Detecting vulnerabilities in IoT firmware via keyword identification and path optimization

The rapid growth of IoT devices has led to increased interconnectivity, exposing vulnerabilities in firmware, particularly in back-end programs that handle untrusted inputs such as HTTP requests. Existing static taint analysis methods can detect such vulnerabilities, but they often suffer from missing keywords and exploration of unnecessary paths, which reduces efficiency and coverage. In this paper, we present IotSleuth, an approach that detects vulnerabilities in firmware by identifying keywords in back-end binaries. Our key insight is that functions receiving requests from the front-end frequently invoke the same data processing routines multiple times with different strings. By analyzing these invocations, IotSleuth extracts keywords and propagates them to discover additional taint sources, effectively extending the coverage of traditional taint analysis. We further introduce path optimization strategies to reduce redundant path exploration, significantly improving analysis efficiency. We implemented IotSleuth and evaluated it on 117 IoT firmware samples from nine vendors. Experimental results show that IotSleuth discovered 27 new vulnerabilities, all of which were assigned Common Vulnerabilities and Exposures (CVE) identifiers, and outperformed KARONTE, SaTC, CINDY, and HermeScan in both detection effectiveness and analysis speed.