Automated Dynamic Fireware Analysis At Scale: A Case Study on Embedded Web Interfaces
summary
A fully automated framework performs large-scale dynamic firmware analysis by unpacking images, preparing filesystems, and running them under QEMU with chroot or a hosted document-root approach; it combines static scanning (RIPS for PHP) and dynamic web fuzzing (Arachni, ZAP, w3af, Nessus) plus network probes. Validated on 1,925 firmware images from 54 vendors, it finds high-impact XSS, CSRF and command-injection bugs in 185 images (≈225 findings), demonstrates live exploits (e.g. leaking /etc/passwd), and shows 61.3% emulation and 25.2% web-launch failures are fixable.
AI-written summary · about
chapters (9)
- 0:00Start
- 14:19File System Preparation
- 16:48Dynamic Analysis
- 22:31Generic System Emulator
- 23:49Architectural Chroot
- 36:14Data Sets
- 41:22Failure Analysis
- 58:22Xss Test
- 1:05:18The Summary of the Results
related talks
45mFirmware.RE: Firmware Unpacking, Analysis and Vulnerability-Discovery as a Service
39mNight of the living vulnerabilities
33mIdentifying Multi-Binary Vulnerabilities in Embedded Firmware at Scale
45mFinding Vulnerabilities through Static Analysis and Scripting
45mAutomatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing
44mCome Join the CAFSA - Continuous Automated Firmware Security Analysis
28mFuzzing Malware for Fun & Profit
53mResearching New Attack Interfaces On iOS And OSX