running project Semantics, Cybersecurity & Services (SCS)
Automating patching for embedded firmware images
Funded by: Ministry of Economic Affairs and Climate Policy (Dutch: Ministerie van Economische Zaken en Klimaat; EZK)
Period: Apr, 2023 - Mar, 2027
Contact:
Partners: TNO
Description:
Other than to enable unprecedented utility for consumers, smart embedded devices are nowadays widely adopted in critical infrastructures (e.g., industrial robots, medical devices) and drive a wide range of systems and applications that are crucial for our society, such as medical devices, military systems, and industrial control systems. This enticing set of targets has not gone unnoticed by attackers, which exploited security vulnerabilities located in embedded firmware to, for instance, create botnets, which pose a severe threat to the Internet and our society. This problem is further amplified by the fact that we have seen an increase in the number of devices that have been abandoned or reached the end of their support periods, not receiving security updates. On the defense side, while, in the past years, the security community introduced novel and effective techniques to automate security analysis of traditional (e.g., Desktop) applications, existing methodologies and tools are mostly ineffective when applied to firmware images. In fact, firmware lives in unique, minimal environments with non-standard configurations. In this project, we research novel automated techniques to analyze firmware. In particular, we tailor our techniques to enable third-party patching of deployed and legacy embedded systems, where the source code is not available. To this end, binary firmware images are modified to mitigate a design or implementation flaw. By removing vulnerabilities in critical systems, this project will secure embedded devices and prevent cyberattacks.