Firmware Analysis
Firmware Analysis
EMBA is a firmware security analysis tool for penetration testers, security teams, and developers that performs firmware extraction, static analysis, dynamic analysis, and then generates a web-based vulnerability report.
Security Testing
Security Testing
In this example, I use ZAP to sit between a browser and the target site to intercept an HTTP request. By examining the request body, we can observe the transmission of user credentials, including variable names and values. This particular request reveals two critical security flaws: The username and password are sent in plain text, making them susceptible to interception. Also, both the username and password are set to "admin", a well-known and easily guessable default credential.
Web Form Validation
Web Form Validation
Password requirements force the user to a certain minimum complexity, increasing entropy. Password entropy is the measure of an individual password's "unpredictability", and is represented as a number of bits, representing alternatives. Assuming a randomly-generated password, we can calculate a password's entropy using the following formula:
E = log2(strength) = log2(RL)
EMBA - IoT Firmware Analysis
During my senior year at UTSA, I worked on an undergraduate research project in collaboration with the Department of Defense. EMBA is a firmware security analysis tool for penetration testers, security teams, and developers that performs firmware extraction, static analysis, dynamic analysis, then generates a web-based vulnerability report.
IoT devices are estimated to grow to over 24 billion devices by the year 2030. The time to process the firmware of these devices with EMBA is proportional to the complexity of the firmware. One of the objectives of this project was to leverage GPUs for scalability of processing speed.
I first gathered requirements from stakeholders and organized an Agile work process and scrum dashboard. I made a timeline, planning individual sprints for requirements gathering, design, implementation, testing, deployment, and maintenance, then added user stories to our backlog. I also created a GitHub repository for collaboration and version control.
DFS Algorithm Implementation
The problem I wanted to solve is that the current p50 binwalk module is potentially slow, and could be further optimized in the case that it encounters a large file system.
To solve this problem, I created an EMBA module - P51 "Mustang", an optimized binwalk extractor that first determines if the file system is deep enough to really benefit from the optimizations. To determine this, my module performs a depth-first search traversal on the extracted Linux file system. In the case that the depth is less than 50, it performs binwalk normally, but if it is over 50, it detects if an NVIDIA or an OpenCL-compatible GPU is available, and if so, performs binwalk with GPU acceleration and parallelization for file operations.
GitHub
OWASP ZAP
Zed Attack Proxy (ZAP) is an open-source web app scanning tool used for security testing. It simulates real-world scenarios to identify potential vulnerabilities. The goal of this type of testing is to proactively discover and remediate security weaknesses before they can be exploited by malicious actors.
In this example, I used OWASP ZAP to fuzz a website in order to identify a secret string stored in its database. Because this test was performed as part of an assignment at UTSA, I had full permission to scan this site. Fuzzing is a type of black-box testing that can only access the functionality of a system. It's a brute-force technique in which we control what goes in, and observe what comes out, and it is done to see if the software we're testing is robust enough to handle abnormal inputs.
Packet Interception
In this next example, I used ZAP to sit between a browser and the target site to intercept an HTTP request. By examining the request body, we can observe the transmission of user credentials, including variable names and values. This particular request reveals two critical security flaws: The username and password are sent in plain text, making them susceptible to interception. Also, both the username and password are set to "admin", a well-known and easily guessable default credential.
As an engineer focused on secure software development, I would address these issues with the following mitigations: Implement encryption via HTTPS to ensure data in transit is protected, enforce strong password policies that require high-entropy credentials, hash and salt passwords before storing them on the server to protect against credential theft. These steps align with industry best practices and help safeguard user data while strengthening the overall security of the application.
Authentication
Authorization and access control cannot be enforced without proper authentication. The most common method for authentication is passwords. This is a registration form that I created for a website. The user creates a username and password for later authentication when logging in. The username and password combination is stored in a SQL database.
Password "strength" can be measured and interpreted in different ways. The more passwords possible, the longer it takes to exhaust all combinations using brute force by guessing a new, random password each time. For a random character-based password, password complexity is a function of the password's length and possible characters (character pool).
Complexity = Possible Passwords = RL
In the javascript file shown below, I use a regex pattern to enforce a password with at least one upper-case letter,
one lower-case letter, one digit (0-9), and one special character: ( ! @ # $ % ^ & * ( ) _ + { } [ ] : ; < > , . ? ~ \ / - )
It's important to validate both client-side and server-side.
Password Complexity
Password requirements force the user to a certain minimum complexity, increasing entropy. Password entropy is the measure of an individual password's "unpredictability", and is represented as a number of bits, representing alternatives. Assuming a randomly-generated password, we can calculate a password's entropy using the following formula:
E = log2(strength) = log2(RL)
Strong passwords have at least 50 bits of entropy, which means for an attacker who can guess 10,000 passwords per second, it would take 3.7 million years to exhaust all possible passwords!
Form Authentication
Chaz's Linkedin
