网络与信息安全学报 ›› 2022, Vol. 8 ›› Issue (5): 98-110.doi: 10.11959/j.issn.2096-109x.2022070

• 学术论文 • 上一篇    下一篇

面向物联网设备固件的硬编码漏洞检测方法

穆超1, 王鑫1, 杨明1, 张恒2, 陈振娅1, 吴晓明1   

  1. 1 齐鲁工业大学（山东省科学院）山东省计算中心（国家超级计算济南中心）山东省计算机网络重点实验室，山东 济南 250014
    2 江苏海洋大学计算机工程学院，江苏 连云港 222005
  • 修回日期:2022-09-02 出版日期:2022-10-15 发布日期:2022-10-01
  • 作者简介:穆超（1990- ），男，山东济南人，齐鲁工业大学（山东省科学院）助理研究员，主要研究方向为物联网安全与数据安全
    王鑫（1992- ），男，山东邹平人，博士，齐鲁工业大学（山东省科学院）副研究员，主要研究方向为工业互联网安全与数据隐私保护
    杨明（1981- ），男，山东东营人，博士，齐鲁工业大学（山东省科学院）研究员，主要研究方向为密码学、云安全、大数据安全、物联网安全
    张恒（1981- ），男，江苏连云港人，博士，江苏海洋大学教授，主要研究方向为系统安全与控制和人工智能算法安全
    陈振娅（1983- ），女，山东菏泽人，齐鲁工业大学（山东省科学院）副研究员，主要研究方向为数据安全与隐私保护
    吴晓明（1981- ），男，山东滨州人，博士，齐鲁工业大学（山东省科学院）研究员、博士生导师，主要研究方向为物联网安全与信息安全
  • 基金资助:
    国家重点研发计划(2021YFF0901301-02);山东省自然科学基金(ZR2021QF057);国家自然科学基金(61873106);江苏省杰出青年科学基金(BK20200049);齐鲁工业大学（山东省科学院）计算机科学与技术学科基础研究加强计划(2021JC02023);工业控制技术国家重点实验室（浙江大学）开放课题(ICT2022B36)

Hardcoded vulnerability detection approach for IoT device firmware

Chao MU1, Xin WANG1, Ming YANG1, Heng ZHANG2, Zhenya CHEN1, Xiaoming WU1   

  1. 1 Shandong Provincial Key Laboratory of Computer Networks, Shandong Computer Science Center (National Supercomputer Center in Jinan),Qilu University of Technology (Shandong Academy of Sciences), Jinan 250014, China
    2 School of Computer Engineering, Jiangsu Ocean University, Lianyungang 222005, China
  • Revised:2022-09-02 Online:2022-10-15 Published:2022-10-01
  • Supported by:
    The National Key R＆D Program of China(2021YFF0901301-02);Shandong Provincial Natural Science Foundation(ZR2021QF057);The National Natural Science Foundation of China(61873106);The Natural Science Foundation of Jiangsu Province for Distinguished Young Scholars(BK20200049);QLU/SDAS Computer Science and Technology Fundamental Research Enhancement Program(2021JC02023);Open Research Project of the State Key Laboratory of Industrial Control Technology, Zhejiang University, China(ICT2022B36)

在线阅读

62

pdf下载

462

摘要：

随着物联网设备的普及，越来越多有价值的数据产生，依托物联网设备进行大数据分析和挖掘是近年来学术界和工业界关注的热点问题。然而，由于缺乏必要的检测和防护手段，很多物联网设备存在严重的信息安全隐患。特别地，设备硬编码信息与系统加解密、身份认证等功能密切相关，可为核心数据提供机密性保障，一旦被恶意攻击者利用，会产生敏感信息泄露、后门攻击、非授权登录等严重后果。针对该问题，在研究物联网设备中硬编码漏洞表现特征的基础上，提出了一种可执行文件中多类型字符识别定位和硬编码漏洞检测方法。首先，提取固件内容并筛选所有可执行文件作为待分析源，提出特殊格式字符、外部文件引用、密码实现3类硬编码字符的识别与定位；然后，根据函数调用关系对硬编码字符所在函数进行可达性分析，采用中间表示 IR 模型消除指令异构性，并利用数据流分析方法确定字符型和参数型硬编码值；最后，设计符号执行方法确定硬编码漏洞的触发条件，最终输出漏洞检测结果。一方面，所提方法在利用中间表示模型的基础上引入了符号执行的方法，消除了指令架构依赖性，减少了漏洞误报率；另一方面，该方法可融合字符、文件、密码实现 3 类硬编码字符的不同特征表现，增加了漏洞检测的覆盖范围，提升了检测方法的通用性。实验结果表明，所提方法可有效检测多种物联网设备中的字符、文件、密码3类硬编码漏洞，具有较好的检测精度，可为后续安全防护技术的部署提供一定指导。

关键词: 大数据, 物联网安全, 硬编码, 漏洞检测

Abstract:

With the popularization of IoT devices, more and more valuable data is generated.Analyzing and mining big data based on IoT devices has become a hot topic in the academic and industrial circles in recent years.However, due to the lack of necessary detection and protection methods, many IoT devices have serious information security risks.In particular, device hard-coded information is closely related to system encryption and decryption, identity authentication and other functions, which can provide confidentiality protection for core data.Once this information is exploited by malicious attackers, serious consequences such as sensitive information leakage, backdoor attacks, and unauthorized logins will occur.In response to this problem, a multi-type character recognition and positioning scheme was designed and a hard-coded vulnerability detection method in executable files was proposed based on the study of the characteristics of hard-coded vulnerabilities in IoT devices.The proposed method extracted the firmware of IoT devices and filtered all executable files as the source to be analyzed.Then, a solution to identify and locate three types of hard-coded characters was provided.Further, the reachability of the function, where the hard-coded character was located, was analyzed according to the function call relationship.Meanwhile, the instruction heterogeneity was mitigated by an intermediate representation (IR) model.The character and parameter hard-coded values was obtained through a data flow analysis approach.A symbolic execution method was devised to determine the trigger conditions of the hard-coded vulnerabilities, and then the vulnerability detection result was output.On the one hand, the proposed method introduced the method of symbolic execution based on the use of the intermediate representation model, which eliminated the dependency of instruction architecture and reduces the false positive rate of vulnerabilities; On the other hand, this method can integrate characters, files, and cryptographic implementation to realize the different characteristics of three types of hard-coded characters, which increased the coverage of vulnerability detection and improves the versatility of the detection method.The experimental results show that the proposed method can effectively detect three types of hard-coded vulnerabilities of characters, files and cryptographic implementation in various IoT devices, and has good detection accuracy, which can provide certain guidance for the deployment of subsequent security protection technologies.

Key words: big data, IoT security, hard coding, vulnerability detection

中图分类号: 

No Suggested Reading articles found!