一句话：提出 uTrimmer，对 MIPS 固件共享库做静态二进制去臃肿，在不增开销下删除未用代码以缓解代码复用攻击。
嵌入式系统常遭代码复用攻击，攻击者可从大型共享库（如 uClibc）中提取 gadget，而资源受限设备难以部署常规安全加固。软件去臃肿通过删除未用代码减少可复用 gadget，但对 stripped 二进制共享库（如 MIPS 固件）做静态去臃肿仍很困难。本文提出 uTrimmer，识别并清除共享库二进制中未用的基本块，且不引入额外运行时开销或内存消耗。它识别取地址块/函数，构建保守的过程间控制流图以保留可能被固件使用的代码，并利用位置无关代码的地址访问模式规避代码指针目标判定难题。在 SPEC CPU2017、Apache/BusyBox/OpenSSL 及真实无线路由器固件上的实验表明，去臃肿后程序功能保持，暴露代码面与可复用 gadget 显著减少，效果可与静态链接结果相当。
Embedded systems have become prominent targets for cyberattacks. To exploit firmware’s memory corruption vulnerabilities, cybercriminals harvest reusable code gadgets from the large shared library codebase (e.g., uClibc). Unfortunately, unlike their desktop counterparts, embedded systems lack essential computing resources to enforce security hardening techniques. Recently, we have witnessed a surge of software debloating as a new defense mechanism against code-reuse attacks; it erases unused code to significantly diminish the possibilities of constructing reusable gadgets. Because of the single firmware image update style, static library debloating shows promise to fortify embedded systems without compromising performance and forward compatibility. However, static library debloating on stripped binaries (e.g., firmware’s shared libraries) is still an enormous challenge. In this paper, we show that this challenge is not insurmountable for MIPS firmware. We develop a novel system, named uTrimmer, to identify and wipe out unused basic blocks from shared libraries’ binary code, without causing additional runtime overhead or memory consumption. We propose a new method to identify address-taken blocks/functions, which further help us maintain an inter-procedural control flow graph to conservatively include library code that could be potentially used by firmware. By capturing address access patterns for position-independent code, we circumvent the challenge of determining code-pointer targets and safely eliminate unused code. We run uTrimmer to debloat shared libraries for SPEC CPU2017 benchmarks, popular firmware applications (e.g., Apache, BusyBox, and OpenSSL), and a real-world wireless router firmware image. Our experiments show that not only does uTrimmer deliver functional programs, but also it can cut the exposed code surface and eliminate various reusable code gadgets remarkably. uTrimmer’s debloating capability can compete with the static linking results.
@inproceedings{ZhangR0M22,
title = {One size does not fit all: security hardening of MIPS embedded systems via static binary debloating for shared libraries},
author = {Haotian Zhang and Mengfei Ren and Yu Lei and Jiang Ming},
booktitle = {ASPLOS},
year = {2022},
doi = {10.1145/3503222.3507768}
}