Challenges in Designing Exploit Mitigations for Deeply Embedded Systems

No ratings

Presented at IEEEEuroS&P 2019 by

Thorsten Holz

Sandro Etalle

Ali Abbasi

Jos Wetzels

Memory corruption vulnerabilities have been around for decades and rank among the most prevalent vulnerabilities in embedded systems. Unfortunately, such constrained systems pose unique design and implementation challenges that significantly complicate and hinder the adoption of common hardening techniques. Combined with the irregular and involved nature of embedded patch management, this results in prolonged vulnerability exposure windows and vulnerabilities that are easy to exploit by an attacker. Considering the sensitive and critical nature of many embedded systems, this situation merits significant improvements. In this paper, we present the first quantitative study of exploit mitigation adoption in 42 embedded operating systems. Our main finding is that the embedded world significantly lags behind the general-purpose world. To explain the results of our analyses, we provide a systematic identification of the underlying challenges embedded exploit mitigation adoption efforts face in practice. Based on these insights, we present µArmor, a realistic approach to address some of the key gaps identified in our quantitative analysis. Our evaluation shows that our prototype implementation of µArmor significantly raises the bar for attackers, while inducing only minimal performance and storage overhead.