Shimware: Security Retrofitting of Monolithic Embedded Firmware
Abstract
Shimware: Security Retrofitting of Monolithic Embedded FirmwareThe Navy uses a wide variety of systems that operate on embedded devices, and their security has direct implications for operations both in cyberspace and in the real world. Unfortunately, the enticing set of targets has not gone unnoticed by attackers and reports on vulnerabilities in embedded systems have increased dramatically over the last few years. In addition, even when bugs are found and reported, that does not guarantee that a fix will be available or can easily be deployed. The reason is that many embedded systems and IoT devices lack mechanisms that enable easy and safe updating and patching. In this project, we will develop novel techniques to automatically retrofit security into firmware that drives critical systems. To this end, binary firmware images are modified to mitigate a design or implementation flaw. While the actual content of a fix is very dependent on the details of the flaw being patched, this work will focus on the act of patching a monolithic firmware image, and automating as many aspects as possible. Our efforts directly address needs outlined in the BAA under focus area (11) Cyberspace Operations. By automatically removing vulnerabilities in critical systems, work in this project wo;; prevent compromise of devices and harden them against attacks.
Document Details
- Document Type
- DoD Grant Award
- Publication Date
- Jun 17, 2020
- Source ID
- N000142012632
Entities
People
- Christopher Kruegel
Organizations
- Office of Naval Research
- United States Navy
- University of California, Santa Barbara