embedded Firmwares”, In Proceedings of the 23rd USENIX Conference on Security (to appear)
● [2] A. Costin, J. Zaddach, ”Poster: Firmware.RE: Firmware Unpacking and Analysis as a Service”, In Proceedings of the ACM Conference on Security and Privacy in Wireless Mobile Networks (WiSec) '14
● [3] A. Costin, A. Francillon, ”Short paper: A Dangerous 'Pyrotechnic Composition': Fireworks, Embedded Wireless and Insecurity-by-Design”, In Proceedings of the ACM Conference on Security and Privacy in Wireless Mobile Networks (WiSec) '14
top related