본문 바로가기
KERD
논문KCI 등재

체계적인 IoT 기기의 펌웨어 보안 분석 방법에 관한 연구

A Study on Systematic Firmware Security Analysis Method for IoT Devices

김정현|김승주|김예준
한국정보보호학회 (Korea Institute Of Information Security And Cryptology)|2021.02|정보보호학회논문지 (Journal of The Korea Institute of Information Security and Cryptology)|제31권 제1호|pp. 31-49|DOI https://doi.org/10.13089/JKIISC.2021.31.1.31

0

조회

0

다운로드

4

인용

0

참고문헌

키워드

IoTVulnerability AnalysisFirmwareFirmware Analysis
주제분류컴퓨터학

초록

IoT 기기는 네트워크 통신이 가능한 임베디드 기기를 의미한다. IoT 기기는 금융, 개인, 산업, 공공, 군 등과 같이 우리 주변의 다양한 분야에서 많이 사용되고 있기 때문에 공격이 발생할 경우 개인정보 유출과 같은 다양한 피해가 발생할 수 있다. IoT에 대한 취약점 분석은 IoT 기기와 상호작용 하는 스마트폰의 애플리케이션, 웹 사이트와같은 소프트웨어 인터페이스 분석뿐만 아니라, IoT 기기의 주요 구성요소인 펌웨어에 대해서도 필수적으로 수행되어야 한다. 하지만 문제는 펌웨어의 추출 및 분석이 생각보다 쉽지 않으며, 보안팀 내 분석하는 사람의 전문성에 따라같은 대상을 분석하더라도 결과물의 수준이 다를 수 있어 일정한 수준의 품질 관리가 쉽지 않다는 것이다. 따라서본 논문에서 우리는 IoT 기기의 펌웨어에 대한 취약점 분석 프로세스를 정립하고 단계별로 사용 가능한 도구를 제시함으로써, IoT 보안성 분석에 있어 로드맵을 제시하고 일정한 수준의 품질 관리가 가능하였다. 우리는 다양한 상용 제조사들이 생산한 IoT 기기의 펌웨어 획득부터 분석까지의 과정을 제안하였으며, 이를 다양한 제조사의 드론 분석에 직접 적용해 봄으로써 그 타당성을 입증하였다.

Abstract

IoT devices refer to embedded devices that can communicate with networks. Since there are various types of IoT devicesand they are widely used around us, in the event of an attack, damages such as personal information leakage can occurdepending on the type of device. While the security team analyzes IoT devices, they should target firmware as well assoftware interfaces since IoT devices are operated by both of them. However, the problem is that it is not easy to extractand analyze firmware and that it is not easy to manage product quality at a certain level even if the same target isanalyzed according to the analyst's expertise within the security team. Therefore, in this paper, we intend to establish avulnerability analysis process for the firmware of IoT devices and present available tools for each step. Besides, weorganized the process from firmware acquisition to analysis of IoT devices produced by various commercial manufacturers,and we wanted to prove their validity by applying it directly to drone analysis by various manufacturers.

참고문헌 (77)

  1. "The IoT Rundown For 2020: Stats, Risks, and Solutions" (2020)[URL]
  2. [URL]
  3. Alshamrani, Adel, "A comparison between three SDLC models waterfall model, spiral model, and Incremental", Iterative model, 2015, pp.12(1), 106~
  4. Okoli, Chitu, "A guide to conducting a systematic literature review of information systems research", ~ (2010)
  5. "IEEE"[URL]
  6. "NDSS"[URL]
  7. "Usenix"[URL]
  8. "ACM"[URL]
  9. "NDSS"[URL]
  10. "Springer"[URL]
  11. Zaddach, Jonas, "Embedded devices security and firmware reverse engineering" (2013), Black-Hat USA
  12. Shwartz, Omer, "Reverse engineering IoT devices: Effective techniques and methods", IEEE Internet of Things Journal, 5(6), pp.4965~4976 (2018)
  13. Hernandez, Grant, "Toward Automated Firmware Analysis in the IoT Era", IEEE Security & Privacy, 17(5), pp.38~46 (2019)
  14. Schulz, Matthias, "The Nexmon firmware analysis and modification framework:Empowering researchers to enhance Wi-Fi devices", Computer Communications, 129, pp.269~285 (2018)
  15. Fowze, Farhaan, "ProXray: Protocol Model Learning and Guided Firmware Analysis" (2019), IEEE Transactions on Software Engineering
  16. Basnight, Zachry, "Firmware modification attacks on programmable logic controllers", International Journal of Critical Infrastructure Protection, 6(2), pp.76~84 (2013)
  17. Lee, Seoksu, "Toward Firmware-Type Analysis Using machine Learning Techniques", 2018 IEEE 42nd Annual Computer Software and Applications Conference (COMPSAC), 1 (2018), IEEE
  18. Costin, Andrei, "A large-scale analysis of the security of embedded firmwares", 23rd {USENIX} Security Symposium ({USENIX} Security 14) (2014)
  19. Xu, Yifei, "A Search-based Firmware Code Analysis Method for IoT Devices", 2018 IEEE Conference on Communications and Network Security (CNS) (2018), IEEE
  20. English, K. Virgil, "Exploiting Memory Corruption Vulnerabilities in Connman for IoT Devices", 2019 49th Annual IEEE, 2019, ~[DOI]
  21. Cam, Nguyen Tan, "Detect malware in android firmware based on distributed network environment", 2019 IEEE 19th International Conference on Communication Technology (ICCT) (2019), IEEE
  22. Cheng, Kai, "DTaint: detecting the taint-style vulnerability in embedded device firmware", 2018 48th Annual IEEE, 2018, ~[DOI]
  23. Liu, Muqing, "Security analysis of vendor customized code in firmware of embedded device", International Conference on Security and Privacy in Communication Systems (2016), Springer
  24. Classen, Jiska, "Anatomy of a vulnerable fitness tracking system:Dissecting the fitbit cloud, app, and firmware", Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, 2(1), pp.1~24 (2018)
  25. Xie, Wei, "Vulnerability detection in iot firmware: A survey", 2017 IEEE 23rd International Conference on Parallel and Distributed Systems (ICPADS) (2017), IEEE
  26. Yao, Yao, "Identifying Privilege Separation Vulnerabilities in IoT Firmware with Symbolic Execution", European Symposium on Research in Computer Security (2019), Springe
  27. Al-Alami, Haneen, "Vulnerability scanning of IoT devices in Jordan using Shodan", 2017 2nd International Conference on the Applications of Information Technology in Developing Renewable Energy Processes &Systems (IT-DREPS) (2017), IEEE
  28. Krishnankutty, Deepak, "Fiscal:Firmware identification using side-channel power analysis", 2017 IEEE 35th VLSI Test Symposium (VTS) (2017), IEEE
  29. Hou, Jin-bing, "Research for vulnerability detection of embedded system firmware", Procedia Computer Science, 107, pp.814~818 (2017)
  30. Shirani, Paria, "Binarm: Scalable and efficient detection of vulnerabilities in firmware images of intelligent electronic devices", International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (2018), Springer
  31. Cui, Ang, "When firmware modifications attack: A case study of embedded exploitation", ~ (2013)
  32. Mulliner, Collin, "Read It Twice! A Mass-Storage-Based TOCTTOU Attack" (2012), WOOT
  33. Miller, Charlie, "Battery firmware hacking", pp.3~4 (2011), Black Hat USA
  34. Hudson, Trammell, "Thunderstrike: EFI firmware bootkits for Apple MacBooks", Proceedings of the 8th ACM International Systems and Storage Conference (2015)
  35. Papp, Dorottya, "Embedded systems security: Threats, vulnerabilities, and attack taxonomy", 2015 13th Annual Conference on Privacy, Security and Trust (PST) (2015), IEEE
  36. Choi, Byung-Chul, "Secure firmware validation and update for consumer devices in home networking", IEEE Transactions on Consumer Electronics, 62(1), pp.39~44 (2016)
  37. Konstantinou, Charalambos, "Impact of firmware modification attacks on power systems field devices", 2015 IEEE International Conference on Smart Grid Communications (SmartGridComm) (2015), IEEE
  38. Liu, Jiajia, "Smart attacks against intelligent wearables in people-centric internet of things", IEEE Communications Magazine, 54(12), pp.44~49 (2016)
  39. Ling, Zhen, "Security vulnerabilities of internet of things: A case study of the smart plug system", IEEE Internet of Things Journal, 4(6), pp.1899~1909 (2017)
  40. Shudrak, Maxim, "The technique of dynamic binary analysis and its application in the information security sphere", Eurocon 2013 (2013), IEEE
  41. Chen, Jiongyi, "IoTFuzzer:Discovering Memory Corruptions in IoT Through App-based Fuzzing" (2018), NDSS
  42. Manès, Valentin Jean Marie, "The art, science, and engineering of fuzzing: A survey", IEEE Transactions on Software Engineering (2019)
  43. Zheng, Yaowen, "FIRM-AFL:high-throughput greybox fuzzing of iot firmware via augmented process emulation", 28th {USENIX} Security Symposium ({USENIX} Security 19) (2019)
  44. Kim, Taegyu, "RVFUZZER : finding input validation bugs in robotic vehicles through control-guided testing", 28th {USENIX} Security Symposium ({USENIX}Security 19) (2019)
  45. Gui, Zhijie, "FIRMCORN:Vulnerability-Oriented Fuzzing of IoT Firmware via Optimized Virtual Execution", IEEE Access, 8, pp.29826~29841 (2020)
  46. Yu, Bo, "Poster: Fuzzing iot firmware via multi-stage message generation", Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (2019)
  47. Srivastava, Prashast, "FirmFuzz:automated IoT firmware introspection and analysis", Proceedings of the 2nd International ACM Workshop on Security and Privacy for the Internet-of-Things (2019)
  48. Shila, Devu Manikantan, "I can detect you:Using intrusion checkers to resist malicious firmware attacks", 2016 IEEE Symposium on Technologies for Homeland Security (HST) (2016), IEEE
  49. Li, Yanlin, "VIPER: verifying the integrity of PERipherals' firmware", Proceedings of the 18th ACM conference on Computer and communications security (2011)
  50. Eriksson, Jakob, "Truelink: A practical countermeasure to the wormhole attack in wireless networks", Proceedings of the 2006 IEEE International Conference on Network Protocols (2006), IEEE
  51. Cao, Fei, "Vulnerability Model and Evaluation of the UEFI Platform Firmware Based on Improved Attack Graphs", 2018 IEEE 9th International Conference on Software Engineering and Service Science (ICSESS) (2018), IEEE
  52. Sun, Pengfei, "Hybrid Firmware Analysis for Known Mobile and IoT Security Vulnerabilities", 2020 50th Annual IEEE, 2020, ~[DOI]
  53. Shoshitaishvili, Yan, "Firmalice-automatic detection of authentication bypass vulnerabilities in binary firmware" (2015), NDSS
  54. Maskiewicz, Jacob, "Mouse Trap:Exploiting Firmware Updates in {USB}Peripherals", 8th {USENIX} Workshop on Offensive Technologies ({WOOT} 14) (2014)
  55. David, Yaniv, "Firmup: Precise static detection of common vulnerabilities in firmware", ACM SIGPLAN Notices, 53(2), pp.392~404 (2018)
  56. Costin, Andrei, "Automated dynamic firmware analysis at scale: a case study on embedded web interfaces", Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security (2016)
  57. Visoottiviseth, Vasaka, "Firmaster:Analysis Tool for Home Router Firmware", 2018 15th International Joint Conference on Computer Science and Software Engineering (JCSSE) (2018), IEEE
  58. Hernandez, Grant, "Firmusb:Vetting USB device firmware using domain informed symbolic execution", Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (2017)
  59. Davidson, Drew, "{FIE} on firmware: Finding vulnerabilities in embedded systems using symbolic execution", 22nd {USENIX} Security Symposium ({USENIX}Security 13) (2013)
  60. Zaddach, Jonas, "AVATAR: A Framework to Support Dynamic Security Analysis of Embedded Systems'Firmwares", NDSS, 14 (2014)
  61. Thomas, Sam L., "HumIDIFy: a tool for hidden functionality detection in firmware", International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (2017), Springer
  62. Chen, Daming D., "Towards Automated Dynamic Analysis for Linux-based Embedded Firmware", NDSS, 16 (2016)
  63. Okmianski, Anton, "Method of identifying a home gateway using network traffic sniffing and apparatus employing the same", U.S. Patent No. 7,505,464, ~ (2009)
  64. Chong, Hon Fong, "Development of IoT device for traffic management system", 2016 IEEE Student Conference on Research and Development (SCOReD) (2016), IEEE
  65. Lu, Chung-Ming, "Communication system for devices with UART interfaces", U. S. Patent No. 7, 650, 449, ~ (2010)
  66. Zadigian, Timothy, "JTAG-based programming and debug", U.S. Patent No. 8,856,600, ~ (2014)
  67. Rosenfeld, Kurt, "Attacks and Defenses for JTAG", IEEE Design & Test of Computers, 27(1), pp.36~47 (2010)
  68. Hwang, Joo-Young, "Xen on ARM:System virtualization using Xen hypervisor for ARM-based secure mobile phones", 2008 5th IEEE Consumer Communications and Networking Conference (2008), IEEE
  69. Ito, Masayuki, "An 8640 MIPS SoC with independent power-off control of 8CPUs and 8 RAMs by an automatic parallelizing compiler", 2008 IEEE International Solid-State Circuits Conference-Digest of Technical Papers (2008), IEEE
  70. Pastrnak, Milan, "Data-flow timing models of dynamic multimedia applications for multiprocessor systems", 4th IEEE International Workshop on System-on-chip for Real-time Applications (2004), IEEE
  71. Avgerinos, Thanassis, "AEG:Automatic exploit generation", ~ (2011)
  72. [URL]
  73. "Binwalk"[URL]
  74. Pa, Yin Minn Pa, "IoTPOT: analysing the rise of IoT compromises", 9th {USENIX} Workshop on Offensive Technologies ({WOOT} 15) (2015)
  75. Bellard, Fabrice, "QEMU, a fast and portable dynamic translator", USENIX Annual Technical Conference, FREENIX Track, 41 (2005)
  76. Zheng, Yaowen, "FIRM-AFL:high-throughput greybox fuzzing of iot firmware via augmented process emulation", 28th {USENIX} Security Symposium ({USENIX} Security 19) (2019)
  77. Microsoft, "Security Development Lifecycle - SDL Process Guidance Version 5.2", ~ (2012)

관련 논문AI추천

IoT 기기 취약점 분석을 위한 펌웨어 추출 및 분석 환경 구축 방법론이승민, 이예준, 조효진한국정보보호학회 · 정보보호학회논문지2024 · 제34권 제6호IoT 펌웨어 취약점 분석 효율성 제고를 위한 시스템 개발에 관한 연구조영민한국산업보안연구학회 · 한국산업보안연구2022 · 제12권 제1호복합 에뮬레이션을 이용한 효율적인 커버리지 가이드 IoT 펌웨어 퍼징 기법김주환, 김현욱, 윤주범한국정보보호학회 · 정보보호학회논문지2020 · 제30권 제5호공개 펌웨어 수집 및 펌웨어 바이너리 SBOM 생성 기법 연구박정흠, 이인혁, 정수은한국정보보호학회 · 정보보호학회논문지2024 · 제34권 제6호임베디드 디바이스 펌웨어의 웹 인터페이스 취약점 식별을 위한 에뮬레이션 기반 퍼징 기법김지민, 지청민, 허정민, 홍만표한국정보보호학회 · 정보보호학회논문지2019 · 제29권 제6호IoT 봇넷 악성코드 기반 침해사고 흔적 수집 방법이형우한국사물인터넷학회 · 사물인터넷융복합논문지2021 · 제7권 제3호

이 간행물의 다른 논문 (9건)

주파수 분석 기반 RSA 단순 전력 분석정지혁, 윤지원pp. 1-9IoD 환경에서 MEC를 활용한 U2U 인증에서 보안 취약점 분석최재현, 정익래, 변진욱, 이상훈pp. 11-17SIDH 기반 암호 구현에 대한 홀수 차수 아이소제니 적용윤기순, 박영호, 김수리pp. 19-30입력 변이에 따른 딥러닝 모델 취약점 연구 및 검증권태경, 박래현, 김재욱pp. 51-59Windows에서의 Wire 크리덴셜 획득 및 아티팩트 분석김종성, 윤병철, 신수민, 김소람pp. 61-71
원문 보기