固件边界二进制程序的危险路径收集与脆弱性检测  

Collection of Dangerous Paths and Vulnerability Detection for Firmware Border Binary Programs

作　　者：张士超 茆琳 谢耀滨[1] 彭慜威 刘春玲[1] ZHANG Shichao;MAO Lin;XIE Yaobin;PENG Minwei;LIU Chunling(Information Engineering University,Zhengzhou 450001,China;Unit 92196,Qingdao 266000,China)

机构地区：[1]信息工程大学,河南郑州450001 [2]92196部队,山东青岛266000

出　　处：《信息工程大学学报》2024年第6期744-750,共7页Journal of Information Engineering University

基　　金：河南省重点研发专项(221111210300)。

摘　　要：物联网(IoT)设备固件中Web服务程序的脆弱性对设备带来严重威胁,Web服务程序后端接收并处理前端输入,称为边界二进制程序。针对常用的污点分析、符号执行等脆弱性检测方法导致边界二进制程序检测误报率高的问题,提出一种利用前后端交互逻辑的方式检测设备固件中二进制程序的脆弱性框架。首先,对解包的固件文件系统进行自动扫描,识别出Web服务相关的边界二进制程序;其次,在边界二进制程序中搜索潜在脆弱性的危险路径;最后,通过危险路径的污点分析,检测脆弱性的有效性。在公开的固件集进行测试,与SaTC工具相比,该方法可以显著提高固件二进制程序中脆弱性的发现效率。The vulnerability of the Web service program in the firmware of Internet of Things(IoT)de-vices poses a serious threat to the devices.The back-end of the Web service program receives and pro-cesses input from the front-end,which is called a border binary program.To address the problem that the common vulnerability detection methods,such as taint analysis and symbol execution,lead to a high false alarm rate when detecting border binary programs,a framework is proposed,which is used to detect binary program vulnerability in device firmware by using front-end and back-end interaction logic.Firstly,the unpacked firmware file system is automatically scanned to identify the Web service-related boundary binaries.Secondly,the dangerous path of potential vulnerability is searched in the boundary binary program.Finally,the effectiveness of vulnerability is tested through the stain analysis of the dangerous path.Tested on a publicly available firmware set,the method can significantly im-prove the efficiency of vulnerability discovery in firmware binaries compared to the SaTC.

关 键 词：脆弱性 边界二进制程序 危险函数 物联网 危险路径 

分 类 号：TP309.1[自动化与计算机技术—计算机系统结构]