Automated Rehosting and Instrumentation of Embedded Firmware
Vulnerable embedded systems continue to proliferate as the Internet of Things (IoT) grows. Rehosting enables security analysis of these devices by separating embedded firmware from its host hardware, allowing the firmware to be run and inspected in virtual environments. I present a system to perform...
| Main Author: | |
|---|---|
| Other Authors: | |
| Format: | Thesis |
| Published: |
Massachusetts Institute of Technology
2022
|
| Online Access: | https://hdl.handle.net/1721.1/139071 |
| _version_ | 1826200186773307392 |
|---|---|
| author | Ramseyer, Ryan William |
| author2 | Rinard, Martin C. |
| author_facet | Rinard, Martin C. Ramseyer, Ryan William |
| author_sort | Ramseyer, Ryan William |
| collection | MIT |
| description | Vulnerable embedded systems continue to proliferate as the Internet of Things (IoT) grows. Rehosting enables security analysis of these devices by separating embedded firmware from its host hardware, allowing the firmware to be run and inspected in virtual environments. I present a system to perform automated rehosting and instrumentation of embedded firmware: ARI. ARI improves upon previous methods by performing progressive fidelity assessments and automatically applying various failure-oblivious, network, and filesystem fixes necessary to enable web service operation. On successfully emulated systems, ARI further instruments and tests embedded web servers using the popular dynamic analysis tool, Valgrind. On a corpus of 1709 Linux-based firmware samples, representing 617 unique IoT products, ARI enables successful web service execution on 1017 samples, a 125% improvement over an existing system, Firmadyne. Results are used to inform analysis of rehosting as a technique to improve security assessments of Department of Defense (DoD) embedded systems. Barriers to adoption, including intellectual property and lack of standardization, are outlined and mitigations leveraging existing digital acquisition methods are suggested. |
| first_indexed | 2024-09-23T11:32:29Z |
| format | Thesis |
| id | mit-1721.1/139071 |
| institution | Massachusetts Institute of Technology |
| last_indexed | 2024-09-23T11:32:29Z |
| publishDate | 2022 |
| publisher | Massachusetts Institute of Technology |
| record_format | dspace |
| spelling | mit-1721.1/1390712022-01-15T03:40:33Z Automated Rehosting and Instrumentation of Embedded Firmware Ramseyer, Ryan William Rinard, Martin C. Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science Massachusetts Institute of Technology. Institute for Data, Systems, and Society Vulnerable embedded systems continue to proliferate as the Internet of Things (IoT) grows. Rehosting enables security analysis of these devices by separating embedded firmware from its host hardware, allowing the firmware to be run and inspected in virtual environments. I present a system to perform automated rehosting and instrumentation of embedded firmware: ARI. ARI improves upon previous methods by performing progressive fidelity assessments and automatically applying various failure-oblivious, network, and filesystem fixes necessary to enable web service operation. On successfully emulated systems, ARI further instruments and tests embedded web servers using the popular dynamic analysis tool, Valgrind. On a corpus of 1709 Linux-based firmware samples, representing 617 unique IoT products, ARI enables successful web service execution on 1017 samples, a 125% improvement over an existing system, Firmadyne. Results are used to inform analysis of rehosting as a technique to improve security assessments of Department of Defense (DoD) embedded systems. Barriers to adoption, including intellectual property and lack of standardization, are outlined and mitigations leveraging existing digital acquisition methods are suggested. S.M. S.M. 2022-01-14T14:48:10Z 2022-01-14T14:48:10Z 2021-06 2021-06-11T14:54:00.884Z Thesis https://hdl.handle.net/1721.1/139071 In Copyright - Educational Use Permitted Copyright retained by author(s) https://rightsstatements.org/page/InC-EDU/1.0/ application/pdf Massachusetts Institute of Technology |
| spellingShingle | Ramseyer, Ryan William Automated Rehosting and Instrumentation of Embedded Firmware |
| title | Automated Rehosting and Instrumentation of Embedded Firmware |
| title_full | Automated Rehosting and Instrumentation of Embedded Firmware |
| title_fullStr | Automated Rehosting and Instrumentation of Embedded Firmware |
| title_full_unstemmed | Automated Rehosting and Instrumentation of Embedded Firmware |
| title_short | Automated Rehosting and Instrumentation of Embedded Firmware |
| title_sort | automated rehosting and instrumentation of embedded firmware |
| url | https://hdl.handle.net/1721.1/139071 |
| work_keys_str_mv | AT ramseyerryanwilliam automatedrehostingandinstrumentationofembeddedfirmware |