Come Join the CAFSA - Continuous Automated Firmware Security Analysis
summary
A continuous automated firmware security analysis pipeline is built and open sourced: a firmware-analyzer that unpacks final firmware bundles, runs file system image checks (permissions, ownership, SELinux labels, known-bad binaries), extracts version and key material via data extraction, and compares file-tree snapshots to flag unexpected changes. It integrates into CI and acts as a pre-signing gate for production images, runs on Android and Linux-based devices, has caught numerous insecure builds in deployment, and is designed for automated reporting and audit.
AI-written summary · about
chapters (22)
- 0:00Start
- 18:01FwAnalyzer: Overview
- 18:50Global File Checks
- 19:30File Stat Check
- 21:17File Content: Examples
- 22:32Extract Data
- 23:14File Tree Check
- 23:57Script - Implement Custom Checks
- 24:40Checks and InformationalOnly
- 26:11Example: Android Firmware
- 26:40Android OTA Update
- 29:29Running it...
- 30:20Offenders
- 31:38Deploying FwAnalyzer
- 32:12FwAnalyzer during Development
- 35:15Production Checks
- 35:31FwAnalyzer Gating Production Signing
- 36:22Acceptance Testing Device manufactured by 3rd party supplier
- 38:35Vendor Security Assessment
- 40:05FwAnalyzer for Your Device: Config Files
- 40:37Rule Library
- 40:59Future Work
related talks
45mFirmware.RE: Firmware Unpacking, Analysis and Vulnerability-Discovery as a Service
01h 08mAutomated Dynamic Fireware Analysis At Scale: A Case Study on Embedded Web Interfaces
40mIs Your Code Secure?: Automatic Security Analysis Tools and Systems
09mSecurity-driven SDV in SOAFEE
33mIdentifying Multi-Binary Vulnerabilities in Embedded Firmware at Scale
52mBuilding Community-Driven Security Analysis for Your .NET Software Supply Chain
53mDemystify Intel Security Technologies in the Firmware
20mSoK: On the Effectiveness of Control-Flow Integrity in Practice