IoTaint: An Optimized Static Taint Analysis Method in Embedded Firmware

While IoT devices have created immense value for human life, they have also introduced unavoidable security risks. In recent years, attacks targeting IoT devices have become increasingly common, making the use of efficient and automated methods for discovering vulnerabilities in IoT devices a popular research direction. However, current vulnerability detection techniques face issues such as high false positive rates and huge time costs. Therefore, this paper introduces a prototype system for IoT device vulnerability detection, IoTaint, which is based on an optimized taint analysis method. IoTaint identifies tainted data sources by analyzing shared keywords between front-end and back-end files, tracks taint analysis across border binary and inter-files, and checks sink points of dangerous data. With low latency and low false positive rates, it is achieved by optimization strategies to efficiently identify vulnerabilities in IoT device firmware. Not only does IoTaint perform well in detecting Nday and 1day vulnerabilities, but it is also capable of discovering 0day vulnerabilities, for which are confirmed by CVE/CNNVD.