Firmadyne

Towards Automated Dynamic Analysis for Linux-based Embedded Firmware

1. redhung@SQLab, NYCU
Towards Automated Dynamic Analysis
for Linux-based Embedded Firmware
Daming D. Chen, Manuel Egele, Maverick Woo, and David Brumley, Carnegie Mellon University, NDSS, 2016

2. >_ CAT ./OVERVIEW
Background
0x00
Architecture &
Concept
0x10
Evaluation
0x20
Conclusion
0x30

3. Background

4. >_ Internet of Things
•Problems
---
-IoT devices are controlled by vendor and chipset-specific firmware
-
-Financial burden Q_Q
-interface with the debugging port on the device places strict limits
•How to dump the firmware from the actual hardware?

5. >_ Internet of Things
---

6. >_ Internet of Things
---
•Dismantle the DVR

7. >_ Internet of Things
---
SHOUT OUT TO ATTIFY
•Dismantle the DVR

8. >_ Internet of Things
---
GND Tx Rx
•Dismantle the DVR

9. >_ Internet of Things
---
•Dismantle the DVR

10. >_ Internet of Things
---
•Dumping the firmware

11. >_ Internet of Things
---
•Dumping the firmware

12. >_ Internet of Things
---
•Dumping the firmware

13. >_ Internet of Things
---
•Dumping the firmware

14. >_ Internet of Things
---

15. >_ Internet of Things
---
•Done ! But …

16. >_ Internet of Things
---

17. >_ Emulator and automated analysis
•FIRMADYNE
---
-Automated dynamic analysis
-Using the QEMU full system emulator
•Challenges of embedded systems
-Presence of hardware-specific peripherals
-Creation of dynamically- generated files
-Usage of non-volatile memory (NVRAM)

18. Architecture & Concept

19. >_ Architecture
•Components
---
-Extract Firmware Filesystem
-Initial Emulation
-Dynamic Analysis
-Crawling Firmware

20. >_ Architecture
•Components
---
-Extract Firmware Filesystem
-Initial Emulation
-Dynamic Analysis
-Crawling Firmware

21. >_ Architecture
•Components
---
-Extract Firmware Filesystem
-Initial Emulation
-Dynamic Analysis
-Crawling Firmware

22. >_ Architecture
•Crawling firmware
---
-42 vendors in the dataset
-Multiple geographic locations of each vendor’s website
-Using the Scrapy framework
-Crawling FTP if the webpage is dynamically generated

23. >_ Architecture
•Components
---
-Extract Firmware Filesystem
-Initial Emulation
-Dynamic Analysis
-Crawling Firmware

24. >_ Architecture
•Extract Firmware Filesystem
---
-Blacklist of filenames
-Improve extraction of JFFS2 and SquashFS filesystems
-Binwalk was insufficient for our purposes

25. >_ Architecture
---

26. >_ Architecture
---

27. >_ Architecture
•Components
---
-Extract Firmware Filesystem
-Initial Emulation
-Dynamic Analysis
-Crawling Firmware

28. >_ Architecture
•Components
---
-Extract Firmware Filesystem
-Initial Emulation
-Dynamic Analysis
-Crawling Firmware

29. >_ Architecture
•Initial Emulation
---
-Process-level
-System-level
-Application-level

30. >_ Architecture
•Initial Emulation
---
-Process-level
-System-level
-Application-level

31. >_ Architecture
•NVRAM
---
-52.6% of all extracted firmware images access a hardware NVRAM
-Using a shared library named libnvram.so
-const char* nvram_get (const char* key)
-int nvram_set (const char* key, char *val)
-Init binary to include this library via LD_PRELOAD

32. >_ Architecture
•Kernel
---
-Hooking 20 system calls using the kprobes framework
-Assigning MAC addresses, creating a network bridge, rebooting the system
-Automatic confirmation of vulnerabilities with poison values
-E.g. 0xDEADBEEF, 0x41414141

33. >_ Architecture
•Components
---
-Extract Firmware Filesystem
-Initial Emulation
-Dynamic Analysis
-Crawling Firmware

34. >_ Architecture
•Dynamic analysis
---
-SNMP Information
-Vulnerabilities
-Accessible Webpages

35. >_ Architecture
•Accessible Webpages
---
-Verifies that it is not a static resource (e.g., *.png, *.css, *.js)
-Attempts to access it directly over the web interface.
-Iterates through each file within the firmware (e.g., located within /www/)
-Determine which URLs were most accessible

36. >_ Architecture
•Vulnerabilities
---
-The tested vulnerabilities were manually selected
-Manually developed proof-of-concepts exploits for the new vulnerabilities
-Using 60 known exploits, mostly from the Metasploit Framework

37. Evaluation

38. >_ Evaluation
---
•Dataset from the crawler

39. >_ Evaluation
---
•Dataset from the crawler

40. >_ Evaluation
---

41. >_ Evaluation
---

42. Conclusion

43. >_ Conclusion
---
•FIRMADYNE is an automated approach to analyze the firmware
•OEMs made the most vulnerabilities of the IoT devices
•Emulation with firmware fuzzing

44. THANK YOU!
[email protected]
r3dhun9@r3dhun9Philip Chen