AutoFirm：大规模自动识别物联网固件中复用的库
AutoFirm: Automatically Identifying Reused Libraries inside IoT Firmware at Large-Scale
AI总结：
针对物联网固件复用库带来的安全风险，提出自动化工具AutoFirm，通过语法信息检测复用库，经大规模实证研究发现厂商普遍忽视更新过时库，漏洞威胁严峻。
摘要：
物联网（IoT）已成为我们日常生活和工作中不可或缺的一部分。遗憾的是，开发人员经常在物联网固件中复用软件库，这引发了重大安全隐患。如果这些库的漏洞或不安全版本未得到修补，大量物联网设备都可能受到影响。本文提出了AutoFirm，这是一款用于大规模检测物联网固件中复用库的自动化工具。具体而言，AutoFirm利用语法信息（库名称和版本）来判断物联网固件是否复用了这些库。我们对物联网固件中的复用库开展了大规模实证研究，调查了6900多款固件，以及来自349个开源软件库、影响11300多个易受攻击版本的2700多个不同漏洞。借助这一多样化的信息集，我们对存在漏洞的库版本进行了定性评估，以了解物联网固件中的安全缺口以及对库的错位信任问题。研究表明：在67.3%的案例中，制造商未更新物联网固件中的过时库；平均而言，过时库在修复前会存在超过1.34年；软件库的漏洞已对广泛分布的物联网设备构成了严重威胁。
英文摘要：
The Internet of Things (IoT) has become indispensable to our daily lives and work. Unfortunately, developers often reuse software libraries in the IoT firmware, leading to a major security concern. If vulnerabilities or insecure versions of these libraries go unpatched, a massive number of IoT devices can be impacted. In this paper, we propose the AutoFirm, an automated tool for detecting reused libraries in IoT firmware at a large scale. Specifically, AutoFirm leverages the syntax information (library name and version) to determine whether IoT firmware reuses the libraries. We conduct a large-scale empirical study of reused libraries of IoT firmware, investigating more than 6,900+ firmware and 2,700+ distinct vulnerabilities affecting 11,300+ vulnerable versions from 349 open-source software libraries. Leveraging this diverse information set, we conduct a qualitative assessment of vulnerable library versions to understand security gaps and the misplaced trust of libraries in IoT firmware. Our research reveals that: manufacturers neglected to update outdated libraries for IoT firmware in 67.3\% of cases; on average, outdated libraries persisted for over 1.34 years prior to remediation; vulnerabilities of software libraries have posed server threats to widespread IoT devices.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
