Finding backdoors in IoT devices and popular software

What is it about?

Most of us own and use one or more IoT devices: routers for our home WiFi, smart watches, voice-controlled home automation devices and so on. The software that runs on those devices, called firmware, is often a collection of various parts performing different tasks. Since many of those parts are reused across devices, they are often duplicated. Some of them are sourced via third parties, which have in the past (knowingly or not) shipped software containing backdoors, meaning that there are "secret keys"--passwords, IP addresses, or any type of data--which unlock parts of the software not meant to be accessed by regular users. Hackers can find these "secret keys" and use them to get access to personal data or private infrastructure. In general, it is very hard to make sure that a piece of software does not contain any backdoors. In fact, it is very much like trying to prove that there is no way to sneak into a given building: it requires a very detailed check of every square centimeter of the premises, to be carried out by physical security experts--and even then, mistakes can happen. Our approach automates this process in two ways. First, it automates the search: in the building analogy, we would use some sort of robot that can check the surface of the building much faster and with more precision than a human. Second, it automates the process of checking for a backdoor: in the building analogy, the robot would compare the behavior produced by a given action (like pushing against a door leading to the door unlocking and opening) to the behaviors of similar actions that it has seen before (for example, pushing most locked doors does not do anything). Thanks to this automation we have discovered a powerful tool that can aid security researchers and firmware developers to vet third-party software components in a way which requires much less manual work than before, while allowing for high precision.

Featured Image

Photo by Jordan Harrison on Unsplash

Photo by Jordan Harrison on Unsplash

Why is it important?

Backdoor attacks are unfortunately quite common. Besides the very recent examples of the attack against multiple NPM packages (https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised) and the attack against the XZ Utils compression toolchain (https://en.wikipedia.org/wiki/XZ_Utils_backdoor), there have been a number of firmware attacks on different routers (https://conference.hitb.org/hitbsecconf2018dxb/materials/D1T1%20-%20Hunting%20for%20Backdoors%20in%20IoT%20Firmware%20at%20Unprecedented%20Scale%20-%20John%20Toterhi.pdf, https://www.zdnet.com/article/d-link-routers-found-to-contain-backdoor/, https://web.archive.org/web/20131020145741/http://www.devttys0.com/2013/10/from-china-with-love). These backdoors are often detected due to the attackers being "loud" and not due to the backdoor itself, which means that there might be multiple undetected backdoors in the wild. Finally, as more and more software reaches the general public, it is becoming less and less feasible to manually check all of it, which is why automating such processes is vital to ensure that the software remains secure.