System and method for analyzing contamination paths to analyze vulnerabilities in IoT devices
AssigneeZien, Inc.
InventorYoung Min Cho
Life of this patent
Estimating the term…
Abstract
Provided are a method and a system for analyzing a vulnerability in software installed on an Internet of things (IoT) device. In the vulnerability analysis method and the device, a target binary file extracted from firmware of the IoT device is acquired, a taint path is generated by performing taint analysis on the target binary file, transmission information related to the taint path is generated, and a vulnerability is detected in the target binary file by performing symbolic execution on the target binary file on the basis of the taint path and the transmission information.
Claims13
A method of analyzing a vulnerability in software installed on an Internet of things (IoT) device, which is performed by a vulnerability analysis device, the method comprising:
- acquiring a target binary file extracted from firmware of an IoT device;
- generating a taint path by performing taint analysis on the target binary file, and
- generating transmission information related to the taint path;
- and
- detecting a vulnerability in the target binary file by performing symbolic execution on the target binary file on the basis of the taint path and the transmission information,
- wherein the taint path includes a user function, including a user input function that is an internal function of the software or a user library function based on an external library of the software, and
- wherein the generating of the taint path and the generating of the transmission information related to the taint path comprise:
- specifying a taint sink in the target binary file;
- generating a tracking graph by tracking a parameter from the taint sink;
- determining whether a user function is in the tracking graph and designating the user function as a taint source corresponding to the taint sink;
- generating a taint path for the target binary file including the taint sink and the taint source;
- and
- generating transmission information of the taint path, and
- wherein the determining of whether a user function is in the tracking graph and designating of the user function as a taint source corresponding to the taint sink comprise:
- designating the user function as the taint source corresponding to the taint sink on the basis of a call function for calling the taint sink and the tracking graph by comparing all call instructions in a function for calling the taint sink with call instructions in the tracking graph;
- and
- specifying the taint source corresponding to the taint sink on the basis of a comparison result of the call instructions.
A vulnerability analysis device for analyzing a vulnerability in software installed on an Internet of things (IoT) device, the vulnerability analysis device comprising:
- a communication unit configured to acquire a target binary file extracted from firmware of the IoT device;
- a taint analysis unit configured to generate a taint path by performing taint analysis on the target binary file and generate transmission information related to the taint path;
- and
- a vulnerability analysis unit configured to detect a vulnerability in the target binary file by performing symbolic execution on the target binary file on the basis of the taint path and the transmission information,
- wherein, to generate the taint path and the transmission information related to the taint path, the taint analysis unit specifies a taint sink in the target binary file, generates a tracking graph by tracking a parameter from the taint sink, determines whether a user function is in the tracking graph and specifies the user function as a taint source corresponding to the taint sink, generates a taint path for the target binary file including the taint sink and the taint source, and generates transmission information of the taint path, and
- to determine whether a user function is in the tracking graph and designate the user function as a taint source corresponding to the taint sink, the taint analysis unit designates the user function as the taint source corresponding to the taint sink on the basis of a call function for calling the taint sink and the tracking graph by comparing all call instructions in a function for calling the taint sink with call instructions in the tracking graph and specifying the taint source corresponding to the taint sink on the basis of a comparison result of the call instructions.
Dependencies are inferred from the claim text.