A machine learning framework for inferring properties of embedded devices

Abstract

Nowadays, the prevalence of Internet of Things (IoT) devices has increased in our homes and workplaces, providing us with more convenience. However, the security of these devices is often compromised. The objective of this paper is to assess the security of embedded IoT devices. Existing passive fingerprinting approaches are inapplicable in the configuration when the network traffic of devices connected to an IoT hub is inaccessible. We proposed a firmware analysis technique for analyzing devices’ security by inspecting their firmware contents. Our aim is not to identify unknown vulnerabilities, but only those that are already known. We also intend to investigate whether the software that is executing services is outdated or not. Precise information regarding the name and version of servers, as well as login credentials and passwords, can be obtained through the analysis of firmware. Having obtained this information, we have created an active identification technique that enables an attacker to deduce specific characteristics of a connected device, such as the name of the software employed for the HTTP server or usernames. Our method involves training a classifier using data extracted from firmware. The results of our experiments indicate that our approach is more effective and covert compared to a brute-force method. We scrutinized 5,204 firmware of devices using our approach. Our findings suggest that the level of exposure of connected devices has grown in recent years. As connected devices become more open to services, it increases the potential attack surface while reducing their security.