FirmSolo: Enabling dynamic analysis of binary Linux-based IoT kernel modules
FirmSolo: Enabling dynamic analysis of binary Linux-based IoT kernel modules
复制标题
DOI：
--
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
Ioannis Angelakopoulos;G. Stringhini;Manuel Egele
中科院分区：
文献类型：
--
作者：
Ioannis Angelakopoulos;G. Stringhini;Manuel Egele
在物联网（IoT）设备上运行的基于Linux的固件很复杂，由用户级程序和内核级代码组成。这两个组件都被证明存在严重的安全漏洞，与内核漏洞相关的风险特别高，因为这些漏洞可能导致整个系统受损。然而，以前的工作只集中在嵌入式固件的用户空间组件。在本文中，我们介绍了Firmware Soluti on（FirmSolo），这是一个旨在将内核空间纳入固件分析的系统。FirmSolo提供内核配置逆向工程（K.C.R.E.）利用信息的过程（即，导出的和所需的符号和版本魔术）来构建可以在仿真环境中加载模块的内核。此功能允许下游分析将其范围扩展到以特权模式执行的代码。我们在包含56,688个内核模块的1,470个图像上评估了FirmSolo，其中它加载了64%的内核模块。为了演示FirmSolo如何帮助下游分析，我们将其与两个代表性的分析系统集成; TriforceAFL内核模糊器和Firmadyne，一个动态固件分析工具，最初没有内核模式分析功能。我们在75个内核模块的子集上进行的TriforceAFL实验在11个不同的专有模块中发现了19个以前未知的错误。通过Firmadyne，我们确认了84个固件映像中存在这些以前未知的漏洞。此外，通过使用FirmSolo，Firmadyne在15个固件映像中确认了封闭源代码Kcodes NetUSB模块的五个不同版本中的一个先前已知的内存损坏漏洞。
The Linux-based firmware running on Internet of Things (IoT) devices is complex and consists of user level programs as well as kernel level code. Both components have been shown to have serious security vulnerabilities, and the risk linked to kernel vulnerabilities is particularly high, as these can lead to full system compromise. However, previous work only focuses on the user space component of embedded firmware. In this paper, we present Firm ware Sol uti o n ( FirmSolo ), a system designed to incorporate the kernel space into firmware analysis. FirmSolo features the Kernel Configuration Reverse Engineering (K.C.R.E.) process that leverages information (i.e., exported and required symbols and version magic) from the kernel modules found in firmware images to build a kernel that can load the modules within an emulated environment. This capability allows downstream analysis to broaden their scope into code executing in privileged mode. We evaluated FirmSolo on 1,470 images containing 56,688 kernel modules where it loaded 64% of the kernel modules. To demonstrate how FirmSolo aids downstream analysis, we integrate it with two representative analysis systems; the TriforceAFL kernel fuzzer and Firmadyne, a dynamic firmware analysis tool originally devoid of kernel mode analysis capabilities. Our TriforceAFL experiments on a subset of 75 kernel modules discovered 19 previously-unknown bugs in 11 distinct proprietary modules. Through Firmadyne we confirmed the presence of these previously-unknown bugs in 84 firmware images. Furthermore, by using FirmSolo , Firmadyne confirmed a previously-known memory corruption vulnerability in five different versions of the closed-source Kcodes’ NetUSB module across 15 firmware images.