| dc.description.abstract | Internet-Of-Things (IoT) devices and their firmware
are notorious for their lifelong vulnerabilities. As device infection
increases, vendors also fail to release patches at a competitive
pace. Despite security in IoT being an active area of research,
prior work has mainly focused on vulnerability detection and
exploitation, threat modelling, and protocol security. However,
these methods are ineffective in preventing attacks against legacy
and End-Of-Life devices that are already vulnerable. Current
research mainly focuses on implementing and demonstrating the
potential of malicious modifications. Hardening emerges as an
effective solution to provide IoT devices with an additional layer
of defense.
In this paper, we bridge these gaps through the design
of HALE-IoT, a generically applicable systematic approach to
HArdening LEgacy IoT non-low-end devices by retrofitting
defensive firmware modifications without access to the original source code.
HALE-IoT approaches this non-trivial task
via binary firmware reversing and modification while being
underpinned by a semi-automated toolset that aims to keep
cybersecurity of such devices in a hale state. Our focus is on
both modern and, especially, legacy or obsolete IoT devices as
they become increasingly prevalent. To evaluate the effectiveness
and efficiency of HALE-IoT, we apply it to a wide range of
IoT devices by retrofitting 395 firmware images with defensive
implants containing an intrusion prevention system in the form
of a Web Application Firewall (for prevention of web-attack
vectors), and an HTTPS-proxy (for latest and full end-to-end
HTTPS support) using emulation. We also test our approach on
four physical devices, where we show that HALE-IoT successfully
runs on protected and quite constrained devices with as low as
32MB of RAM and 8MB of storage. Overall, in our evaluation,
we achieve good performance and reliability with a remarkably
accurate detection and prevention rate for attacks coming from
both real CVEs and synthetic exploits. | es |
