一句话：结合静态分析与大模型自动审计 IoT 伴侣应用，揭示固件更新中的泄露漏洞并获得 35 个 CVE。
IoT 设备普遍依赖伴侣应用进行管理，而其设备固件更新（DFU）流程往往缺乏充分校验，导致固件可被直接下载并泄露，攻击者可据此逆向设备设计。为解决该问题，作者提出自动化分析工具 FirmProj，系统评估 IoT 伴侣应用中的固件泄露风险。该工具将先进静态分析技术与大语言模型相结合，能够自动识别 DFU 模块、抽取固件文件并检测其中的安全漏洞。在对 10,047 个 IoT 伴侣应用的大规模实证研究中，FirmProj 成功获取 3,434 个固件文件，发现 DFU 实现中可导致固件泄露的严重缺陷，相关工作共获得 35 个 CVE 编号。研究结果表明，IoT 生态亟需强化固件保护机制。
The rapid growth of the Internet of Things (IoT) has led to the widespread use of companion apps for device management. However, these apps expose a critical vulnerability in the IoT ecosystem: insufficient verification procedures during device firmware updates (DFU), often resulting in firmware leakage. Once leaked, the firmware reveals sensitive design details, creating a straightforward path for attackers to reverse-engineer devices. To address this issue, we designed an automated analysis tool called FirmProj. It systematically evaluates firmware leakage risks by examining IoT companion apps. FirmProj combines advanced static analysis techniques with large language models to identify DFU modules, extract firmware files, and detect security vulnerabilities. In a large-scale study involving 10,047 IoT companion apps, FirmProj successfully retrieved 3,434 firmware files, uncovering severe flaws in DFU implementations that can lead to firmware leakage. These findings resulted in the assignment of 35 CVE IDs. Our results highlight the urgent need to strengthen firmware protection mechanisms throughout the IoT ecosystem.
DOI 原文 ·
@inproceedings{paperbot9224,
title = {FirmProj: Detecting Firmware Leakage in IoT Update Processes via Companion App Analysis},
author = {Wenzhi Li and Jialong Guo and Jiongyi Chen and Fan Li and Yujie Xing and Yanbo Xu and Shishuai Yang and Wenrui Diao},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00171}
}