SoK: Enabling Security Analyses of Embedded Systems via Rehosting

A. Fasano, T. Ballo, M. Muench, T. Leek, A. Bulekov, B. Dolan-Gavitt, M. Egele, A. Francillon, L. Lu, N. Gregory, D. Balzarotti, W. Robertson

Research output: Chapter in Book / Report / Conference proceedingConference contributionAcademicpeer-review

Abstract

Closely monitoring the behavior of a software system during its execution enables developers and analysts to observe, and ultimately understand, how it works. This kind of dynamic analysis can be instrumental to reverse engineering, vulnerability discovery, exploit development, and debugging. While these analyses are typically well-supported for homogeneous desktop platforms (e.g., x86 desktop PCs), they can rarely be applied in the heterogeneous world of embedded systems. One approach to enable dynamic analyses of embedded systems is to move software stacks from physical systems into virtual environments that sufficiently model hardware behavior. This process which we call "rehosting"poses a significant research challenge with major implications for security analyses. Although rehosting has traditionally been an unscientific and ad-hoc endeavor undertaken by domain experts with varying time and resources at their disposal, researchers are beginning to address rehosting challenges systematically and in earnest. In this paper, we establish that emulation is insufficient to conduct large-scale dynamic analysis of real-world hardware systems and present rehosting as a firmware-centric alternative. Furthermore, we taxonomize preliminary rehosting efforts, identify the fundamental components of the rehosting process, and propose directions for future research.
Original languageEnglish
Title of host publicationASIA CCS 2021 - Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security
PublisherAssociation for Computing Machinery, Inc
Pages687-701
Number of pages15
ISBN (Electronic)9781450382878
DOIs
Publication statusPublished - May 2021
Event16th ACM Asia Conference on Computer and Communications Security, ASIA CCS 2021 - Virtual, Online, Hong Kong
Duration: 7 Jun 202111 Jun 2021

Publication series

NameASIA CCS 2021 - Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security

Conference

Conference16th ACM Asia Conference on Computer and Communications Security, ASIA CCS 2021
Country/TerritoryHong Kong
CityVirtual, Online
Period7/06/2111/06/21

Funding

The authors wish to thank the following individuals for their contributions and support: Lindsey Wang, John Wilkinson, Douglas E. Stetson, William Hedberg, and Greta Lepore. This work was in part funded by ONR Awards N00014-15-1-2180 and N00014-19-1-2364; the National Science Foundation under Grants No. CNS-1916398 and CNS-1942793; NWO 628.001.030 \u201CTropics\u201D and NWO NWA-ORC InterSect; and a research contract with Siemens AG. DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited. This material is based upon work supported by the Under Secretary of Defense for Research and Engineering under Air Force Contract No. FA8702-15-D-0001. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the Under Secretary of Defense for Research and Engineering, Office of Naval Research, or the National Science Foundation.

FundersFunder number
Under Secretary of Defense for Research and Engineering
Office of Naval ResearchN00014-19-1-2364, N00014-15-1-2180
National Science FoundationCNS-1916398, 1916398, CNS-1942793
Air ForceFA8702-15-D-0001
NWO628.001.030

    Fingerprint

    Dive into the research topics of 'SoK: Enabling Security Analyses of Embedded Systems via Rehosting'. Together they form a unique fingerprint.

    Cite this