Software-based Analysis of the Security by Design in Embedded Devices Pierre-Marie Junges, Jerome´ Franc¸ois, Olivier Festor University of Lorraine, Inria, LORIA, France Email: fi[email protected] Abstract—The growth of embedded devices like IoT or net- [10], our approach solely considers software names, versions working devices makes them major targets for attackers in the and functionalities. Internet. They are known to face security issues because of their Our contributions are threefold: bad design and/or configuration. In this paper, we propose a systematic method to evaluate the security of an embedded device. • an analysis framework to collect firmware images from It relies on a firmware analysis to extract relevant information vendors’ websites, unpack and analyze them is designed about its software composition. Based on our large IoT database, and implemented, our work aims at providing a global and long-term (10 years) • metrics to estimate the potential exposure to security risks analysis of the security by design of firmwares and of the awareness and versatility of vendors in regards to security issues. of embedded devices are defined and, • the technique is applied to 6935 devices released between I. INTRODUCTION 2009 and 2019. Our objective is to discuss the evolution of firmware design over 10 years rather than giving an Nowadays, embedded devices are omnipresent in personal instantaneous snapshot. homes, public spaces and in companies. They are composed of many different kinds of Commercial-Off-The-Shelf (COTS) The rest of the paper is structured as follows. Section II devices including networking devices like routers or access introduces the related work. In Section III our security assess- points and, recently, Internet of Things (IoT) devices that ment technique is introduced. In Section IV, we describe our contribute to the large growth of deployed embedded devices. analysis framework. The results of our analysis are detailed in The IoT eco-system is a tremendous playground for attack- Section V followed by concluding remarks in Section VI. ers because many of them are exposed remotely without ap- II. RELATED WORK propriate protection [1]. As IoT devices (smart home devices, Firmware analysis has been largely used to discover security cameras, sensors...) need connectivity, networking equipments flaws and is based on two main techniques: static and dynamic like routers, gateways or access points are generally considered analysis. In [11], the authors presented a dynamic analysis as part of their eco-system and also considered in research framework acting like a software proxy between an emulator, studies about security of IoT and all of them are so grouped performig the instructions, and a real physical device executing under the term of Embedded Devices [2], [3]. Indeed, net- the related I/O operations. Firmadyne [2] uses the QEMU [12] working devices may also be impacted by the same type of emulator and searches for known vulnerabilities. attacks as shown in the case of the Mirai botnet [4]. An hybrid firmware analysis framework was proposed in The work presented in this paper aims at assessing the [7], [10] that features port scanning, a credential analysis [10] security of embedded devices including both IoT and network- and a vulnerability assessment of the emulated web pages and ing devices. Several research studies evaluated the security of the web service source code [7], [10]. embedded devices. On one hand, massive scans over Internet In [9], the authors present a technique to discover hard- combined with fingerprinting techniques is helpful to reveal coded authentication bypass backdoors. The authors of [3] a snapshot of the global level of exposure of specific alive extract security-related information (e.g., RSA private keys, devices [5], [6]. On the other hand, analyzing the firmwares passwords) and discovered unknown vulnerabilities in 693 of a large set of devices gives insight about the level of security firmware images out of the 32,000 initially downloaded. by design. A deep-learning based framework is described in [13] and We propose an hybrid approach based on static analysis to compared embedded functions in binary code to a learning gather software components of firmwares and partial execu- set of known vulnerable methods. tion/emulation of selected binaries. The objective is twofold: Unfortunately dynamic analysis does not scale [3] because evaluating the potential exposure of devices by analyzing of the difficulty to correctly emulate the hardware resources. server programs packaged within a firmware and assessing the Our approach leverages an hybrid analysis, both static and device’s security level through a mapping of vulnerabilities dynamic. Because it is exclusively based on software meta associated with these programs. Unlike other works aiming information (e.g., name, version), the dynamic analysis is very at scanning vulnerabilities in binaries [7]–[9] or source code lightweight as we do not need to emulate the full functional- 978-3-903176-32-4 © 2021 IFIP ities of a program. Our goal is not to detect new security flaws in the source or binary code but to analyze the software version up to 2016.73 are by design vulnerable and we can composition. We thus rely on CVEs (Common Vulnerabilities conclude that such products were released by the vendors with and Exposures) similarly to [8]. In [8], the authors leveraged a known vulnerability. binary and ASCII signatures to match versions of zlib and Hence, vulnerable COTS devices can be detected by com- OpenSSL libraries in printer firmwares. Our work is not paring their release and CVEs publication dates. device-specific and focuses on server programs. As illustrated in the previous example, required information In [14], Internet-wide scans were performed to extract RSA about software is limited to software names and versions. In and DSA keys from TLS handshakes and the private keys addition, it might be required to check functionalities of the were reversed if an insecure pseudo random number generator programs since some vulnerabilities are specifically related to was used. In [15], [16], authors discovered that half a million a different alternative of the same software version depending devices had their factory default credentials settings active. on optional functionalities which have been packaged in the Other researchers leverage fingerprinting techniques to detect binary. To gather all the required information, two comple- the presence of exposed industrial systems [6] or IoT [5]. mentary methods are used: Those techniques allow to assess the global exposure of • Static analysis: the firmware is unpacked and the list of deployed devices in Internet and are complementary to a programs present in the file system are retrieved. We firmware analysis. Our work aims at evaluating the security of can infer the names of the programs with their version embedded devices but on a different perspective, by evaluating numbers that sometimes appear in their names also. the potential security risks induced by the firmware design. • Partial execution: software is executed to only get the help message, which contains information, such as the III. SECURITY ASSESSMENT METHOD version or the functionalities, and is generally accessible A. Problem definition (i.e., even if the program cannot work properly) without Finding evidence of security threats in the original designed full firmware emulation. firmware is our main objective. In [1], the authors provide a In the remainder of this paper, we considered a software as comprehensive list of security threats related to IoT and among an executable running a service. them, weak programming practices (firmware released with C. Assessment metrics known vulnerabilities) and unnecessary open ports. Similarly, For each device, having the firmware allows to extract the OWASP published the top 10 IoT 20181 which also highlights software information explained before, which is leveraged to vulnerabilities and risks of IoT, in particular top 2: insecure infer the device exposure to security risks. Network Services (unneeded services that can be exploited by Assuming a set of devices D and set of programs P attackers) and top 5: use of insecure or outdated components. considered as sensitive, 8d 2 D we denote d sw the set of Our approach aims at assessing an individual firmware in programs (retrieved by the static analysis) of the device d. The regards to these two issues. The objectives are to: potential level of exposure, exp(d), of a device d 2 D is the 1) infer the level of potential exposure to attacks by exam- number of sensitive programs it contains: ining server programs in the firmware which are known to be exploited by attackers (e.g., SSH, HTTP servers); exp(d) = jd sw \ P j (1) 2) assess the level of security risk by design by extracting The more services a device deploys, the more vulnerable software components of the firmware and mapping them the device might be. Thus, by combining the type of devices to known vulnerabilities. and services found, an overview of the level of exposition for B. Hybrid firmware analysis each type can be deduced. The vulnerability security assessment of a device d is Properly running a firmware image is challenging because calculated for a given software, s 2 d sw (using static analysis it often needs access to hardware resources (e.g., /dev/nvram, d and partial execution). In the following equations, vers and /dev/gpio) that cannot be properly emulated. However, as last vers are the version of s in d and the latest version of s explained in III-A, we are interested in information regarding when d was released respectively. date(v) is the release date the exposure of the device linked to the design of its firmware of version v. program. To reach our objectives, we rely on information The first metric to evaluate the security of a device is related to software present in the latter.