PC Advisor

News: Analysis
Many routers, modems, and other devices
ship without adequate security tests
A large scale security test of firmware images for embedded devices found thousands of vulnerabilities.
Lucian Constantin reports
A
n analysis of hundreds of publicly
available firmware images for
routers, DSL modems, VoIP phones,
IP cameras and other embedded devices
uncovered high-risk vulnerabilities in a
significant number of them, pointing to poor
security testing by manufacturers.
The study was performed by researchers
from the Eurecom research centre in France
and Ruhr University in Bochum, Germany,
who built an automated platform capable of
unpacking firmware images, running them
in an emulated environment and starting
the embedded web servers that host their
management interfaces.
The researchers started out with a
collection of 1,925 Linux-based firmware
images for embedded devices from 54
manufacturers, but they only managed to
start the web server on 246 of them. They
believe that with additional work and tweaks
to their platform that number could increase.
The goal was to perform dynamic
vulnerability analysis on the firmware
packages’ web-based management interfaces
using open-source penetration testing
tools. This resulted in 225 high-impact
vulnerabilities being found in 46 of the
tested firmware images.
A separate test involved extracting
the web interface code and hosting it on
a generic server, so it could be tested
for flaws without emulating the actual
firmware environment. This test had
drawbacks, but was successful for 515
firmware packages and resulted in security
flaws being found in 307 of them.
The researchers also performed a static
analysis with another open-source tool
against PHP code extracted from device
firmware images, resulting in another
9046 vulnerabilities being found in 145
firmware images.
In total, using both static and dynamic
analysis the researchers found important
vulnerabilities like command execution,
SQL injection and cross-site scripting in the
web-based management interfaces of 185
unique firmware packages, affecting devices
from a quarter of the 54 manufacturers.
The researchers focused their efforts
on developing a reliable method for
automated testing of firmware packages
without having access to the corresponding
physical devices, rather than on the
thoroughness of the vulnerability scanning
itself. They didn't perform manual code
reviews, use a large variety of scanning tools
or test for advanced logic flaws.
This means that the issues they found
were really the low-hanging fruit – the flaws
that should have been easy to find during
any standard security testing. This begs the
question: why weren’t they discovered and
patched by the manufacturers themselves?
It would appear that the affected vendors
either didn’t subject their code to security
testing at all, or if they did, the quality of the
testing was very poor, said Andrei Costin,
one of the researchers behind the study.
Team’s findings
Costin presented the team’s findings at
the recent DefCamp security conference
in Bucharest. It was actually the second
test performed on firmware images on
a larger scale. Last year, some of the
same researchers developed methods
to automatically find back doors and
encryption issues in a large number of
firmware packages.
Some of the firmware versions in their
latest data set were not the latest ones,
so not all of the discovered issues were
zero-day vulnerabilities – flaws that were
previously unknown and are unpatched.
However, their impact is still potentially
large, because most users rarely update
the firmware on their embedded devices.
At DefCamp, attendees were also invited
to try to hack four Internet of Things
(IoT) devices as part of the onsite IoT
Village. The contestants found two critical
vulnerabilities in a smart video-enabled
doorbell that could be exploited to gain full
control over the device. The doorbell also
had the option to control a smart door lock.
A high-end D-Link router was also
compromised through a vulnerability in the
firmware version that the manufacturer
shipped with the device. The flaw was
actually known and has been patched in
a newer firmware version, but the router
doesn’t alert users to update the firmware.
Finally, the participants also found a
lower-impact vulnerability in a router from
Mikrotik. The only device that survived
unscathed was a Nest Cam.
Details about the vulnerabilities have
not yet been shared publicly because the
IoT Village organisers, from Bitdefender,
intend to report them to the affected
vendors first, so they can be patched. J
18 www.pcadvisor.co.uk/news February 2016