Enabling Security Analyses of Embedded Systems Via Rehosting
Total Page：16
File Type：pdf, Size：1020Kb
SoK: Enabling Security Analyses of Embedded Systems via Rehosting The MIT Faculty has made this article openly available. Please share how this access benefits you. Your story matters. Citation Fasano, Andrew et al. "SoK: Enabling Security Analyses of Embedded Systems via Rehosting." Forthcoming in 16th ACM ASIA Conference on Computer and Communications Security (June 2021). As Published http://dx.doi.org/10.1145/3433210.3453093 Publisher Association for Computing Machinery (ACM) Version Final published version Citable link https://hdl.handle.net/1721.1/130505 Terms of Use Creative Commons Attribution 4.0 International license Detailed Terms https://creativecommons.org/licenses/by/4.0/ SoK: Enabling Security Analyses of Embedded Systems via Rehosting Andrew Fasano Tiemoko Ballo Marius Muench [email protected] [email protected] [email protected] MIT Lincoln Laboratory MIT Lincoln Laboratory Vrije Universiteit Amsterdam Northeastern University Lexington, Massachusetts, USA Amsterdam, Netherlands Boston, Massachusetts, USA Tim Leek Alexander Bulekov Brendan Dolan-Gavitt [email protected] [email protected] [email protected] MIT Lincoln Laboratory Boston University New York University Lexington, Massachusetts, USA Boston, Massachusetts, USA New York, New York, USA Manuel Egele Aurélien Francillon Long Lu [email protected] [email protected] [email protected] Boston University EURECOM Northeastern University Boston, Massachusetts, USA Biot, France Boston, Massachusetts, USA Nick Gregory Davide Balzarotti William Robertson [email protected] [email protected] [email protected] New York University EURECOM Northeastern University New York, New York, USA Biot, France Boston, Massachusetts, USA ABSTRACT CCS CONCEPTS Closely monitoring the behavior of a software system during its exe- • Software and its engineering ! Software reverse engineering; cution enables developers and analysts to observe, and ultimately un- Software post-development issues; Dynamic analysis;• Hardware derstand, how it works. This kind of dynamic analysis can be instru- ! Post-manufacture validation and debug; Simulation and emula- mental to reverse engineering, vulnerability discovery, exploit de- tion;• Computer systems organization ! Firmware; Embedded velopment, and debugging. While these analyses are typically well- software; Real-time systems. supported for homogeneous desktop platforms (e.g., x86 desktop PCs), they can rarely be applied in the heterogeneous world of em- KEYWORDS bedded systems. One approach to enable dynamic analyses of em- Dynamic program analysis; firmware security; emulation; embed- bedded systems is to move software stacks from physical systems ded systems; internet of things; virtualization; rehosting into virtual environments that sufficiently model hardware behavior. This process which we call “rehosting” poses a significant research ACM Reference Format: challenge with major implications for security analyses. Although Andrew Fasano, Tiemoko Ballo, Marius Muench, Tim Leek, Alexander Bulekov, Brendan Dolan-Gavitt, Manuel Egele, Aurélien Francillon, Long Lu, Nick rehosting has traditionally been an unscientific and ad-hoc endeavor Gregory, Davide Balzarotti, and William Robertson. 2021. SoK: Enabling undertaken by domain experts with varying time and resources at Security Analyses of Embedded Systems via Rehosting . In Proceedings of their disposal, researchers are beginning to address rehosting chal- the 2021 ACM Asia Conference on Computer and Communications Secu- lenges systematically and in earnest. In this paper, we establish that rity (ASIA CCS ’21), June 7–11, 2021, Hong Kong, Hong Kong. ACM, New emulation is insufficient to conduct large-scale dynamic analysis of York, NY, USA, 15 pages. https://doi.org/10.1145/3433210.3453093 real-world hardware systems and present rehosting as a firmware- centric alternative. Furthermore, we taxonomize preliminary rehost- 1 INTRODUCTION ing efforts, identify the fundamental components of the rehosting Whereas enterprise edge systems are typically maintained by IT pro- process, and propose directions for future research. fessionals, the rise of low-cost, consumer edge devices (“Internet of Things”) has led to an increasingly large number of Internet-accessible Permission to make digital or hard copies of part or all of this work for personal or machines which malicious actors can exploit. In 2016, the Mirai classroom use is granted without fee provided that copies are not made or distributed malware exploited insecure default credentials on many of these ma- for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for third-party components of this work must be honored. chines to create a botnet of approximately 600,000 devices [1]. But ForThis all work other is uses,licensed contact under the a owner/author(s).Creative Commons Attribution International 4.0 License. poor security posture is a problem emblematic of many embedded ASIAASIA CCSCCS ’21, June June 7 7–11,–11, 2021, 2021, Hong Hong Kong, Kong, Hong Hong Kong Kong. systems, not just consumer edge devices. Despite the frequent use ©© 20212021 Copyright held by the owner/author(s). ACMACM ISBNISBN 978 978-1-4503-8287-8/21/06.-1-4503-8287-8/21/06. of embedded systems for safety-critical, industrial applications, over https://doi.org/10.1145/3433210.3453093https://doi.org/10.1145/3433210.3453093 90% of embedded real-time operating systems fail to implement virtual memory, cryptographically secure pseudo-random number Embedded System generators, or basic exploit mitigations such as non-executable data System On Chip Motor GPIO_A Motor memory, ASLR, and stack canaries [82]. Across a broad spectrum CPU Core µArchitecture Ctrl GPIO_B of applications, embedded systems are typically less secure than Instruction Set general-purpose computers due to a combination of technical and GPIO_C Accelerometer Serial Function Code UART1 socio-economic factors. Embedded systems often contain numerous Port Application Code WiFi UART2 special-purpose peripherals leading to a larger attack surface than module UART3 their general-purpose counterparts. BroadPwn [3], an unauthenti- Kernel and Driver Code On-Chip Antenna cated Remote Code Execution exploit, attacks embedded systems Peripherals (mobile phones) through a device peripheral (WiFi chipsets). A com- I²C promised peripheral may be leveraged to compromise the full sys- SPI RTC tem if the peripheral is Direct Memory Access capable [75] or if Microwire ROM SRAM B it can be used to exploit a vulnerability in a device driver [73, 74]. ... u Temp. s Sensor But these kinds of cross-component vulnerabilities cannot be discov- e ered or replicated through analysis of a single application, since the s exploit chain may leverage behavior of—and data flows between— Flash EEPROM multiple hardware and software components of a system. Given a general lack of hardening and complex peripheral interac- Firmware Used peripherals tions, the ability to perform security analyses of embedded systems External Hardware Unused peripherals is critical to improving the security of these increasingly prevalent and network-connected devices. However, the vast majority of em- bedded systems security analyses performed today use only static Figure 1: An illustrative embedded system. analysis [11, 19, 22, 67, 85]. While this is a promising start, secu- rity assessments would be strengthened by the ability to conduct dynamic analysis of embedded systems [27]. 2 REHOSTING FOR WHOLE-SYSTEM Whole-system dynamic analysis can be achieved by decoupling a SECURITY ANALYSIS system’s firmware from its underlying hardware to move—or rehost— In contrast to a hardware emulation system which comprehensively the software into a virtual environment designed to run that firmware. reproduces the features of specific hardware in a virtual environ- However, this decoupling is no easy feat: firmware is written for a ment, a rehosted embedded system is designed around a specific specific System-on-Chip (SoC), compiled for a specific CPU,and firmware image and must only reproduce the necessary hardware reliant on a specific set of peripherals. Rehosting a system into avir- features that enable the firmware (or relevant components thereof) tual environment unlocks capabilities unavailable with physical sys- to run sufficiently in a virtual environment. We define these terms tems: inspectability, mutability, replicability, scalability, and dispos- as follows: ability. Such an environment can be leveraged to inspect execution of the rehosted system at arbitrary granularity and without the con- Definition 1. Virtual Environment (VE): A software environment straints of hardware-based solutions [41]. Similarly, the virtual sys- in which code can be executed transparently. tem’s state is fully mutable—CPU state or memory may be modified at any point in execution. Sources of non-determinism can be con- Definition 2. Hardware Emulation System (HES): A VE designed trolled in a virtual environment to ensure replicability of analysis re- to accurately recreate the features of one or more selected pieces of sults or behavior. As software, rehosted systems are scalable—they hardware. Commonly called an emulator. can be inexpensively cloned to conduct distributed analyses or to Definition 3. Rehosted Embedded System (RES): A combination share with collaborators. Finally, virtual systems can be created on of a firmware image and VE designed to sufficiently recreate the demand, and because they