Directed Compositional Symbolic Execution for MSP430

Thursday August 31th, 12-1PM @ BA5205

Speaker: Ivan Pustogarov

Directed Compositional Symbolic Execution for MSP430

As embedded systems become ubiquitous and gradually shift from isolated offline to interconnected online systems, their security becomes a major concern. Embedded systems software is usually written in low-level memory-unsafe programming languages such as C which makes them particularly susceptible to memory corruption vulnerabilities.  In addition, such systems are often equipped with sensors and the firmware controlling them is commonly designed assuming a benign environment which makes them susceptible for signal spoofing attacks.
Symbolic execution is an efficient approach that can help in identifying and understanding these threats: combination of symbolic execution and black-box fuzzing can achieve high code coverage; its ability to automatically generate inputs that drive the program into particular states can be used to better understand possible signal spoofing attacks. Existing symbolic execution tools, however, do not work for firmware code and in contrast to the large body of research for traditional architectures such as x86, there are few tools for lower-end embedded architectures. 
In the first part of this talk, I will discuss our experience in building a directed, compositional  symbolic execution framework that targets software for the popular MSP430 family of microcontrollers.  I will give a few more details about our modular approach and  how we tackled interrupt-driven control flow, extensive use of peripheral devices, and hardware-related memory areas that are common for embedded programming and which frustrate traditional symbolic execution tools. I will then describe how we used our tool to partially automate a signal spoofing attack against a recently proposed gesture recognition system to trick the firmware into “recognizing” a gesture of the adversary’s choosing.  In the second part of the talk, I will briefly describe our preliminary work on handling dynamic memory allocation routines
(c/re/malloc) with symbolic sizes that are known to significantly increase the number of execution states if symbolically executed “as-is”.

Ivan Pustogarov is a Postdoctoral Researcher at Cornell University where he works on program analysis for security of embedded systems. He received his PhD from the University of Luxembourg with the focus on network security in 2015.
His research interests lie in the area of system security and center on program/binary analysis for embedded systems. His recent project focused on developing program analysis tools and techniques for the popular MSP430 family of microcontrollers. His research on network security includes practical low-resource off-path attacks on the Tor and Bitcoin P2P networks. The flaws described in his publications had a direct impact on users’ security and caused redesign of parts of the Tor protocol and its core code. His research has been published in S&P, CCS, AsiaCCS, ESORICS etc., and received attention from the media including BBC, The Register, Dailydot, and others.