Hello, everybody.
Welcome back to this course, in this lesson, I will talk about how to extract and analyze Iot devices
firmware. Firmware is generally found in Iot devices in a compressed format and resides in non-volatile
memory of the Iot device.
It includes generally: a bootloader, the kernel, the file system and additional resources. Regarding
obtaining the firmware of a device,
It must be said that device manufacturers often make firmware available for download on their website.
Sometimes it may also be possible to obtain the firmware in the face of update mechanisms (OTA, Over The-Air updates)
not implemented in a secure way, and which allow with a man-in-the-middle attack to obtain it.
The classic methods of extracting the firmware of a device consist in extracting it directly from the
hardware by means of appropriate interfaces, such as UART, SPI, I2C, or by extracting it directly
from the EEPROM through an EEPROM chip reader. For the extraction of the firmware could also be used
a connection via JTAG or SWD debug interface.
The image shows an EEPROM flash BIOS programmer, which can be used for firmware dump.
The first operation to perform, after obtaining the firmware of the device under test, is to recognize and
extract the file system from the firmware. The recognition and the extraction of the file system can be
done manually or with the help of tools such as, for example, with the Linux tool binwalk.
We can see here usage informations of the binwalk tool, of which I will show some example of use
shortly.
The slide shows an example of analysis with binwalk of a firmware where binwalk analysis reports
recognition of a filesystem Squashfs with gzip compression.
To verify the application of encryption to the firmware, it is possible
with binwalk (with the -E uppercase parameter) to perform an analysis of the entropy of the firmware file,
as in the example shown in the slide. A completely flat line would indicate the presence of encryption,
in case instead of ripples, it would mean that the firmware is only in compressed format, but not encrypted.
And here is an example of extracting the filesystem, using binwalk (used with the parameter -e lowercase).
After extracting the file system from the device firmware, you can proceed by checking the presence
of: sensitive information, hardcoded passwords, encryption keys, backdoor accesses, etc..
The analysis of the extracted file system can be carried out manually or even with the aid of tools such
as the firmwalker tool, as in example shown in the slide.
Next step is to analyze the binary files in the file system.
We can check whether the binaries have any vulnerabilities. To analyze and make a reverse engineering
of binaries the commonly used tools
are disassemblers and binary debuggers, such as: IDA Pro, radare2, Hopper, Ghidra, etc.
In addition to a static analysis of binary files, it is useful to be able to carry out a dynamic
analysis by running them.
To do this, you can use tools, such as Qemu, to emulate the binaries and then run them.
For further information on the methodologies and tools used for the extraction and analysis of the firmware,
it is possible to consult the OWASP firmware Security Testing Methodology project.
OK.
Thank you for your kind attention, bye.