PLC용 uC/OS-II 운영체제 기반 펌웨어에서 발생 가능한 취약점 패턴 탐지 새니타이저
A Sanitizer for Detecting Vulnerable Code Patterns in uC/OS-II Operating System-based Firmware for Programmable Logic Controllers
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
산업제어 시스템에서 많이 사용되는 PLC(Programmable Logic Controller)는 마이크로 컨트롤러, 실시간 운영체제, 통신 기능들과 통합되고 있다. PLC들이 인터넷에 연결됨에 따라 사이버 공격의 주요 대상이 되고 있다. 본 논문에서는, 데스크톱에서 개발한 uC/OS-II 기반 펌웨어를 PLC로 다운로드 하기 전, 펌웨어 코드의 보안성을 향상시켜 주는 새니타이저를 개발한다. 즉, PLC용 임베디드 펌웨어를 대상으로 버퍼의 경계를 넘어선 접근을 탐지하는 BU 새니타이저(BU sanitizer)와 use-after-free 버그를 탐지하는 UaF 새니타이저(UaFsanitizer)를 제안한다. BU 새니타이저는 대상 프로그램의 함수 호출 그래프와 심볼 정보를 기반으로 제어 흐름 무결성 위배도 탐지할 수 있다. 제안한 두 새니타이저를 구현하고 실험을 통해 제안 기법의 유효성을 보였으며, 기존 연구와의 비교를 통해 임베디드 시스템에 적합함을 보였다. 이러한 연구결과는 개발 단계에서 의도하지 않은 펌웨어 취약점을 탐지하여 제거하는데 활용할 수 있다.
Abstract
As Programmable Logic Controllers (PLCs), popular components in industrial control systems (ICS), are incorporated with the technologies such as micro-controllers, real-time operating systems, and communication capabilities. As the latest PLCs have been connected to the Internet, they are becoming a main target of cyber threats. This paper proposes two sanitizers that improve the security of uC/OS-II based firmware for a PLC. That is, we devise BU sanitizer for detecting out-of-bounds accesses to buffers and UaF sanitizer for fixing use-after-free bugs in the firmware. They can sanitize the binary firmware image generated in a desktop PC before downloading it to the PLC. The BU sanitizer can also detect the violation of control flow integrity using both call graph and symbols of functions in the firmware image. We have implemented the proposed two sanitizers as a prototype system on a PLC running uC/OS-II and demonstrated the effectiveness of them by performing experiments as well as comparing them with the existing sanitizers. These findings can be used to detect and mitigate unintended vulnerabilities during the firmware development phase.
참고문헌 (15)
- 권기춘, "TECHNICAL REVIEW ON THE LOCALIZED DIGITAL INSTRUMENTATION AND CONTROL SYSTEMS", Nuclear Engineering and Technology, 41(4), pp.447~454 (2009), 한국원자력학회
- Stan Karanasios, "ICT for development in the context of the closure of Chernobyl nuclear power plant: an activity theory perspective", Information Systems Journal, 23(4), pp.287~306 (2013), Wiley[DOI]
- Vinay M. Igure, "Security issues in SCADA networks", Computers & Security, 25(7), pp.498~506 (2006), Elsevier BV[DOI]
- "W32.Stuxnet Dossier (Version 1.4)" (2011)[URL]
- E. Chien, "W32. Duqu: the precursor to the next stuxnet", Proceedings of the 5th USENIX Workshop on Large-Scale Exploits and Emergent Threats, pp.25~27 (2012)
- "Targeted attacks against the energy sector (Version 1.0)" (2014)[URL]
- Anam Sajid, "Cloud-Assisted IoT-Based SCADA Systems Security: A Review of the State of the Art and Future Challenges", IEEE Access, 4, pp.1375~1384 (2016), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- Zachry Basnight, "Firmware modification attacks on programmable logic controllers", International Journal of Critical Infrastructure Protection, 6(2), pp.76~84 (2013), Elsevier BV[DOI]
- "Software Security - Principles, Policies, and Protection, Free ebook" (2019)[URL]
- K. Serebryany, "AddressSanitizer: A Fast Address Sanity Checker", Proceedings of the 2012 USENIX Annual Technical Conference, pp.13~15 (2012)
- K. Serebryany, "ThreadSanitizer: data race detection in practice", Proceedings of the workshop on binary instrumentation and applications, pp.62~71 (2009)
- E. Stepanov, "MemorySanitizer: fast detector of uninitialized memory use in C++", 2015IEEE, 2015, 7~11
- 최광준, "PLC용 uC", OS 운영체제의 보안성 강화를 위한 실행코드 새니타이저, 2019, pp.29(2), 365~375[DOI]
- "TMS320C28x CPU and Instruction Set - Reference Guide, Literature Number: SPRU430F" (2015)[URL]