UC Davis

Embedded systems serve as foundational components of the technologies that pervade modern life. Given that an embedded system's behavior is in turn defined by the firmware that resides in the system's memory, it follows that bugs and vulnerabilities found in device firmware can become critical threats that have cascading consequences at individual and potentially national levels. Despite this reality, firmware security for many embedded and cyber-physical systems consistently remains unaddressed, making firmware bugs are all too common in the real world. Worse, many of these bugs can be difficult to isolate and diagnose due to firmware programs’ tight coupling with hardware and temporal nature, necessitating more thorough, sophisticated analysis techniques. There are significant technical and practical barriers that prevent widespread adoption of advanced firmware security testing. From a technical perspective, developing dynamic analysis techniques continues to be challenging due to the fundamental issues of modeling hardware dependence for a variety of hardware platforms, and the difficulty of reverse engineering from monolithic binaries. From a practical perspective, the adoption of advanced tools and techniques is unrealistic for the typical firmware developer due to the steep learning curve, high implementation overheads, and poor scalability of most existing tools. Considering both these perspectives, there is a clear need for new, powerful tools that are capable of sophisticated dynamic analysis, while remaining scalable, understandable, and straightforward to use. With this in mind, we believe that investigating dynamic tools for CFG recovery, lifting to intermediate representations, and information flow tracking, all which provide immediate value in conjunction with traditional static analyses, is a worthwhile endeavor, as such techniques can help provide greater insight into the firmware disassembly than fuzzing and re-hosting alone. We explore dynamic binary analysis techniques for the security assessment and reverse engineering of bare-metal firmware binaries. We examine the role of reverse engineering in attack scenarios and tackle some of the challenges presented by control flow graph recovery for bare-metal firmware binaries in particular. We propose a practical vulnerability detection technique that combines dynamic information flow tracking and fuzz testing to surface taint-style vulnerabilities in firmware binaries by treating taint violations as crash conditions. We implement a prototype taint-triggered firmware fuzzing framework as a proof-of-concept for our technique by implementing a dynamic taint-tracking emulator in Rust and integrating it with the LibAFL fuzzing framework.