Master Thesis Defense - December 5, 2018: Fingerprinting Vulnerabilities in Intelligent Electronic Device Firmware

Leo Collard

Wednesday, December 5, 2018 at 2:00 p.m.
Room EV001.162

You are invited to attend the following M.A.Sc. (Quality Systems Engineering) thesis examination.

Examining Committee

Dr. C. Wang, Chair
Dr. M. Debbabi, Supervisor
Dr. A. Hanna, Supervisor
Dr. A. Youssef, CIISE Examiner
Dr. J. Paquet, External Examiner (CSE)

Abstract

Modern smart grid deployments heavily rely on the advanced capabilities that Intelligent Electronic Devices (IEDs) provide. Furthermore, these devices firmware often contain critical vulnerabilities that if exploited would cause devastating effects on national economic security, and national safety. As such, a scalable domain specific approach is required in order to assess the security of IED firmware. In order to resolve this lack of an appropriate methodology, we present a scalable vulnerable function identification framework. It is specifically designed to analyze IED firmware and binaries that employ the ARM CPU architecture. Its core functionality revolves around a multi- stage detection methodology that is specifically designed to resolve the lack of specialization that limits other general-purpose approaches. This is achieved by compiling an extensive database of IED specific vulnerabilities and domain specific firmware that is evaluated. Its analysis approach is composed of three stages that leverage function syntactic, semantic, structural and statistical features in order to identify vulnerabilities. As such it (i) first filters out dissimilar functions based on a group of heterogeneous features, (ii) it then further filters out dissimilar functions based on their execution paths, and (iii) it finally identifies candidate functions based on fuzzy graph matching. In order to validate our methodologies capabilities, it is implemented as a binary analysis framework entitled BinArm. The resulting algorithm is then put through a rigorous set of evaluations that demonstrate its capabilities. These include the capability to identify vulnerabilities within a given IED firmware image with a total accuracy of 0.92.