MIPS-X: The Next IoT Frontier in Emulation & Vulnerability Research
Michael Ross and Nick Balazs present techniques for emulating non-standard MIPS architectures in QEMU to accelerate dynamic IoT firmware analysis.
Summary
The Complexity of Dynamic IoT Firmware Analysis
Dynamic vulnerability research on embedded devices requires emulating target binaries and network daemons without access to physical developer boards.
Overcoming MIPS Emulation Bottlenecks in QEMU
Michael Ross and Nick Balazs investigate emulation hurdles encountered with legacy and proprietary MIPS-X chipsets commonly found in routers and IP cameras.
Customizing Buildroot and Hardware Peripheral Stubs
The authors demonstrate developing custom NVRAM stubs, mock peripheral drivers, and QEMU patches to achieve stable system-level firmware emulation.
Automating Zero-Day Discovery via Dynamic Fuzzing
Ross and Balazs showcase dynamic fuzzing workflows on emulated MIPS targets, discovering unauthenticated memory corruption flaws in embedded web services.
Related talks
Main Stage·40 min
Julian Horoszkiewicz
Demonstrates rapid vulnerability discovery methodologies that uncovered seven zero-day local privilege escalation flaws in pre-installed OEM bloatware.
Main Stage·39 min
S Collins · M Muench · T Chothia
Investigates anti-cheat detection heuristics and server-side validation flaws across competitive online games, revealing how unusual play triggers bans.
Main Stage·20 min
Farzan Karim
Introduces Real-time Re-encryption (RRE), a technique that defeats commercial DRM and streaming paywalls across digital media platforms.