The vulnerability of the Web service program in the firmware of Internet of Things(IoT)de-vices poses a serious threat to the devices.The back-end of the Web service program receives and pro-cesses input from the front-end,which is called a border binary program.To address the problem that the common vulnerability detection methods,such as taint analysis and symbol execution,lead to a high false alarm rate when detecting border binary programs,a framework is proposed,which is used to detect binary program vulnerability in device firmware by using front-end and back-end interaction logic.Firstly,the unpacked firmware file system is automatically scanned to identify the Web service-related boundary binaries.Secondly,the dangerous path of potential vulnerability is searched in the boundary binary program.Finally,the effectiveness of vulnerability is tested through the stain analysis of the dangerous path.Tested on a publicly available firmware set,the method can significantly im-prove the efficiency of vulnerability discovery in firmware binaries compared to the SaTC.
vulnerabilityborder binary programsdangerous functionsInternet of Thingsdanger-ous paths
维普
万方数据
