싱크 확장을 위한 패턴 기반의 임베디드 바이너리 취약점 분석 기법
Pattern-Based Vulnerability Analysis Technique for Embedded Binaries to Expand Sink
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
최근 증가하는 IoT 기기의 확산에 발맞춰, 임베디드 펌웨어 바이너리에 대한 취약성 분석 연구 또한 중요해지고 있다. 현재까지 제안된 정적 분석 기법들은 다양한 취약점을 효과적으로 탐지하고 있지만, 대부분 싱크 함수의 이름에만 집중하여 취약점을 식별하고 있다. 그로 인해 라이브러리 함수가 아닌 버퍼 접근 패턴으로 인한 버퍼 오버플로우와 같은 싱크 함수 독립적 취약점을 탐지하지 못하는 한계점이 존재한다. 따라서 본 연구에서는 코드 패턴을 이용해 싱크를 정의하고 패턴 내부로 제한된 의존성 분석을 수행하여 기존 한계점을 해결하는 패턴 기반의 취약점 분석 방법을 제안한다. 이 접근법은 싱크 함수에 의존하지 않고 코드 패턴을 활용하기 때문에 새로운 유형의 취약점을 식별할 수 있다. 본 연구에서는 특히 반복문 패턴에 초점을 맞추어 구현하였다. 실험 결과는 패턴 기반의 분석 방법이 반복문에 포함된 메모리 증가를 성공적으로 추론할 수 있고 기존 정적 분석 연구들이 탐지할 수 없는 취약점을 탐지할 수 있음을 보여주었다. 이 방법은 새로운 패턴의 추가를 통해 쉽게 확장 가능하며 향후 보다 포괄적인 취약점 탐지에 대한 가능성을 시사한다.
Abstract
With the recent proliferation of IoT devices, the importance of vulnerability analysis for embedded firmware binaries has grown. While current static analysis techniques effectively detect various vulnerabilities, they primarily focus on identifying vulnerabilities through the names of sink functions. This approach has limitations, as it fails to detect sink function-independent vulnerabilities, such as buffer overflows caused by buffer access patterns rather than library functions. Therefore, this study proposes a pattern-based vulnerability analysis method that addresses these limitations by defining sinks using code patterns and performing restricted dependency analysis within these patterns. By relying on code patterns rather than sink functions, this approach can identify new types of vulnerabilities. This study particularly focuses on loop patterns. Experimental results demonstrate that the pattern-based analysis method can successfully infer memory increments within loops and detect vulnerabilities that existing static analysis techniques cannot identify. This method is easily extendable by adding new patterns, suggesting potential for more comprehensive vulnerability detection in the future.
참고문헌 (18)
- "Internet of Things (IoT)connected devices installed base worldwide from 2015 to 2025" (2024)[URL]
- "2020 Unit 42 IoT Threat Report" (2024)[URL]
- Yan Shoshitaishvili, "Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware", Proceedings 2015 Network and Distributed System Security Symposium, pp.1~15 (2015)
- Nilo Redini, "Karonte: Detecting Insecure Multi-binary Interactions in Embedded Firmware", Proceedings of the 2020IEEE Symposium on Security and Privacy, pp.1544~1561 (2020)
- Kai Cheng, "Automatic Inference of Taint Sources to Discover Vulnerabilities in SOHO Router Firmware", 36th IFIP International Conference on ICT Systems Security and Privacy Protection, pp.83~99 (2021)
- Puzhuo Liu, "FITS: Inferring Intermediate Taint Sources for Effective Vulnerability Analysis of IoT Device Firmware", Proceedings of 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, 4, pp.138~152 (2023)
- Sanchuan Chen, "SelectiveTaint:Efficient Data Flow Tracking With Static Binary Rewriting", 30th USENIX Security Symposium, pp.1665~1682 (2021)
- K. Cheng, "Detecting vulnerabilities in linux-based embedded firmware with sse-based on-demand alias analysis", Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis, pp.360~372 (2023)
- Libo Chen, "Sharing More and Checking Less: Leveraging Common Input Keywords to Detect Bugs in Embedded Systems", 30th USENIX Security Symposium, pp.303~319 (2021)
- Libo Chen, "SFuzz: Slice-based Fuzzing for Real-Time Operating Systems", Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pp.485~498 (2022)
- Wil Gibbs, "Operation Mango: Scalable Discovery of Taint-Style Vulnerabilities in Binary Firmware Services", 33rd USENIX Security Symposium, pp.7123~7139 (2024)
- "CVE-2022-24355" (2024)[URL]
- "Ghidra Software Reverse Engineering Framework" (2024)[URL]
- Zhen Li, "VulDeePecker: A Deep Learning-Based System for Vulnerability Detection", Proceedings 2018 Network and Distributed System Security Symposium, pp.1~15 (2018)
- El Habib Boudjema, "VYPER: Vulnerability detection in binary code", Security and Privacy, 3(2), pp.e100~ (2020)
- Weiteng Chen, "KOOBE:Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities", 29th USENIX Security Symposium, pp.1093~1110 (2020)
- Adriana Sejfia, "Strategies for Pattern-Based Detection of Architecturally-Relevant Software Vulnerabilities", IEEE International Conference on Software Architecture, pp.92~102 (2020)
- "angr open-source binary analysis platform" (2024)[URL]