XCS based hidden firmware modification on embedded devices

Boldizsár Bencsáth, Levente Buttyán, Tamás Paulik

Research output: Chapter in Book/Report/Conference proceedingConference contribution

5 Citations (Scopus)

Abstract

Most contemporary embedded devices, such as wireless routers, digital cameras, and digital photo frames, have Web based management interfaces that allow an administrator to perform management tasks on the device from a Web browser connecting to the device's Web server. It has been shown earlier that many of these devices are vulnerable to Cross Site Scripting type attacks whereby some malicious JavaScript code can be injected in the Web pages stored on the device. When such infected pages are opened by the administrator, the malicious script is executed with admin privileges, and it can potentially fully compromise the embedded device. In this paper, we demonstrate that such full compromise of embedded devices is indeed possible in practice by showing how the injected malicious script can install an arbitrarily modified firmware on the device. We present the general framework of this kind of hidden firmware modification attacks, and report on our proof-of-concept implementation that targets Planex MZK-W04NU wireless routers. In addition, we also show how this vulnerability can be exploited to install botnet clients on embedded devices, and by doing so, to create embedded botnets. Our work proves that the risk of this type of attacks on embedded systems is considerable, and it will further increase in the future.

Original languageEnglish
Title of host publication2011 International Conference on Software, Telecommunications and Computer Networks, SoftCOM 2011
Pages327-331
Number of pages5
Publication statusPublished - Nov 23 2011
Event19th International Conference on Software, Telecommunications and Computer Networks, SoftCOM 2011 - Split, Hvar, Dubrovnik, Croatia
Duration: Sep 15 2011Sep 17 2011

Publication series

Name2011 International Conference on Software, Telecommunications and Computer Networks, SoftCOM 2011

Other

Other19th International Conference on Software, Telecommunications and Computer Networks, SoftCOM 2011
CountryCroatia
CitySplit, Hvar, Dubrovnik
Period9/15/119/17/11

    Fingerprint

Keywords

  • Cross Channel Scripting
  • Cross Site Scripting
  • Embedded systems
  • botnets
  • hidden firmware modification
  • malicious code
  • malware
  • security

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Software

Cite this

Bencsáth, B., Buttyán, L., & Paulik, T. (2011). XCS based hidden firmware modification on embedded devices. In 2011 International Conference on Software, Telecommunications and Computer Networks, SoftCOM 2011 (pp. 327-331). [6064451] (2011 International Conference on Software, Telecommunications and Computer Networks, SoftCOM 2011).