× Cookies are disabled! This site requires cookies to be enabled to work properly

Towards Automated Classification of Firmware Images and Identification of Embedded Devices

Andrei Costin Apostolis Zarras, and Aurélien Francillon

In Proceedings of the 32nd International Conference on ICT Systems Security and Privacy Protection - IFIP SEC 2017, May 2017.

Abstract

Embedded systems, as opposed to traditional computers, bring an incredible diversity. The number of devices manufactured is constantly increasing and each has a dedicated software, commonly known as firmware. Full firmware images are often delivered as multiple releases, correcting bugs and vulnerabilities, or adding new features. Unfortunately, there is no centralized or standardized firmware distribution mechanism. It is therefore difficult to track which vendor or device a firmware package belongs to, or to identify which firmware version is used in deployed embedded devices. At the same time, discovering devices that run vulnerable firmware packages on public and private networks is crucial to the security of those networks.
In this paper, we address these problems with two different, yet complementary approaches: firmware classification and embedded web interface fingerprinting. We use supervised Machine Learning on a database subset of real world firmware files. For this, we first tell apart firmware images from other kind of files and then we classify firmware images per vendor or device type. Next, we fingerprint embedded web interfaces of both physical and emulated devices. This allows recognition of web-enabled devices connected to the network. In some cases, this complementary approach allows to logically link web-enabled online devices with the corresponding firmware package that is running on the devices. Finally, we test the firmware classification approach on 215 images with an accuracy of 93.5%, and the device fingerprinting approach on 31 web interfaces with 89.4% accuracy.

Download

Download the conference slides or the conference paper (DOI 10.1007/978-3-319-58469-0_16).

Bibtex

To reference our paper, results and the MoonshineLuaSec (MSL) tool, please use the following bibtex entry:
@inproceedings{costin2017towards,
  title={{Towards Automated Classification of Firmware Images and Identification of Embedded Devices}},
  author={Costin, Andrei and Zarras, Apostolis and Francillon, Aurelien},
  booktitle={ICT Systems Security and Privacy Protection. SEC 2017. IFIP Advances in Information and Communication Technology, vol 502.},
  year={2017},
  month={May},
  doi={10.1007/978-3-319-58469-0_16},
  organization={IFIP},
  publisher={Springer}
}

Scripts and Datasets

File Description SHA256 Size Date (YYYY-MM-DD)
ifipsec17_firmware_classification.data.tgz
ifipsec17_firmware_classification.data.tgz.gpg
Dataset used for firmware classification experiments. be98c81e76bd5d3efd742ce705959b54b4143e6ff4c05d36f6845974e83e65ff
75ecf5811155de26fdebb95f7d9f78a1e6ec5f00622e841d7c34a6eaecd54d84
1925902973
1925903202
2015-06-22
ifipsec17_firmware_classification.scripts.zip Scripts used for firmware classification experiments. - - -
ifipsec17_device_fingerprinting.data.zip Dataset used for device fingerprinting experiments. - - -
ifipsec17_device_fingerprinting.scripts.zip Scripts used for device fingerprinting experiments. - - -