Christopher Roberts - Firmware Slap: Automating Discovery of Exploitable Vulnerabilities in Firmware
Presents Firmware Slap, a framework combining concolic execution and fuzzing to automatically discover exploitable bugs in embedded firmware.
Summary
Automated Firmware Vulnerability Discovery
Christopher Roberts presents Firmware Slap, an open-source framework for automated vulnerability discovery in embedded device firmware.
Framework Architecture
Firmware Slap combines three analysis phases: static binary analysis using Angr for taint tracking, concolic execution to explore complex conditional branches, and targeted fuzzing guided by the static analysis results to generate exploiting test cases.
Firmware Extraction and Normalization
The framework handles the heterogeneous input formats (raw binary blobs, UBIFS/SquashFS filesystem images, encrypted firmware) produced by different vendors' firmware update mechanisms, automating extraction and binary identification.
Real-World Results
Firmware Slap identified multiple previously undiscovered vulnerabilities in consumer router firmware from D-Link and TP-Link, including stack buffer overflows in HTTP server CGI handlers, within minutes of automated analysis.
Related talks
Main Stage·55 min
Jan Berens · Marcell Szakály · Sebastian Köhler
Discloses vulnerabilities in QCA 7000 HomePlug modems used across CCS and NACS EV charging systems that enable communication hijacking and denial of service.
Main Stage·21 min
Noam Moshe
Demonstrates remote code execution and edge compromise across Axis enterprise IP cameras, turning surveillance devices into offensive pivot points.
Main Stage·43 min
Zack Fasel · Erin Jacobs
A consumer reports style walkthrough exposing systemic security flaws across 21 consumer products including DIY home security and fitness trackers.