Identifying Multi-Binary Vulnerabilities in Embedded Firmware at Scale
summary
A static multi-binary taint analysis system named Caronte prototype unpacks firmware with binwalk, identifies border binaries via parsing scores, builds a binary dependency graph using CPF modules (socket, file, env), then propagates taint and constraints to find buffer overflows and DoS loops. It finds 46 new zero-days across 53 devices, scales to 899 firmwares, reduces alerts from ~36,000 to 74 (34 hours vs 18 days), and yields real CVEs and vendor patches.
AI-written summary · about
chapters (28)
- 0:00Introduction
- 0:27Why should we analyze firmware
- 0:53Common vulnerabilities
- 1:21Protection mechanisms
- 1:53Firmwares challenges
- 2:44Dynamic analysis
- 3:11Dynamic analysis limitations
- 3:34Static analysis
- 3:49Firmware is mostly multibinary
- 4:30Binary architecture
- 5:37Example
- 7:29Research Background
- 10:25Canon Architecture
- 10:39Firmware Packing
- 11:44Parsing Score
- 12:23Binary Dependency Graph
- 14:26Semantic CPF
- 16:08The Problem
- 17:43Insecure Interaction Detection
- 18:50Data Analysis
- 19:46Intention
- 21:11Team dependencies
- 22:48Evaluation
- 23:27Experiments
- 24:43Evaluation Results
- 24:56Evaluation Results Summary
- 26:23GitHub
- 31:32Conclusion
related talks
45mFirmware.RE: Firmware Unpacking, Analysis and Vulnerability-Discovery as a Service
01h 08mAutomated Dynamic Fireware Analysis At Scale: A Case Study on Embedded Web Interfaces
39mNight of the living vulnerabilities
51mFirmware Cartography: Charting the Course for Modern Server Compromise
32mEnhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis
29mFragile by Design: Large-Scale Evidence of Supply Chain Risk
36mUncovering Software Provenance in Embedded Systems
57mFinding, Managing, Preventing Vulnerabilities: An Automotive Perspective