基于固件分析的路由器Web页面安全评估技术

路由器web页面用于对路由器进行管理设置,具有界面友好、操作便捷等特点,因而应用比较广泛。当前,路由器页面已经成为对路由器攻击的重要入口。为了提升路由器web页面的安全防护能力,减少漏洞,需要对路由器的web页面进行评估。因此,提出了一种基于固件分析的路由器web页面评估技术,并利用此方法分析了D-link系列路由器web页面漏洞,验证了该方法的有效性和可用性,可为路由器安全分析、路由器厂商安全加固提供借鉴。

网络设备固件分析技术研究

随着"互联网+"时代的到来,网络设备在公众网络中扮演着越来越重要的角色。网络设备的广泛使用使其安全性被高度关注,导致其安全问题也日益突出。基于固件逆向分析技术,主要介绍了网络设备固件分析的常用工具与方法,提出一种通用的固件分析思路,并利用该思路,成功对多款网络设备固件进行逆向分析,为网络设备安全研究提供了一种可验证的新方法。

智能终端固件自动安全分析系统开发与思考

近年来,随着物联网、人工智能的快速发展,IoT技术加速演进与落地,互联网进入万物互联、智能互联的新阶段,不仅带来了海量智能化终端,也带来了大量软件漏洞导致的安全风险。终端软件是网络安全防护的重要门户和攻防的关键节点,值得高度重视其安全性。本文介绍了智能终端固件自动安全分析系统,包括系统简介、系统架构、主要功能等,并对东方有线机顶盒终端及网络接入终端的固件进行自动化分析。

一种基于导向式模糊测试的IoT设备固件漏洞分析方法

为提高物联网(Internet of Things,IoT)设备漏洞分析的准确度,在深入分析了50余个MIPS架构的IoT设备固件漏洞的基础上,提出了一种基于导向式模糊测试的动静结合IoT设备固件漏洞分析方法。获取固件程序中所有函数信息,依据数据引入函数与漏洞触发函数的函数调用关系图,定位危险代码区域。基于危险代码区域详细控制流图,计算执行路径中基本块到达漏洞触发函数的距离,动态调控种子能量,实现面向漏洞触发函数的导向性模糊测试。设计实现了面向MIPS架构的IoT设备固件漏洞分析系统DirFirmFuzz。实验结果表明,相较于已有工具,系统漏洞分析的误报率平均缩减了73.31%,到达漏洞触发函数的平均速度加快了1.1~7倍。同时,在实际环境测试过程中,发现了D-Link、Cisco等多个厂商的12个0-day漏洞,均已报送相关厂商进行修补。

基于前后端关联性分析的固件漏洞静态定位方法

目前大多数物联网设备通过Web服务接口进行远程管理,利用Web服务漏洞发起攻击成为当前物联网设备安全面临的主要威胁之一。文章提出一种针对物联网设备Web服务漏洞的静态挖掘方法,首先基于前端脚本文件与边界二进制程序之间的关联性特征,通过对前后端文件进行关联分析,识别固件中的边界二进制程序,确定在边界二进制程序中针对Web输入数据的起始处理位置。然后利用污点分析技术判断输入数据是否会被漏洞触发函数处理,定位程序中的危险函数区域。最后实现固件漏洞静态方法的原型系统FBIR,并对10款固件进行实验,通过定位危险函数的方式验证45个已知漏洞并挖掘出12个零日漏洞。在漏报率只有14.9%的基础上,与传统人工分析的方法对比,文章所提方法将程序函数分析范围平均缩小了86%。

轿车车轮紧固螺栓断裂失效分析

对轿车装置生产线使用的轮胎车轮紧固螺栓断裂事故进行了调研分析，追踪冶金生产，螺栓制造对失效件断口宏观及材料显向组织进行了科学分析和讨论，并采用批量工艺验证，从而找出了制造工艺不妥之处，提出了改进措施，获得满意的效果。

面向固件的软硬协同仿真方法及其漏洞挖掘应用

针对面向固件的用户级仿真不能准确仿真与外设交互的问题,本文提出一种基于软硬件协同的固件仿真执行方法。该方法拦截应用程序访问设备文件的系统调用,将其转发到实体设备上执行,并将执行结果反馈给仿真器。基于该方法实现了一个原型系统,成功仿真运行了两款设备固件的HTTP服务程序,并且以该原型系统作为动态分析平台,使用Boofuzz对HTTP服务程序进行模糊测试,成功发现了两个已知漏洞。

电力物联网设备安全检测系统设计与应用

电力物联网设备正在越来越多的应用于电力系统,由于设备类型多样、复杂,因此目前尚未有对其进行安全检测的成熟解决方案。为解决这一现状,设计研发一种电力物联网设备安全检测系统,基于设备指纹识别、网络协议识别和固件安全性分析等关键技术,对电力物联网设备从漏洞情况、配置安全性和固件安全性角度进行综合安全分析,实现对设备安全性检测,自动化的系统设计大大提高了用户开展安全检测工作的效率。目前,该系统已积累了品牌库23 613条,固件库11条,协议库22条,漏洞库159 763条,威胁特征库1 028条。利用电力物联网设备安全检测系统对电力5G终端、5G CPE、5G边缘网关等六款设备进行安全检测,累计挖掘终端密钥泄露、配置错误、不安全的组件等安全风险274个。将研发的平台与业内知名漏洞扫描工具进行了对比分析,电力物联网设备安全检测系统具有较高的准确率和覆盖率。同时,将系统在3个典型电力业务场景进行试点验证,累计挖掘各类安全漏洞590个,有力保障了电力物联网终端本体安全性。

Consolidation analysis of composite foundation with partially penetrated cement fly-ash gravel(CFG) piles under changing permeable boundary conditions

Based on the double-layered foundation theory, the composite ground with partially penetrated cement fly-ash gravel(CFG) piles was regarded as a double-layered foundation including the surface reinforced area and the underlying untreated stratum. Due to the changing permeability property of CFG piles, the whole consolidation process of the composite ground with CFG piles was divided into two stages, i.e., the early stage(permeable CFG pile bodies) and the later stage(impermeable pile bodies). Then, the consolidation equation of the composite foundation with CFG piles was established by using the Terzaghi one-dimensional consolidation theory. Consequently, the unified formula to calculate the excess pore water pressure was derived with the specific solutions for the consolidation degree of composite ground, reinforced area and underlying stratum under instant load obtained respectively. Finally, combined with a numerical example, influencing rules by main factors(including the replacement rate m, the treatment depth h1, the permeability coefficient Ks1, Kv2 and compression modulus Es1, Es2 of reinforced area and underlying stratum) on the consolidation property of composite ground with CFG piles were discussed in detail. The result shows that the consolidation velocity of underlying stratum is slower than that of the reinforced area. However, the consolidation velocity of underlying stratum is slow at first then fast as a result of the transferring of effective stress to the underlying stratum during the dissipating process of excess pore water pressure.

Is Terzaghi's effective stress a stress variable under seepage conditions?

From the continuum mechanics perspective, an attempt was made to clarify the role of Terzaghi's effective stress in the theoretical analysis of saturated soil subjected to seepage. The necessity of performing a coupled hydromechanical analysis to solve the seepage-deformation interaction problem was illustrated by examining the equations of static equilibrium among the effective stress, seepage force, pore-water pressure and total stress. The conceptual definition of stress variable that satisfies the principles of continuum mechanics is applied in the coupled hydromechanical analysis. It is shown that Terzaghi's effective stress is in fact not a stress variable under seepage conditions, and the seepage force acting on the soil skeleton cannot be viewed as a body force. This offers a clue to the underlying cause of a paradox between the real Pascal's hydrostatic state and the hydrostatic state predicted by a class of continuum hydromechanical theories.

Stress Analysis of the Sarafix External Fixator Design

A stress analysis of the Sarafix external fixator design was performed using finite element analysis （FEA） and experimental tensometric measurements. The study was conducted at one of the Sarafix fixator configurations that have a clinical application in the treatment of tibia fractures. The intensity of principal and yon Mises stresses generated at two measuring points （MP） on the fixator connecting rod were monitored and analyzed during the testing on axial compression on the fixator design and its finite element model （FEM）. The 3D geometrical and FEM model of the fixator was formed using the computer aided design/computer aided engineering （CAD/CAE） software system CATIA. Verification of the results for the dominant principal stresses obtained from FEA was carried out through tensometric measurements. The measuring chain consisted of strain gauges connected into two Wheatstone half-bridges, digital measuring amplifier system and a computer with software for acquisition and monitoring of measurement results. A quite good agreement was observed between the results obtained on the basis of FEA and results of experimental tensometric analysis,

面向LPWAN的受限设备协议漏洞自动化检测框架

低功耗广域网(low power wide area network,LPWAN)作为一个强调低功耗的协议通常运行在资源受限设备上。一方面,受限的资源给协议实现的安全性带来了严峻的挑战,厂商通常难以在安全性与资源消耗上进行取舍。另一方面,协议栈以裸机固件的形式部署在设备上,各异的硬件特性使得其自动化分析较为困难。因此,本文专门针对资源受限设备提出了一种基于符号执行与污点分析的协议栈分析框架ProSE,能够针对固件中存在的协议漏洞进行检测。本文以LPWAN中最具代表性的LoRaWAN协议作为分析对象,实现了多种漏洞的自动化检测,并成功检测出6个厂商LoRaWAN实现中存在的20个潜在安全漏洞。