[论文解读] A Measurement Study on the (In)security of End-of-Life (EoL) Embedded Devices

Dingding Wang, Muhui Jiang+6 more|arXiv (Cornell University)|May 29, 2021

Advanced Malware Detection Techniques参考文献 25被引用 5

一句话总结

本研究首次通过网络空间搜索引擎和固件分析，对仍在运行的生命周期结束（EoL）嵌入式设备进行了测量，以检测活跃的EoL设备并评估其漏洞。研究发现超过200万台活跃的EoL设备，其中超过100万台存在漏洞——近一半存在高风险缺陷，且通过命令注入可能引发超过2.79 Tbps的DDoS攻击。

ABSTRACT

Embedded devices are becoming popular. Meanwhile, researchers are actively working on improving the security of embedded devices. However, previous work ignores the insecurity caused by a special category of devices, i.e., the End-of-Life (EoL in short) devices. Once a product becomes End-of-Life, vendors tend to no longer maintain its firmware or software, including providing bug fixes and security patches. This makes EoL devices susceptible to attacks. For instance, a report showed that an EoL model with thousands of active devices was exploited to redirect web traffic for malicious purposes. In this paper, we conduct the first measurement study to shed light on the (in)security of EoL devices. To this end, our study performs two types of analysis, including the aliveness analysis and the vulnerability analysis. The first one aims to detect the scale of EoL devices that are still alive. The second one is to evaluate the vulnerabilities existing in (active) EoL devices. We have applied our approach to a large number of EoL models from three vendors (i.e., D-Link, Tp-Link, and Netgear) and detect the alive devices in a time period of ten months. Our study reveals some worrisome facts that were unknown by the community. For instance, there exist more than 2 million active EoL devices. Nearly 300,000 of them are still alive even after five years since they became EoL. Although vendors may release security patches after the EoL date, however, the process is ad hoc and incomplete. As a result, more than 1 million active EoL devices are vulnerable, and nearly half of them are threatened by high-risk vulnerabilities. Attackers can achieve a minimum of 2.79 Tbps DDoS attack by compromising a large number of active EoL devices. We believe these facts pose a clear call for more attention to deal with the security issues of EoL devices.

研究动机与目标

• 调查仍连接至互联网的生命周期结束（EoL）嵌入式设备的规模与持续性。
• 评估厂商支持终止后，活跃EoL设备中存在漏洞的状况及其严重性。
• 评估由于缺乏安全补丁，EoL设备是否仍面临被利用的风险。
• 量化利用被 compromising 的EoL设备形成大规模僵尸网络的潜在影响。

提出的方法

• 利用网络空间搜索引擎（特别是ZoomEye）在为期10个月的持续扫描中检测活跃的EoL设备。
• 通过识别对网络探测有响应且仍在线的EoL设备，开展存活状态分析。
• 从公开来源（如CVE、NVD）及厂商发布说明中收集漏洞信息，识别已知缺陷。
• 使用FIRMADYNE、IDA Pro和Ghidra进行动态与静态固件分析，以验证漏洞的存在。
• 将EoL状态映射至固件镜像，分析补丁可用性与发布时序。
• 遵循伦理研究准则，对IP地址进行匿名化处理，并仅发布非敏感数据以防止滥用。

实验结果

研究问题

• RQ1 有多少台生命周期结束（EoL）的嵌入式设备仍处于活跃并连接至互联网？
• RQ2 在EoL日期之后，活跃EoL设备中漏洞的普遍程度与严重性如何？
• RQ3 EoL设备的补丁是否会在EoL之后发布？如果是，其完整性和及时性如何？
• RQ4 利用被 compromising 的活跃EoL设备，可能对大规模DDoS攻击造成多大影响？

主要发现

• 检测到超过200万台活跃的EoL设备，其中近30万台在被宣布为EoL超过五年后仍处于运行状态。
• 在分析的294个漏洞中，超过一半（182个）是在EoL日期之后才被发现，表明缺陷暴露存在延迟。
• 超过100万台活跃的EoL设备存在漏洞，其中近一半面临高风险漏洞。
• 通过利用活跃EoL设备中的操作系统命令注入漏洞，可能引发高达2.79 Tbps的DDoS攻击。
• 厂商发布的EoL设备安全补丁具有随意性且不完整，导致大多数设备仍处于无保护状态。
• 尽管已有公开报道提及EoL设备被利用，但此前尚无大规模测量研究量化此类系统的规模与风险。