Seum Spread: Discerning Security Flaws in IoT Firmware via Call Sequence Semantics

Internet-of-Things (IoT) devices play a central role in the modern digital landscape by providing uninterrupted convenience, but their history has been marked by the opportunities they provide bad actors desiring to exploit them. Vulnerable firmware remains a major factor in exploiting IoT devices. Persistent storage interfaces, which allow data retention even after power loss, can exacerbate this problem. This work examines and informs on the security impact of persistent storage through the lens of security-critical sanitization bypass flaws, computed attack surface spread, and the presence of command injection vulnerabilities; three facets of firmware code that can influence its susceptibility to exploitation. The assessment is established upon manually annotated call sequences that allow reasoning about path sanitization in order to formulate well-founded observations. We assemble a dataset of 100 IoT firmware images from four well-known vendors and initially find 68 devices whose persistent storage receives attacker-controllable input in over 4800 unique unsanitized paths. Furthermore, we discovered 77 instances of sanitization bypass flaws in 32 devices. In addition, we create the taint spread metric to assess the impact of tainted persistent storage on a firmware’s attack surface; in one alarming instance we find tainted data to affect over 1500 firmware code locations. Finally, we leverage the modeled call sequences to detect and exploit seven 0-day command injection vulnerabilities in five acquired devices and five assigned PSVs.