Tools and methods for detecting vulnerabilities in embedded devices

点击翻译按钮获取中文摘要

As the age of the ``Internet-of-things'' (IoT) dawns, we face a growing legion of embedded, intelligent and Internet capable devices. From smartphones, to smart-TVs, thermostats, smoke detectors, video cameras, electricity meters and self-driving cars, we are ever surrounded with more and more connected devices. This massive growth creates a dangerous situation where the rate and numbers at which new IoT devices are being introduced makes it impossible to perform security analysis on all of them. Analysis of embedded devices is challenging because of the opaqueness of the devices, which make it impossible to use efficient grey-box analysis techniques, or identify the boundary between valid and invalid inputs, where many vulnerabilities tend to lie. In this project, we plan to research and develop tools and methods that address the challenges set forth by embedded devices. First, to enable the application of grey-box analysis techniques, we will research hardware emulation methods that are able to evade the dependencies the firmware on these devices have on proprietary hardware. Second, to overcome the challenge of identifying the boundary between valid and invalid inputs, we propose techniques that can automatically construct network protocol-specific test-generation tools from open-source software implementations of those protocols.