Embedded Device Firmware Vulnerability Hunting Using FRAK

Architecture and Background

Copy of the slides for this talk are here: Embedded Device Firmware Vulnerability Hunting Using FRAK, the Firmware Reverse Analysis Konsole Ang Cui Red Balloon Security We present FRAK, the firmware reverse analysis konsole. FRAK is a framework for unpacking, analyzing, modifying and repacking the firmware images of proprietary embedded devices.

Vulnerability Analysis

The FRAK framework provides a programmatic environment for the analysis of arbitrary embedded device firmware as well as an interactive environment for the disassembly, manipulation and re-assembly of such binary images. We demonstrate the automated analysis of Cisco IOS, Cisco IP phone and HP LaserJet printer firmware images.

Exploitation and Demonstrations

We show how FRAK can integrate with existing vulnerability analysis tools to automate bug hunting for embedded devices. We also demonstrate how FRAK can be used to inject experimental host-based defenses into proprietary devices like Cisco routers and HP printers.

Remediation and Defensive Strategies

Ang Cui is the founder of Red Ballon Security Inc., which specializes in the development of offensive and defensive technologies for embedded systems. Ang is also currently a PhD candidate at Columbia University in the Intrusion Detection Systems Laboratory.