Automatic Inference of Taint Sources to Discover Vulnerabilities in SOHO Router Firmware - Inria - Institut national de recherche en sciences et technologies du numérique
Conference Papers Year : 2021

Automatic Inference of Taint Sources to Discover Vulnerabilities in SOHO Router Firmware

Abstract

Cyberattacks against SOHO (small office and home office) routers have attracted much attention in recent years. Most of the vulnerabilities exploited by hackers occur in the web servers of router firmware. In vulnerabilities detection, static taint analysis can quickly cover all code without depending on the runtime environment compared to dynamic analysis (e.g., fuzzing). However, existing static analysis techniques suffer from a high false-negative rate due to the lack of resolution of indirect calls, making it challenging to track tainted data from a common source (e.g., recv) to a sink. In this work, we propose a new heuristic approach to address the challenge. Instead of resolving the indirect calls, we automatically infer taint sources through identifying functions with key-value features. We can bypass the indirect calls with the inferred taint sources and track the taint to detect vulnerabilities by static taint analysis. We implement a prototype system and evaluate it on 10 popular routers across 5 vendors. The proposed system discovered 245 vulnerabilities, including 41 1-day vulnerabilities and 204 vulnerabilities never exposed before. The experimental results show that our system can find more bugs compared to a state-of-the-art fuzzing tool.
Fichier principal
Vignette du fichier
512098_1_En_6_Chapter.pdf (619.73 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-03746053 , version 1 (04-08-2022)

Licence

Identifiers

Cite

Kai Cheng, Dongliang Fang, Chuan Qin, Huizhao Wang, Yaowen Zheng, et al.. Automatic Inference of Taint Sources to Discover Vulnerabilities in SOHO Router Firmware. 36th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2021, Oslo, Norway. pp.83-99, ⟨10.1007/978-3-030-78120-0_6⟩. ⟨hal-03746053⟩
65 View
72 Download

Altmetric

Share

More