一句话：设计 FirmSec 检测固件中的第三方组件及其漏洞，并对 3.4 万余个固件镜像开展大规模安全实证分析。
IoT 固件开发高度依赖第三方组件（TPC），但 TPC 自身漏洞会反过来威胁固件安全，现有工作对此关注不足，缺乏对 TPC 漏洞安全影响的全面认识。为此，作者设计并实现 FirmSec，利用语法特征与控制流图特征在版本级检测固件中的 TPC，并识别其对应漏洞。基于 FirmSec，论文首次对固件中 TPC 的使用及其漏洞进行大规模分析，覆盖 34,136 个固件镜像（11,086 个公开镜像和 23,050 个来自 TSmart 的私有镜像），成功检测 584 个 TPC，识别出由 429 个 CVE 导致的 128,757 个漏洞。分析揭示了不同厂商固件的安全差异、知名漏洞仍广泛存在、TPC 平均落后五年、部分地区设备风险更高，以及 2,478 个商业固件可能违反 GPL/AGPL 许可条款。
As the core of IoT devices, firmware is undoubtedly vital. Currently, the development of IoT firmware heavily depends on third-party components (TPCs), which significantly improves the development efficiency and reduces the cost. Nevertheless, TPCs are not secure, and the vulnerabilities in TPCs will turn back influence the security of IoT firmware. Currently, existing works pay less attention to the vulnerabilities caused by TPCs, and we still lack a comprehensive understanding of the security impact of TPC vulnerability against firmware. To fill in the knowledge gap, we design and implement FirmSec, which leverages syntactical features and control-flow graph features to detect the TPCs at version-level in firmware, and then recognizes the corresponding vulnerabilities. Based on FirmSec, we present the first large-scale analysis of the usage of TPCs and the corresponding vulnerabilities in firmware. More specifically, we perform an analysis on 34,136 firmware images, including 11,086 publicly accessible firmware images, and 23,050 private firmware images from TSmart. We successfully detect 584 TPCs and identify 128,757 vulnerabilities caused by 429 CVEs. Our in-depth analysis reveals the diversity of security issues for different kinds of firmware from various vendors, and discovers some well-known vulnerabilities are still deeply rooted in many firmware images. We also find that the TPCs used in firmware have fallen behind by five years on average. Besides, we explore the geographical distribution of vulnerable devices, and confirm the security situation of devices in several regions, e.g., South Korea and China, is more severe than in other regions. Further analysis shows 2,478 commercial firmware images have potentially violated GPL/AGPL licensing terms.
@inproceedings{paperbot7405,
title = {A large-scale empirical analysis of the vulnerabilities introduced by third-party components in IoT firmware},
author = {Binbin Zhao and Shouling Ji and Jiacheng Xu and Yuan Tian and Qiuyang Wei and Qinying Wang and Chenyang Lyu and Xuhong Zhang and Changting Lin and Jingzheng Wu and Raheem Beyah},
booktitle = {ISSTA},
year = {2022},
doi = {10.1145/3533767.3534366}
}