Jetset: Targeted Firmware Rehosting for Embedded Systems

By Evan Johnson, Maxwell Bland, YiFei Zhu, Joshua Mason, Stephen Checkoway, Stefan Savage, and Kirill Levchenko.

In Proceedings of USENIX SECURITY 2021. USENIX, August 2021.

Abstract

The ability to execute code in an emulator is a fundamental part of modern vulnerability testing. Unfortunately, this poses a challenge for many embedded systems, where firmware expects to interact with hardware devices specific to the target. Getting embedded system firmware to run outside its native environment, termed rehosting, requires emulating these hardware devices with enough accuracy to convince the firmware that it is executing on the target hardware. However, full fidelity emulation of target devices (which requires considerable engineering effort) may not be necessary to boot the firmware to a point of interest for an analyst (for example, a point where fuzzer input can be injected). We hypothesized that, for the firmware to boot successfully, it is sufficient to emulate only the behavior expected by the firmware, and that this behavior could be inferred automatically.

To test this hypothesis, we developed and implemented Jetset, a system that uses symbolic execution to infer what behavior firmware expects from a target device. Jetset can generate devices models for hardware peripherals in C, allowing an analyst to boot the firmware in an emulator (e.g., QEMU). We successfully applied Jetset to thirteen distinct pieces of firmware together representing three architectures, three application domains (power grid, avionics, and consumer electronics), and five different operating systems. We also demonstrate how Jetset-assisted rehosting facilitates fuzz-testing, a common security analysis technique, on an avionics embedded system, in which we found a previously unknown privilege escalation vulnerability.

Material

• Proceedings version PDF
• Full version, local copy PDF

Reference

@InProceedings{johnson-et-al:jetset:usenix21,
  author =       {Evan Johnson and Maxwell Bland and YiFei Zhu and Joshua Mason
                  and Stephen Checkoway and Stefan Savage and Kirill Levchenko},
  title =        {Jetset: Targeted Firmware Rehosting for Embedded Systems},
  booktitle =    {Proceedings of the USENIX Security Symposium 2021,
                  (\textbf{USENIX})},
  editor =       {Michael Bailey and Rachel Greenstadt},
  year =         2021,
  month =        aug,
  organization = {USENIX},
  url =          {https://checkoway.net/papers/jetset2021},
}