PaperlayerView exact revision on arXiv

Source-linked AI summary

Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces

Andrei Costin, Apostolis Zarras, Aurélien Francillon

arXiv:1511.03609v1cs.CRcs.DCcs.NI

TL;DR

Embedded web interfaces are a substantial attack surface, yet their vulnerabilities are difficult to discover and confirm. The paper presents a scalable, software-only framework for automated firmware emulation and static/dynamic web-interface analysis, finding vulnerabilities in 185 firmware images across 1,925 images from 54 vendors.

  • Problem

    Vulnerabilities in embedded web interfaces are difficult to discover, analyze, and confirm, while many embedded systems lack clear security goals or threat models.

  • Method

    The framework automatically performs full-system firmware emulation in a software-only environment and applies static and dynamic analysis tools to embedded web interfaces.

  • Results

    185 firmware images contained 9,271 vulnerabilities after aggregating static and dynamic analysis, based on 1,925 images from 54 vendors.

  • Takeaways & Limitations

    The results demonstrate the viability of scalable automated dynamic analysis for discovering vulnerabilities in embedded web interfaces.

  • Takeaways & Limitations

    The framework inherits false-positive and false-negative limitations from its existing web vulnerability-finding tools, which frequently miss command-injection flaws.

Abstract

from arXiv · show

Embedded devices are becoming more widespread, interconnected, and web-enabled than ever. However, recent studies showed that these devices are far from being secure. Moreover, many embedded systems rely on web interfaces for user interaction or administration. Unfortunately, web security is known to be difficult, and therefore the web interfaces of embedded systems represent a considerable attack surface. In this paper, we present the first fully automated framework that applies dynamic firmware analysis techniques to achieve, in a scalable manner, automated vulnerability discovery within embedded firmware images. We apply our framework to study the security of embedded web interfaces running in Commercial Off-The-Shelf (COTS) embedded devices, such as routers, DSL/cable modems, VoIP phones, IP/CCTV cameras. We introduce a methodology and implement a scalable framework for discovery of vulnerabilities in embedded web interfaces regardless of the vendor, device, or architecture. To achieve this goal, our framework performs full system emulation to achieve the execution of firmware images in a software-only environment, i.e., without involving any physical embedded devices. Then, we analyze the web interfaces within the firmware using both static and dynamic tools. We also present some interesting case-studies, and discuss the main challenges associated with the dynamic analysis of firmware images and their web interfaces and network services. The observations we make in this paper shed light on an important aspect of embedded devices which was not previously studied at a large scale. We validate our framework by testing it on 1925 firmware images from 54 different vendors. We discover important vulnerabilities in 185 firmware images, affecting nearly a quarter of vendors in our dataset. These experimental results demonstrate the effectiveness of our approach.

I. INTRODUCTION

Embedded web interfaces combine widespread embedded-system security concerns with difficult-to-scale vulnerability analysis. The paper addresses this gap through a software-only framework combining firmware emulation with static and dynamic analysis.

  • Motivation: Embedded devices increasingly use web interfaces for administration, while embedded systems and web applications both have established security problems.The paper identifies embedded web interfaces as a substantial attack surface because web applications are difficult to secure and embedded devices are often insecure.
  • Analysis Challenges: Existing static and dynamic techniques are difficult to apply reliably at scale because embedded interfaces use heterogeneous technologies and require functional firmware environments.Static tools leave some server-side technologies uncovered and may produce many false positives, while dynamic tools require working system or interface emulation.
  • Analysis Challenges: Live-device testing is expensive, ethically problematic without ownership, and does not scale; hosted extraction also fails to reproduce many native CGIs and architecture-dependent features.These limitations motivate executing firmware in a controlled software environment rather than testing physical devices or transplanted web files.
  • Framework: The framework performs preprocessing, static analysis, partial firmware emulation, and automated web-interface testing in a distributed cloud setup.It identifies document roots, analyzes web-root modules, and replaces the firmware kernel with a stock kernel for partial emulation.
  • Contributions: The study presents a scalable, automated, software-only framework and applies it to a large-scale security study of embedded web interfaces.The contributions include describing emulation challenges and leveraging multiple existing analysis techniques and tools.
  • Results: 225 previously unknown serious vulnerabilities were automatically discovered in 45 firmware images.The broader dataset comprised 1925 firmware images from 54 vendors, with static and dynamic analysis used in the study.

C. Outline

The paper proceeds from emulation and analysis techniques to the framework, dataset, results, ethics and limitations, related work, and conclusion. This organization supports a systematic presentation of the large-scale security study.

  • Outline: Section II reviews techniques for emulating and analyzing embedded firmware and web interfaces, including their limitations and the rationale for the paper’s choices.
  • Outline: The later sections present the framework and dataset, evaluate results and case studies, discuss ethics and limitations, summarize related work, and conclude the paper.

A. Static Analysis

Static analysis is scalable and broadly automatable, but embedded web interfaces often use technologies unsupported by available tools. Dynamic analysis complements it by exercising interfaces across implementation technologies and confirming findings.

  • Static analysis tools are scalable and easy to automate because they generally require only source code or an application.
  • Static analysis can produce both false negatives and false positives, with false positives becoming problematic in large-scale automated setups.
  • Embedded firmware often relies on uncommon technologies, including Lua, Haserl, and binary CGIs, for which suitable static-analysis tools may not exist.
  • Dynamic analysis is largely independent of server-side technology and can confirm vulnerabilities identified through static analysis.
  • The framework selected Arachni, ZAP, and w3af as free, open-source web penetration tools, while allowing other tools to supplement or replace them.
  • Hosting extracted interfaces simplifies deployment and scaling, but cannot handle platform-dependent binaries and CGIs; 57% of 1580 candidates had such dependencies.

2) Firmware and Web Interface Emulation:

The paper compares firmware-emulation strategies under the constraints of unknown hardware, missing kernels, and incomplete peripheral support. A generic-kernel chroot provides the best reported balance of accuracy, complexity, speed, and scalability.

  • 22?
  • a) Perfect emulation: Perfect hardware emulation is impractical for unknown embedded devices because QEMU supports few platforms and hardware may be highly customized.
  • b) Original kernel and filesystem on a generic emulator: Only 5% of firmware images in the dataset contained kernels, making reuse of the original kernel infeasible.
  • c) Firmware chroot with a generic kernel and filesystem: A firmware chroot with a generic kernel and filesystem preserves the original filesystem structure, starts the web server and interface, and executes native programs.
  • c) Firmware chroot with a generic kernel and filesystem: Emulation is one order of magnitude slower than native execution and cannot fully reproduce peripherals or specific kernel extensions.
  • c) Firmware chroot with a generic kernel and filesystem: This chroot approach offers the best trade-off among emulation accuracy, complexity, and speed, while scaling and producing the best dynamic-analysis results.
  • d) Architectural chroot: Architectural chroot improves speed but was too unstable for large-scale use and was therefore excluded from the setup.

A. Firmware Selection

Firmware selection and preparation use automated filtering, filesystem heuristics, and web-server discovery to produce emulation candidates. Sanitization improves launchability but adds processing overhead and cannot eliminate unpacking limitations.

  • A. Firmware Selection: The framework selects successfully unpacked Linux firmware that can be natively emulated and chrooted, then identifies web-server binaries, configurations, and interface code.
  • A. Firmware Selection: Firmware packages may contain multiple architectures, multiple firmware blobs, or layered archives, requiring detection of candidate root filesystems.
  • A. Firmware Selection: Broken unpacking, customized archive formats, and malformed symbolic links can produce incorrect root filesystems.
  • 1) Filesystem Sanitization: 13% processing overhead from sanitization increased successful emulations by 2% and successful web-server launches by 11%.
  • A. Firmware Selection: Web-server paths and configuration files provide enough information to launch servers and extract settings such as the document root.
  • A. Firmware Selection: Optimized site maps guide dynamic tools toward URLs, but restricting analysis can miss dynamically generated content or pages served by monolithic binaries.

C. Analysis Phase

The analysis phase runs static and dynamic tools in isolated virtual machines, collects reports and execution evidence, and uses those records to investigate and reproduce findings.

  • Prepared filesystems are emulated in analysis VMs for dynamic testing, while document roots are submitted to static analyzers; firmware analyses run independently and scale well.
  • The framework collects vulnerability reports, filesystem changes, SSH logs, and captured network traffic to support further analysis and debugging.
  • Filesystem snapshots before, during, and after emulation are differenced to identify modified and newly created files.
  • Recovering complete HTTP input histories is necessary because fuzzing tools may trigger vulnerabilities through combinations of earlier inputs rather than the final request.
  • High-impact vulnerabilities are manually validated and proof-of-concept exploits are attempted, while selected static findings can guide subsequent dynamic analysis.

IV. DATASET

The dataset began with 1925 unpacked Linux-based firmware images and was progressively narrowed using web-interface and emulation criteria, with substantial attrition before analysis. The resulting dataset spans multiple architectures and web technologies, enabling static vulnerability analysis alongside dynamic testing.

  • Dataset construction: 1925 unpacked firmware images formed the initial Linux-based dataset collected from publicly available sources.The selection targeted systems considered comparatively easy to emulate.
  • Dataset construction: 1580 firmware candidates met heuristics requiring web-server binaries, configuration files, or web-interface code.Examples included httpd, lighttpd, boa.conf, HTML, JavaScript, PHP, and CGI.
  • Analysis pipeline: 488 candidates could be chrooted, 246 web interfaces launched, and 185 yielded high-impact vulnerabilities.These successive stages show substantial losses from candidate selection to vulnerability discovery.
  • Scope boundaries: The dataset is biased toward publicly available, Linux-based firmware images, tested mainly on ARM, MIPS, and MIPSel architectures.Additional architectures were not the primary focus of the experiments.
  • Static vulnerability analysis: Static analysis identified 145 unique firmware packages containing 9046 reported issues, with cross-site scripting and file manipulation comprising most findings.Command injection ranked third among the reported vulnerability classes.

C. Dynamic Analysis Vulnerabilities

Dynamic analysis covered 246 distinct web interfaces and found command injection, XSS, and CSRF across multiple embedded-device types. A hosted alternative broadened coverage but produced a narrower vulnerability profile and required manual interventions, while HTTPS support remained uncommon.

  • Dynamic findings: 246 distinct web interfaces underwent dynamic security testing.The tested interfaces came from firmware images that successfully launched their embedded web servers.
  • Dynamic findings: 21 firmware packages were vulnerable to command injection, while 32 had XSS and 37 had CSRF.The paper notes that XSS and CSRF can nevertheless have high impact in embedded devices.
  • Device coverage: The discovered vulnerabilities affected SOHO routers, CCTV cameras, and smaller WiFi devices, although correlating firmware with online populations was left for future work.Shodan and ZMap are identified as possible tools for that future correlation.
  • Overall result: 24% of dynamically tested firmware images contained vulnerabilities, demonstrating the approach’s viability.The paper summarizes this as roughly one vulnerable firmware image in four.
  • Hosted analysis: The hosted technique tested more firmware images but almost exclusively reported CSRF and found no new command injection or XSS vulnerabilities.The authors attribute missing categories partly to side effects from static web-server configuration.
  • Hosted analysis: Manual hosting adjustments included installing Apache modules, disabling .htaccess files, and changing interpreter paths, limiting scalability.The paper concludes that emulation and hosting are complementary, with emulation finding more vulnerabilities whenever feasible.
  • HTTPS and network services: Nearly 19% of original firmware images contained an HTTPS certificate, and around 24% of HTTP-starting instances also started HTTPS.Both figures are described as lower-bound estimates.

F. Analysis of the Failures

The framework’s large-scale emulation produced many failures, so the authors sampled logs to estimate causes, repairability, and coverage limitations. They found that some failures were easy to fix, while missing hardware and heterogeneous environments remained substantial obstacles.

  • Failure analysis: 69% of original firmware images failed chroot, and around 50% of successfully chrooted packages failed to start the embedded web interface.These failures limited coverage of tested firmware images and motivated failure analysis.
  • Chroot failures: 40.9% ± 9.8% of 1092 chroot failures were attributed to actual chroot failures, while the remainder included cases where chroot succeeded but detection failed.The estimate was based on logs from 88 randomly selected firmware files.
  • Chroot failures: 11.3% ± 6.3% of 1092 firmware images had chroot exec-format failures caused by incorrect architecture guesses or illegal instructions.The authors considered changing the QEMU architecture or improving instruction support relatively easy fixes.
  • Chroot failures: 29.5% ± 9.1% of 1092 images were partial firmware updates lacking shell or busybox binaries required for chroot.Replacing missing utilities could fix these cases, but the resulting firmware would diverge from the actual device firmware.
  • Web-interface failures: 65.2% ± 9.5% of 242 web-server failures were generally hard to fix because missing devices caused the failures.Examples included eth1, br0, /dev/gpio, and /dev/mtdblock0; missing specifications could make emulation impossible.
  • Web-interface failures: 34.8% ± 9.6% of web-server failures were estimated to have easy fixes that could eventually enable embedded web-interface launch.The estimate covered 24 samples among the analyzed web-server failures.

G. Case Study: Netgear Networking Devices

The Netgear case study shows that combining static and dynamic analysis can uncover exploitable vulnerabilities across multiple device types and firmware images. The framework found command injection and XSS in manufacturer-data modules, alongside additional manually identified pre-authentication weaknesses.

  • Findings: At least 8 Netgear device types contained previously unknown command-injection and XSS vulnerabilities exploitable by non-authenticated users.The vulnerabilities were automatically discovered and manually confirmed on emulated interfaces and some physical devices.
  • Root causes: Unsafe unsanitized exec calls caused command injection, while unsafe unsanitized echo calls caused XSS in PHP manufacturer-data modules.The modules stored and displayed user-controlled values such as MAC addresses and hardware-register values.
  • Analysis approach: Static analysis with RIPS also discovered the PHP vulnerabilities, allowing dynamic analysis to focus on modules flagged during the static phase.The authors present this as support for combining static and dynamic analysis.
  • Additional findings: Manual analysis revealed additional pre-authentication issues, including privilege escalation to web administration, unencrypted configuration storage, and unauthorized configuration downloads.Examples of downloaded data included WPAx keys and passwords.
  • Exposure: Around 500 potentially affected devices were reported by Shodan, but the number of affected worldwide devices could not be determined from the available data.The WIGLE database reported several million wireless devices from the vendor but lacked detailed device-type information.
  • Affected firmware: The vulnerable PHP modules appeared in more than 30 firmware images across the affected 8 device types.The paper lists their SHA-256 hashes and byte sizes in Table X.

H. Case Study: Samsung CCTV Cameras

The Samsung CCTV case study demonstrates the framework’s use of static analysis followed by partial emulation to investigate vulnerabilities in a camera web interface. It automatically identified command injection and multiple XSS vulnerabilities, while the broader emulation setup remained subject to environmental limitations.

  • Findings: The framework automatically discovered a command injection and multiple XSS vulnerabilities in a Samsung CCTV camera’s web interface.The camera provided Ethernet networking, advanced functions, and web administration for SOHO and enterprise settings.
  • Analysis approach: RIPS reported multiple potential vulnerability types in the camera’s PHP CGI scripts during the static-analysis phase.The subsequent workflow used a partial PHP implementation and the Hosted technique for further analysis.
  • Emulation challenges: The approach was able to discover vulnerabilities in web interfaces running inside an emulated environment, but setting up such environments was not always straightforward.The paper attributes several limitations to failures analyzed earlier in the study.
  • Emulation challenges: Emulated web interfaces sometimes returned HTTP 500 or 404 responses because scripts, binaries, permissions, or web-server configuration were incorrect.The framework tried combinations of discovered configuration files and document roots to overcome configuration-related failures.

3) Imperfect Emulation:

Imperfect emulation limits the framework through missing peripherals, outdated-version uncertainty, heterogeneous firmware behavior, and necessary manual intervention. These constraints define where automated analysis requires engineering effort or cautious interpretation.

  • Emulation limitations: Missing peripheral devices, especially nonvolatile memories such as NVRAM, commonly caused QEMU emulation failures.NVRAM stores boot and configuration information, and the paper discusses universal or on-the-fly emulators as possible remedies.
  • Version scope: The experiments did not necessarily use the latest firmware versions, so discovered vulnerabilities may not apply to current releases.The authors argue that older vulnerabilities can still provide useful input or mutation templates for testing newer versions.
  • Version scope: Users may apply firmware updates less often or less quickly than desired unless effective Internet-connected auto-update is enabled.Field-deployed devices may also require difficult or impossible physical access for updates.
  • Automation boundary: Manual intervention remains necessary for newly encountered web-server types and for inspecting results to confirm vulnerabilities.The framework is designed to maximize automation, but these steps are not fully automated.

VII. RELATED WORK

Prior work examined embedded-device and web-interface security through static analysis, manual studies, Internet scanning, emulation, and black-box testing. This work differs by automating dynamic firmware analysis at scale and validating it across hundreds of firmware images.

  • Embedded-device analysis: Earlier embedded-device studies used simple static analysis or manual analysis of small device samples.One large-scale study used only simple static analysis, while other studies manually examined 21 or about 10 devices.
  • Embedded-device analysis: Internet-wide scanning commonly found devices exposed to known vulnerabilities and raised serious ethical problems.These approaches sometimes helped discover new flaws but generally identified devices vulnerable to manually discovered bugs.
  • Web-interface analysis: Web vulnerability research developed static data-flow techniques and evaluated automated black-box scanners, while exposing limitations in their accuracy and coverage.Evaluations reported promise but also limitations, including inaccurate identification of all vulnerabilities and lower accuracy on Linux-based hosts.
  • Emulation-based analysis: Emulation-based frameworks supported firmware security testing, but existing approaches either forwarded peripheral I/O to real hardware or required manual annotations.Avatar combined QEMU with a physically attached device, whereas Firmalice detected known backdoors but was not scalable because of manual annotations.
  • This work: The proposed framework performs scalable, automated dynamic firmware analysis through software-only emulation and found serious vulnerabilities across emulated firmware images.It tested 246 firmware images, found serious vulnerabilities in at least 24% of emulated interfaces, and reported 9271 issues in 185 firmware images when static analysis was included.
  • This work: Future work targets better emulation, automated exploit synthesis, deeper dynamic analysis, and the difficulty of responsible vulnerability disclosure at scale.The authors identify unknown-hardware emulation quality, exploit confirmation, vendor disclosure, and more sophisticated dynamic techniques as open challenges.
Loading 1511.03609v1…