ProXray: Protocol Model Learning and Guided Firmware Analysis
ProXray: Protocol Model Learning and Guided Firmware Analysis
复制标题
DOI：
10.1109/tse.2019.2939526
复制
发表时间：
2019-09
影响因子：
7.4
通讯作者：
Farhaan Fowze;D. Tian;Grant Hernandez;Kevin R. B. Butler;Tuba Yavuz
中科院分区：
文献类型：
--
作者：
Farhaan Fowze;D. Tian;Grant Hernandez;Kevin R. B. Butler;Tuba Yavuz
2018 年初，全球物联网 (IoT) 数量已达到 70 亿，在日常生活中几乎无处不在。了解这些设备的使用是否安全变得至关重要。 IoT 设备通常在固件中实现 USB 和蓝牙等通信协议，以实现广泛的功能。因此，使用这些协议中的领域知识来分析固件对于了解设备行为、检测实施错误和识别恶意组件至关重要。不幸的是，由于这些协议的复杂性，通常没有正式的规范可以帮助自动化固件分析；因此，目前需要大量的手动工作来研究这些协议并对设备固件进行逆向工程。在本文中，我们提出了一种名为 ProXray 的使用符号执行的新固件分析方法，该方法可以从已知固件中学习协议模型，并应用该模型来识别协议相关字段并自动检测未知固件中的功能。训练阶段结束后，ProXray 可以完全自动化固件分析过程，同时支持用户以协议相关约束的形式进行查询。我们通过从实现这些协议的固件中学习协议约束模型，将 ProXray 应用于 USB 和蓝牙协议。然后，我们能够在所有 6 个未知 USB 固件中自动映射协议字段并识别 USB 功能，同时在未知蓝牙固件中达到协议相关目标方面实现超过一个数量级的加速。我们的模型实现了 USB 和蓝牙规范几个重要协议领域的高覆盖。 ProXray 提供了一种将领域知识自动应用于固件分析的新方法。
The number of Internet of Things (IoT) has reached 7 billion globally in early 2018 and are nearly ubiquitous in daily life. Knowing whether or not these devices are safe and secure to use is becoming critical. IoT devices usually implement communication protocols such as USB and Bluetooth within firmware to allow a wide range of functionality. Thus analyzing firmware using domain knowledge from these protocols is vital to understand device behavior, detect implementation bugs, and identify malicious components. Unfortunately, due to the complexity of these protocols, there is usually no formal specification available that can help automate the firmware analysis; as a result significant manual effort is currently required to study these protocols and to reverse engineer the device firmware. In this paper, we propose a new firmware analysis methodology using symbolic execution called ProXray, which can learn a protocol model from known firmware, and apply the model to recognize the protocol relevant fields and detect functionality within unknown firmware automatically. After the training phase, ProXray can fully automate the firmware analysis process while supporting user’s queries in the form of protocol relevant constraints. We have applied ProXray to the USB and the Bluetooth protocols by learning protocol constraint models from firmware that implement these protocols. We are then able to map protocol fields and identify USB functionality automatically within all 6 unknown USB firmware while achieving more than an order of magnitude speedup in reaching protocol relevant targets in unknown Bluetooth firmware. Our model achieved high coverage of the USB and Bluetooth specifications for several important protocol fields. ProXray provides a new method to apply domain knowledge to firmware analysis automatically.