基于固件分析的路由器Web页面安全评估技术  

Security Assessment Technology of Router Web Page based on Firmware Analysis

作　　者：李建春 谢瑞云[1] 张旭博[1] LI Jian-chun;XIE Rui-yun;ZHANG Xu-bo(No.30 Institute of CETC,Chengdu Sichuan 610064,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《通信技术》2018年第3期676-681,共6页Communications Technology

摘　　要：路由器web页面用于对路由器进行管理设置,具有界面友好、操作便捷等特点,因而应用比较广泛。当前,路由器页面已经成为对路由器攻击的重要入口。为了提升路由器web页面的安全防护能力,减少漏洞,需要对路由器的web页面进行评估。因此,提出了一种基于固件分析的路由器web页面评估技术,并利用此方法分析了D-link系列路由器web页面漏洞,验证了该方法的有效性和可用性,可为路由器安全分析、路由器厂商安全加固提供借鉴。The router web page,being used to manage and set up the router,is now widely used for its characteristics of friendly interface and convenient operation.And currently,the router page becomes the main entrance to router attacks.In order to improve the security capability and reduce the vulnerability of the router web page,it is necessary to evaluate the web page of the router.For this reason,the router webpage evaluation technology based on firmware analysis is proposed.Experiment indicates the validity and availability of the proposed technology,and this technology may provide a reference for router security analysis and the vendor's router security reinforcement.

关 键 词：路由器web页面 安全评估 固件分析 登录验证 

分 类 号：TP97[自动化与计算机技术]