网络与信息安全学报 ›› 2023, Vol. 9 ›› Issue (1): 150-157.doi: 10.11959/j.issn.2096-109x.2023015

• 学术论文 • 上一篇    下一篇

基于语义冲突的硬编码后门检测方法

胡安祥1, 肖达2, 郭世臣1, 刘胜利1   

  1. 1 数学工程与先进计算国家重点实验室，河南 郑州 450001
    2 郑州工业应用技术学院信息工程学院，河南 郑州 451100
  • 修回日期:2022-05-11 出版日期:2023-02-25 发布日期:2023-02-01
  • 作者简介:胡安祥（1996- ），男，江西景德镇人，数学工程与先进计算国家重点实验室硕士生，主要研究方向为网络空间安全和逆向工程
    肖达（1981- ），男，江西吉安人，博士，郑州工业应用技术学院副教授，主要研究方向为网络空间安全和漏洞挖掘
    郭世臣（1998- ），男，河南辉县人，数学工程与先进计算国家重点实验室硕士生，主要研究方向为网络空间安全和逆向工程
    刘胜利（1973- ），男，河南周口人，博士，数学工程与先进计算国家重点实验室教授、博士生导师，主要研究方向为网络空间安全
  • 基金资助:
    科技委基础加强项目(2019-JCJQ-ZD-113)

Hard-coded backdoor detection method based on semantic conflict

Anxiang HU1, Da XIAO2, Shichen GUO1, Shengli LIU1   

  1. 1 State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou 450001, China
    2 School of Information Engineering, Zhengzhou University of Industry Technology, Zhengzhou 451100, China
  • Revised:2022-05-11 Online:2023-02-25 Published:2023-02-01
  • Supported by:
    Science＆Technology Commission Foundation Strengthening Project(2019-JCJQ-ZD-113)

在线阅读

16

pdf下载

311

摘要：

路由器安全问题主要聚焦于内存型漏洞的挖掘与利用，对后门的检测与发现的研究较少。硬编码后门是较常见的后门之一，设置简单方便，仅仅需要少量代码就能实现，然而却难以被发现，往往造成严重的危害和损失。硬编码后门的触发过程离不开字符串比较函数，因此硬编码后门的检测借助于字符串比较函数，主要分为静态分析方法和符号执行方法。前者自动化程度较高，但存在较高的误报率，检测效果不佳；后者准确率高，但无法自动化大规模检测固件，面临着路径爆炸甚至无法约束求解的问题。针对上述问题，在静态分析的基础上，结合污点分析的思想，提出了基于语义冲突的硬编码后门检测方法——Stect。Stect从常用的字符串比较函数出发，结合MIPS和ARM体系结构的特点，利用函数调用关系、控制流图和分支选择依赖的字符串，提取出具有相同起点和终点的路径集合，如果验证成功的路径集合中的字符串具有语义冲突，则判定路由器固件中存在硬编码后门。为了评估 Stect 对路由器硬编码后门的检测效果，对收集的1 074个设备固件进行了测试，并与其他的后门检测方法进行了对比。实验结果表明，相比现有的后门检测方法Costin和Stringer，Stect具有更好的检测效果：从数据集中成功检测出8个固件后门口令，召回率达到88.89%。

关键词: 路由器固件, 硬编码后门, 字符串比较函数, 语义冲突

Abstract:

The current router security issues focus on the mining and utilization of memory-type vulnerabilities, but there is low interest in detecting backdoors.Hard-coded backdoor is one of the most common backdoors, which is simple and convenient to set up and can be implemented with only a small amount of code.However, it is difficult to be discovered and often causes serious safety hazard and economic loss.The triggering process of hard-coded backdoor is inseparable from string comparison functions.Therefore, the detection of hard-coded backdoors relies on string comparison functions, which are mainly divided into static analysis method and symbolic execution method.The former has a high degree of automation, but has a high false positive rate and poor detection results.The latter has a high accuracy rate, but cannot automate large-scale detection of firmware, and faces the problem of path explosion or even unable to constrain solution.Aiming at the above problems, a hard-coded backdoor detection algorithm based on string text semantic conflict (Stect) was proposed since static analysis and the think of stain analysis.Stect started from the commonly used string comparison functions, combined with the characteristics of MIPS and ARM architectures, and extracted a set of paths with the same start and end nodes using function call relationships, control flow graphs, and branching selection dependent strings.If the strings in the successfully verified set of paths have semantic conflict, it means that there is a hard-coded backdoor in the router firmware.In order to evaluate the detection effect of Stect, 1 074 collected device images were tested and compared with other backdoor detection methods.Experimental results show that Stect has a better detection effect compared with existing backdoor detection methods including Costin and Stringer: 8 hard-coded backdoor images detected from image data set, and the recall rate reached 88.89%.

Key words: router firmware, hard-coded backdoor, string comparison functions, semantic conflict

中图分类号: 

No Suggested Reading articles found!