无文件系统嵌入式固件后门检测  

Backdoor detection in embedded system firmware without file system

作　　者：忽朝俭[1,2] 薛一波[1] 赵粮[2] 李舟军[3] 

机构地区：[1]清华大学信息技术研究院,北京100084 [2]绿盟科技,北京100089 [3]北京航空航天大学计算机学院,北京100191

出　　处：《通信学报》2013年第8期140-145,共6页Journal on Communications

基　　金：国家自然科学基金资助项目(61170189;60973105;90718017);国家科技重大专项基金资助项目(2012ZX03002002-003)~~

摘　　要：在无文件系统嵌入式固件中,系统代码和应用代码集成在单个文件中,无法看到熟悉的系统调用名字,故针对此类固件的分析将更为困难。以此类固件为研究对象,分析了其中的库函数识别问题,并提出了一种针对网络套接字和字符串/内存操作函数的基于启发式规则的识别方法。在此基础上,讨论了多种典型的后门类型检测问题,包括未授权侦听者、非预期功能、隐藏功能和向外的连接请求等,并在一款实际系统上成功检测出多个后门(其中有一个严重级别的)。实验结果表明,提出的针对无文件系统嵌入式固件的库函数识别方法对于此类固件的安全分析具有重要的参考价值。Any embedded system firmware without file system will integrate its system code and user application code into a single file. This setting has brought some additional difficulties to analyze them. Aimed at this kind of firmware, the problem of library function identification was analyzed, and several heuristic methods to recognize some important function relevant with manipulating network socket and character string / memory were proposed. Based on this analysis, the backdoor detection problem of some typical types including unauthorized listener, unintended function, hidden function, outward connection request etc. were discussed, and several backdoors （one is critical level） in a real world firmware were found. The result shows this method of identifying library function can be useful for security analysis to this type of firmware.

关 键 词：嵌入式系统 固件 文件系统 库函数识别 后门检测 

分 类 号：TP311.1[自动化与计算机技术—计算机软件与理论]