SEFF: Scalable Embedded Firmware Fuzzing for Hardware Peripherals
Project ID:
P14_23
Email:
Co-Principal Investigator(s):
N/A
Principal Investigator:
Dr. Houman Homayoun
Topic Areas:
Microelectronics Research and Development
Abstract
The growth of Internet of Things (IoT) devices in various sectors has been substantial. Central to the IoT ecosystem are embedded devices, which comprise hardware and firmware. Firmware is the primary source of business logic, and any vulnerabilities present in it can have a direct or indirect effect on the entire system. Several factors have contributed to the absence of vulnerability detection and mitigation features in embedded devices. These include a lack of awareness of security concerns, the need for rapid time-to-market, resource limitations, and insufficient scalable and user-friendly automated tools for firmware testing. Consequently, the firmware in these devices is susceptible to attacks by malicious actors seeking to exploit these vulnerabilities. There exist several types of embedded firmware, which include Linux OS-based, monolithic firmware such as bare-metal, and RTOS-based firmware. The analysis of such firmware can be carried out using static and dynamic techniques. Although the study of Linux OS-based user space firmware has been considerably decent, analyzing monolithic firmware remains a challenging task. Various industries, such as automotive, aerospace, defense, and critical infrastructures, employ monolithic firmware-based embedded systems. The diverse range of custom implementations from various vendors makes the analysis of such systems a more complicated task. While fuzzing is a cutting-edge technique used to identify security vulnerabilities in software, implementing it from an embedded perspective poses significant challenges. This project aims to improve and streamline fuzzing techniques to perform the security assessment on hardware peripheral-based third-party SDKs/libraries (e.g. I2C, SPI) used in various embedded devices.