KR101972825B1 - Method and apparatus for automatically analyzing vulnerable point of embedded appliance by using hybrid analysis technology, and computer program for executing the method - Google Patents

Abstract

The present invention relates to a method and a device for automatically analyzing vulnerabilities of an embedded device using a hybrid analysis technology, and to a computer program for executing the method, and more particularly to a method for searching for vulnerabilities without an actual embedded device with respect to a firmware of the embedded device using static and dynamic analysis processes. According to the present invention, a system for detecting and preventing vulnerabilities of embedded devices in advance through automated vulnerability analysis is provided in order to solve a security problem of the embedded devices. Also, a new system capable of efficient analysis for a plurality of objects by analyzing the same only with a firmware of a corresponding embedded device without an actual embedded device in order to analyze embedded devices variously present in accordance with types, manufacturers, models, etc., is provided.

Description

[0001] The present invention relates to a method and an apparatus for automatically analyzing an embedded device vulnerability using hybrid analysis technology, and a computer program for executing the method,

The present invention relates to a method and an apparatus for automatically analyzing vulnerabilities of an embedded device using a hybrid analysis technique and a computer program for executing the method. More particularly, the present invention relates to an embedded device A device, and a computer program for finding a vulnerability without an embedded device.

Many embedded devices such as wired / wireless routers, IP cameras, network printers, and various IoT devices are used in real life, and security issues are increasingly attracted to users' personal information. In particular, security of embedded devices is becoming more important due to security problems such as Mirai Botnet using embedded device vulnerability. However, the development of a system that automatically analyzes firmware vulnerabilities of various embedded devices such as Mirai Botnet is a small situation There was a problem.

KR 10-2006-0062882 A

It is an object of the present invention to provide a system for preventing a vulnerability of an embedded device from being detected in advance through an automated vulnerability analysis in order to solve the security problem of an embedded device.

Also, in order to analyze embedded devices that exist in various types, manufacturers, models, etc., a new system capable of analyzing a plurality of objects by analyzing only the firmware of the embedded device without actual embedded devices is provided There is a purpose.

In order to achieve the above object, there is provided a method for automatically analyzing an embedded device vulnerability according to the present invention, comprising the steps of: (a) performing a vulnerability analysis on a firmware code of an embedded device to be analyzed by static analysis; (b) generating, as a result of the static analysis, a vulnerability test code; (c) performing the vulnerability analysis by performing dynamic analysis on the firmware after emulating the firmware; And (d) generating log data of a dynamic analysis for the firmware, wherein prior to the analysis of the vulnerability by the static analysis of step (a), based on the log data input from the dynamic analysis process, A part of the analysis target program (firmware code) is set as an environment suitable for the log data, and the vulnerability analysis is performed by the static analysis of step (a) for the firmware code set as described above.

In the step (a), the vulnerability analysis by the static analysis can be performed by a symbolic execution method.

(A1) extracting a binary file from the embedded device firmware before performing the vulnerability analysis by the symbol execution method; And (a2) disassembling the extracted binary file to convert the extracted binary file into an assembly code. The symbol execution may be performed on the assembly code of the firmware can do.

The vulnerability analysis by the static analysis may include verification of the possibility of buffer overflow.

The vulnerability analysis by the static analysis may include a verification as to whether a command injection attack is possible with respect to the firmware.

The vulnerability analysis by the static analysis may include verification of whether or not an SQL injection attack is possible for the firmware.

The vulnerability analysis by the static analysis may include a verification as to whether a cross-site scripting (XSS) attack is possible for the firmware.

The vulnerability test code of the step (b) may generate an input value capable of causing the vulnerability analyzed in the step (a) to the firmware code to be analyzed, using the symbol execution.

The vulnerability analysis by the dynamic analysis of the step (c) can be performed by executing the vulnerability test code generated in the step (b).

The vulnerability analysis by the dynamic analysis of step (c) can be performed using a fuzzer.

The fuzzy analysis using the fuzzer may be performed using various values that may cause one or more of buffer overflow, command injection, SQL injection, and cross-site scripting It can be repeated until the vulnerability is determined through the output result or the collected log.

The log data of the dynamic analysis generated in the step (d) may be transmitted to the vulnerability analysis process by the static analysis in the step (a).

According to another aspect of the present invention, an apparatus for automatically analyzing an embedded device vulnerability includes at least one processor; And at least one memory for storing computer-executable instructions, wherein the computer-executable instructions stored in the at least one memory are executable by the at least one processor to: (a) generate a firmware code performing vulnerability analysis on the code by static analysis; (b) generating, as a result of the static analysis, a vulnerability test code; (c) performing the vulnerability analysis by performing dynamic analysis on the firmware after emulating the firmware; (D) generating log data of the dynamic analysis for the firmware is executed, and before the vulnerability analysis by the static analysis in the step (a), the log data inputted from the dynamic analysis process is used as a basis , A part of the analysis target program (firmware code) is set to an environment suitable for the log data, and the vulnerability analysis is performed by the static analysis of step (a) for the firmware code thus set.

According to another aspect of the present invention, a computer program for automatically analyzing an embedded device vulnerability is stored in a non-volatile storage medium, the program being executed by a processor to: (a) determine a firmware code of an embedded device, Performing vulnerability analysis by static analysis; (b) generating, as a result of the static analysis, a vulnerability test code; (c) performing the vulnerability analysis by performing dynamic analysis on the firmware after emulating the firmware; And (d) generating log data of a dynamic analysis for the firmware to be executed, wherein before the vulnerability analysis by the static analysis of step (a) A part of the analysis target program (firmware code) is set as an environment suitable for the log data based on the log data, and a command for performing the vulnerability analysis by the static analysis in the step (a) .

According to the present invention, a system for preventing a vulnerability of embedded devices from being detected in advance through automated vulnerability analysis is provided in order to solve the security problem of embedded devices, and a system for preventing embedded systems, In order to analyze the devices, there is an effect of providing a new system capable of analyzing a plurality of objects efficiently by making it possible to analyze only the firmware of the embedded device without an actual embedded device.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a diagram showing an overall process of an automatic analysis method of an embedded device vulnerability using a hybrid analysis technique according to the present invention. FIG.
2 is a diagram illustrating a static analysis process in an automatic method for analyzing an embedded device vulnerability using a hybrid analysis technique according to the present invention.
3 is a diagram illustrating a dynamic analysis process in an automatic method for analyzing vulnerabilities of an embedded device using a hybrid analysis technique according to the present invention.
4 is a diagram illustrating a configuration of an apparatus for automatically analyzing vulnerabilities of an embedded device using a hybrid analysis technique according to the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, terms and words used in the present specification and claims should not be construed as limited to ordinary or dictionary terms, and the inventor should appropriately interpret the concepts of the terms appropriately It should be interpreted in accordance with the meaning and concept consistent with the technical idea of the present invention based on the principle that it can be defined. Therefore, the embodiments described in this specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention and do not represent all the technical ideas of the present invention. Therefore, It is to be understood that equivalents and modifications are possible.

1 is a diagram illustrating an overall process of an automatic method for analyzing an embedded device vulnerability using a hybrid analysis technique according to the present invention.

First, the system receives firmware of various embedded devices (S100). Basically, it is targeted at embedded devices based on Linux OS, and architecture can analyze various architectures such as ARM and MIPS. Firmware must contain the file system for analysis and not be encrypted. Embedded device makers can process their firmware in a suitable form. For other analysis, firmware update files provided by embedded device manufacturers can be collected and analyzed on a website or an FTP server.

Various methods can be applied to analyze the structure of the firmware. In addition to the general compression type firmware, it can be implemented as a separate module type so as to have a function of extracting only a desired portion of the firmware in case that each manufacturer or device has a specific format.

The analysis process includes two types of analysis processes. That is, the static analysis process and the dynamic analysis process.

The static analysis process executes a static analysis, that is, an analysis on the program code itself of the firmware (S200). Symbolic execution techniques are used to analyze the program's detailed execution flow to detect various types of vulnerabilities such as buffer overflow, command injection, SQL injection, and XSS. If there is a part judged to be a vulnerability, a test code for dynamically testing the part is generated (S210), and the dynamic code is provided to the dynamic analysis process (S220).

The dynamic analysis process performs dynamic analysis, i.e., analysis while actually operating the firmware (S300). Through emulation of the file system extracted from the firmware, internal programs are executed as if they are executed in real equipment, fuzzing is used to find the vulnerability, or the test code generated from the static analysis is executed to verify the vulnerability. In the dynamic analysis, the vulnerability is verified based on the monitoring. Finally, the analysis log is generated (S310). Although the exact vulnerability is not found in the analysis log, The corresponding information is provided (S320), and the static analysis process is performed so as to generate an accurate test code.

As a result of the final vulnerability analysis, vulnerabilities are reported as vulnerabilities in the items of the dynamic analysis process, which do not need additional static analysis, because of the clear result of the vulnerability log.

Hereinafter, the static analysis process will be described in detail with reference to FIG. 2, and the dynamic analysis process will be described in detail with reference to FIG.

2 is a diagram illustrating a static analysis process in an automatic method for analyzing an embedded device vulnerability using a hybrid analysis technique according to the present invention.

The static analysis process analyzes the program code itself of the input embedded device firmware and extracts the binary files corresponding to the web server, the CGI service program, and other network services from the firmware, and performs the analysis. Common Gateway Interface (CGI) is an interface that enables a service program implemented separately from a web server that interprets HTTP (Hyper-Text Transfer Protocol) to operate.

First, the firmware of the embedded device to be analyzed is inputted (S220). In order to analyze the input firmware, binary files are basically extracted (S201) and converted into analytical assembly codes (S202). In addition, it is necessary to divide the functions into units of functions. A commercial analysis tool such as IDA Pro This process is performed using related open source libraries.

Vulnerability analysis is performed for each binary file using a symbolic execution method (S203). It can be implemented using a variety of symbol execution-based frameworks. Symbol execution is a method of analyzing a program, assuming that the value is a symbolic value, if an unknown value is used instead of a concrete value when the program is executed.

Vulnerability analysis using sign execution proceeds similar to the related previous researches. From the beginning to the end of the program, it runs in the signature execution engine to check whether the Vulnerability is in a state consistent with the pattern that could cause the vulnerability. A partial analysis is performed only on functions that are likely to cause a vulnerability or a portion of the program is set to an environment suitable for the log data based on log data input from the dynamic analysis process (S220) (S221) Back analysis may be performed (S203).

The pattern for the vulnerability check (S204) can be variously implemented.

For example, the buffer overflow vulnerability can be analyzed by analyzing the length of some library functions used for copying data, or analyzing whether the return address in the stack is altered during execution It can detect.

Command injection means to insert a command, which is a way to send a system command to a web request to execute it. If you run a system command from within the web, the hacker can manipulate this value to execute other system commands if you pass it as part of a system command without checking that the value you enter is correct. In the case of command injection, it is checked whether the strings that can be used in the command injection attack can be inputted through the data from the outside by reaching the system () function or the execve () It is possible.

SQL injection (also called SQL injection, SQL injection, or SQL injection) is a technique of code injection that can attack a server's database by manipulating client input values. SQL Injection is similar to command injection, and it is possible to check whether injection can occur in a SQL query related function.

Cross-site scripting (XSS) is one of the most basic vulnerability attack methods on the Web, along with SQL injection, which is a technique for malicious users to inject scripts into sites they wish to attack. If the attack is successful, users who access the site will execute the embedded code, usually perform unintended actions, or steal sensitive information such as cookies or session tokens. In the case of XSS, it is possible to check whether or not the special characters usable in XSS are processed with respect to the portion where the input data is directly outputted.

The detected vulnerabilities may be false positives due to errors occurred in the symbolic execution process of the static analysis process or may be vulnerabilities that are not used in the actual execution process. Therefore, the vulnerability test code is generated so that the vulnerability can be verified rather than reporting the vulnerability directly (S210). The vulnerability test code is generated by using symbol execution that can cause the vulnerability to be analyzed. The vulnerability test code is generated by simple code with the input value part added to the basic template code for communication with the target service such as the web server.

3 is a diagram illustrating a dynamic analysis process in an automatic method for analyzing vulnerabilities of an embedded device using a hybrid analysis technique according to the present invention.

In the dynamic analysis process, the file system part is extracted from the input device firmware (S100) (S301), and a separate kernel is created in the firmware emulation system based on the QEMU and the file system is created in advance, Environment is established (S302). In this environment, there is no hardware part of the embedded device. However, web server, network service, etc., which are exposed as the main attack target, are executed in the emulated environment and operate as actual equipment.

After the embedded device firmware is emulated (S302), dynamic analysis is performed. A log of various abnormal information, flow of program execution, and information collected in the dynamic analysis process is logged, And prints the results as logs that appear to be vulnerable or relevant.

The dynamic analysis process receives the vulnerability test code generated in the static analysis process (S220), executes the verification (S303), or proceeds using the fuzzer (S304). A fuzzer is a technique that inserts a random or sequential value into various fields of an application to ensure that it is safe from unknown application vulnerabilities (eg, buffer overflows, parameter format checks, error handling, user input value checks, Refers to a tool used to determine difficult information (such as OS version, application server version, database information, even private IP, etc.).

In S304, the buffer overflow, command injection, SQL injection, and cross-site scripting (XSS) are applied to the part where data of the web interface can be input. It repeatedly tries to input various values that can be triggered, and it repeats until it is judged as a vulnerability through output result or collected log.

In the case of the vulnerability determination method (S305), it can be implemented in various ways according to the vulnerability. For example, when a buffer overflow occurs, a crash that abnormally terminates in a program is mostly generated, In the case of injection, if a log of the system call related to program execution is left in the kernel, it is possible to judge whether or not the command which has attempted command injection has been normally transmitted and executed. In the case of XSS, it is possible to check whether the XSS script entered in the output from the server is included. In this manner, log data for the vulnerability is generated (S310).

In addition, although the vulnerability is not directly judged in the log, since the static analysis can be performed on the vulnerable portion, the information such as the binary information and the input value is provided to the static analysis process (S320). For example, there may be a case where the input value is passed to the system call related to the program execution, but it is slightly modulated or only a part of the input is passed through the log, and the filtering may be performed.

FIG. 4 is a diagram illustrating a configuration of an apparatus for automatically analyzing vulnerabilities of an embedded device 200 using a hybrid analysis technique according to the present invention.

The embedded device vulnerability automatic analyzing apparatus 200 may be, for example, a portable computer apparatus such as a notebook or a desktop computer. However, it is not necessarily limited thereto, and in some cases, it may be a mobile device such as a tablet device.

The embedded device automatic vulnerability analysis apparatus 200 includes a processor 210, a nonvolatile storage unit 220 for storing programs and data, a volatile memory 230 for storing executing programs, a communication unit (240), a bus serving as an internal communication path between these devices, and the like.

The running program may be a device driver, an operating system, and various applications (not shown). Also, the embedded device firmware to be analyzed may be running. As shown in the figure, the embedded device firmware 400 may be directly connected to the embedded device 10 and downloaded to the embedded device vulnerability automatic analyzer 200. However, the embedded device firmware 400 may be downloaded from another device 10 storing the firmware, And may be downloaded to the apparatus automatic vulnerability analysis apparatus 200. In addition, the firmware to be analyzed may be downloaded to the embedded device vulnerability automatic analyzer 200 for analysis, but may be downloaded and executed in a separate firmware emulation system (not shown), and then communicated to the embedded device vulnerability automatic analyzer 200 The analysis can also be performed by connecting.

The embedded device firmware 400 is subject to analysis in a static analysis process S200 for code self analysis or a dynamic analysis process S300 for analysis in execution state. In the dynamic analysis process, the embedded device vulnerability automatic analysis device 200 may be operated together with the embedded device vulnerability automatic analysis application (program) 300.

Although not shown, the embedded device vulnerability automatic analyzing apparatus 200 includes a power providing unit.

The embedded device vulnerability automatic analysis application (program) 300 is installed in the embedded device automatic vulnerability analyzer 200 and executes the vulnerability analysis process for the firmware of the embedded device. 3, it will be briefly described below.

That is, the embedded device vulnerability automatic analyzer 200 receives the firmware of various embedded devices and analyzes the vulnerability of the corresponding firmware through the static analysis process and the dynamic analysis process.

The static analysis process executes the static analysis, that is, the analysis of the program code itself of the firmware, and the dynamic analysis process executes the dynamic analysis, that is, the analysis while the firmware is actually operated in the embedded device vulnerability automatic analyzing apparatus 200 .

The static analysis process analyzes the detailed execution flow of the program using symbolic execution technology to detect various kinds of vulnerabilities such as buffer overflow, command injection, SQL injection, and XSS . If there is a part judged to be a vulnerability, a test code for dynamically testing the part is generated (S210), and the test code is provided to the dynamic analysis process.

The dynamic analysis process emulates the file system extracted from the firmware and executes the internal programs as if it is executed on the actual equipment. It uses fuzzing to find the vulnerability, or executes the test code generated from the static analysis to verify the vulnerability do. In the dynamic analysis, the vulnerability is verified based on the monitoring of the firmware operating through the emulation. Finally, an analysis log is generated, and although an exact vulnerability is not found in the analysis log, For the larger part, the information is provided to the static analysis process so that the static analysis process can generate the correct test code and proceed with the verification. The final vulnerability analysis result shows that the vulnerability logs show the clear results of the vulnerability logs generated by the dynamic analysis process and do not require additional static analysis.

100: Embedded device / firmware storage device
200: Embedded device vulnerability automatic analyzer
300: Embedded device vulnerability automatic analysis application (program)
400: Embedded device firmware

Claims (15)

As an automatic analysis method of embedded device vulnerability,
(a) performing a vulnerability analysis on a firmware code of an embedded device to be analyzed by static analysis;
(b) generating, as a result of the static analysis, a vulnerability test code;
(c) performing the vulnerability analysis by performing dynamic analysis on the firmware after emulating the firmware; And
(d) generating log data of dynamic analysis for the firmware
Lt; / RTI >
A part of the analysis target program (firmware code) is set as an environment suitable for the log data based on the log data input from the dynamic analysis process before the vulnerability analysis by the static analysis in the step (a) And performing a vulnerability analysis by the static analysis of the step (a)
Automated method for analyzing embedded device vulnerability. The method according to claim 1,
The vulnerability analysis according to the static analysis in the step (a)
Symbolic execution.
The method comprising the steps of: The method of claim 2,
Before performing the vulnerability analysis by the symbol execution method,
(a1) extracting a binary file from the embedded device firmware; And
(a2) disassembling the extracted binary file to convert the extracted binary file into an assembly code
Further comprising:
The symbol execution may be performed on the assembly code of the firmware
The method comprising the steps of: The method according to claim 1,
The vulnerability analysis by the static analysis,
Including verification of the possibility of buffer overflow
The method comprising the steps of: The method according to claim 1,
The vulnerability analysis by the static analysis,
Including verification of whether a command injection attack is possible with respect to the firmware
The method comprising the steps of: The method according to claim 1,
The vulnerability analysis by the static analysis,
Including verification of whether or not an SQL injection attack is possible for the firmware
The method comprising the steps of: The method according to claim 1,
The vulnerability analysis by the static analysis,
Including verification of whether a cross-site scripting (XSS) attack is possible against the firmware
The method comprising the steps of: The method according to claim 1,
The vulnerability test code of step (b)
(I) an input value capable of causing the vulnerability analyzed in the step (a) to be generated in the firmware code to be analyzed by using symbol execution
The method comprising the steps of: delete The method according to claim 1,
The vulnerability analysis by the dynamic analysis of the step (c)
Executing by executing the vulnerability test code generated in the step (b)
The method comprising the steps of: The method according to claim 1,
The vulnerability analysis by the dynamic analysis of the step (c)
Performing with a fuzzer
The method comprising the steps of: The method of claim 11,
In the vulnerability analysis using the fuzzer,
It is repeated to input various values that may cause at least one of buffer overflow, command injection, SQL injection, and cross-site scripting (XSS) Repeat until the vulnerability is determined through the collected logs
The method comprising the steps of: The method of claim 11,
The log data of the dynamic analysis generated in the step (d)
To the vulnerability analysis process by the static analysis of step (a)
The method comprising the steps of: An apparatus for automatically analyzing an embedded device vulnerability,
At least one processor; And
At least one memory for storing computer executable instructions,
The computer-executable instructions stored in the at least one memory may be, by the at least one processor,
(a) performing a vulnerability analysis on a firmware code of an embedded device to be analyzed by static analysis;
(b) generating, as a result of the static analysis, a vulnerability test code;
(c) performing the vulnerability analysis by performing dynamic analysis on the firmware after emulating the firmware; And
(d) generating log data of dynamic analysis for the firmware
Lt; / RTI >
A part of the analysis target program (firmware code) is set as an environment suitable for the log data based on the log data input from the dynamic analysis process before the vulnerability analysis by the static analysis in the step (a) And performing a vulnerability analysis by the static analysis of step (a)
A device for automatically analyzing embedded device vulnerabilities. A computer program for automatically analyzing an embedded device vulnerability,
Stored in a non-volatile storage medium,
(a) performing a vulnerability analysis on a firmware code of an embedded device to be analyzed by static analysis;
(b) generating, as a result of the static analysis, a vulnerability test code;
(c) performing the vulnerability analysis by performing dynamic analysis on the firmware after emulating the firmware; And
(d) generating log data of dynamic analysis for the firmware
To be executed,
A part of the analysis target program (firmware code) is set as an environment suitable for the log data based on the log data input from the dynamic analysis process before the vulnerability analysis by the static analysis in the step (a) And performing an analysis of the vulnerability according to the static analysis of step (a)
A computer program for automatically analyzing embedded device vulnerabilities.

Images