Understanding Security Risks of Embedded Devices Through Fine-Grained Firmware Fingerprinting

Simple item page
dc.contributor.authorLi, Qiangen
dc.contributor.authorTan, Daweien
dc.contributor.authorGe, Xinen
dc.contributor.authorWang, Hainingen
dc.contributor.authorLi, Zhien
dc.contributor.authorLiu, Jiqiangen
dc.date.accessioned2023-04-26T12:58:47Zen
dc.date.available2023-04-26T12:58:47Zen
dc.date.issued2022-11en
dc.description.abstractAn increasing number of embedded devices are connecting to the Internet, ranging from cameras, routers to printers, while an adversary can exploit security flaws already known to compromise those devices. Security patches are usually associated with the device firmware, which relies on the device vendors and products. Due to compatibility and release-time issues, many embedded devices are still using outdated firmware with known vulnerabilities or flaws. In this article, we conduct a systematic study on device vulnerabilities by leveraging firmware fingerprints. Specifically, we use a web crawler to gather 9,716 firmware images from official websites of device vendors, and 347,685 security reports scattered across data archives, blogs, and forums. We propose to generate fine-grained fingerprints based on the subtle differences between the filesystems of various firmware images. Furthermore, machine learning algorithms and regex are used to identify device vulnerabilities and corresponding device firmware fingerprints. We perform real-world experiments to validate the performance of the firmware fingerprint, which yields high accuracy of 91% precision and 90% recall. We reveal that 6,898 reports have the firmware and related vulnerability information, and there are more than 10% of firmware vulnerabilities without any patches or solutions for mitigating underlying security risks.en
dc.description.notesThe work was supported in part by the National Key R&D Program of China under Grant 2018YFB0803402, in part by the National Natural Science Foundation of Chinaunder under Grant 61972024, and in part by the National Key R&D Program of China under Grant 2020YFB2103802.en
dc.description.sponsorshipNational Key R&D Program of China [2020YFB2103802]; National Natural Science Foundation of Chinaunder [61972024]en
dc.description.versionPublished versionen
dc.format.mimetypeapplication/pdfen
dc.identifier.doihttps://doi.org/10.1109/TDSC.2021.3119970en
dc.identifier.eissn1941-0018en
dc.identifier.issue6en
dc.identifier.urihttp://hdl.handle.net/10919/114798en
dc.identifier.volume19en
dc.language.isoenen
dc.publisherIEEEen
dc.rightsCreative Commons Attribution 4.0 Internationalen
dc.rights.urihttp://creativecommons.org/licenses/by/4.0/en
dc.subjectSecurityen
dc.subjectInterneten
dc.subjectMicroprogrammingen
dc.subjectBlogsen
dc.subjectPerformance evaluationen
dc.subjectFingerprint recognitionen
dc.subjectSoftwareen
dc.subjectFirmwareen
dc.subjectfingerprintingen
dc.subjectembedded deviceen
dc.subjectvulnerabilityen
dc.titleUnderstanding Security Risks of Embedded Devices Through Fine-Grained Firmware Fingerprintingen
dc.title.serialIEEE Transactions on Dependable and Secure Computingen
dc.typeArticle - Refereeden
dc.type.dcmitypeTexten

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
LiUnderstanding.pdf
Size:
1.95 MB
Format:
Adobe Portable Document Format
Description:
Published version
Download

Collections

Scholarly Works, Electrical and Computer Engineering