EMBA v2.0.0 - A brave new world of firmware analysis #1831
m-1-k-3
announced in
Announcements
Replies: 1 comment
-
|
It's great to see that EMBA has taken an important step in firmware analysis, especially in improving the success rate of system simulation and integrating the SBOM workflow💪 |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
The last few weeks looked a bit more silent to the outside ... but cool things were going on in the background. Now, it is time to share all the great things we were working on ;)
In the early days of the EMBA firmware analysis environment one of our visions was a bit like the following:
EMBA should be an environment for fully automated detection and verification of known and unknown vulnerabilities in the product and firmware sector
The complete environment needs to be available as Open-Source which allows you to be part of it. Everyone should be able to perform high quality firmware security analysis, perform better IoT penetration tests, create the best SBOMs, scale and optimize firmware security research at all. Additionally, everyone should be able to modify, integrate and adopt EMBA easily (btw. this is the reason why we decided to use Bash), improve EMBA and being part of EMBA as user, tester, developer, feedback giver, idea generator, bug hunter ... you get the idea of Open-Source ;)
Vulnerability analysis in the field of firmware is a complex task, but with EMBA we have built some quite solid tooling and strategies over the years. This would not be possible without all the other awesome Open-Source projects out there!
EMBA is standing on the shoulders of giants. EMBA is standing on your shoulders! Thank you!
We were always fascinated by the idea of automatically starting up the device during an EMBA analysis in a controlled emulated environment. This means that we will be able to verify the already discovered results directly on the running firmware. We are not at the end of this journey yet, but it looks like this goal is not completely unrealistic anymore! In our opinion this release is a milestone to our ultimate goal of vulnerability detection and verification.
The road to version 2.0.0 was very rough and bumpy. Over the last few months we tested, tested, tested, looked at emulation output and improved every little piece a little bit! The goal we had in mind was ...
Let's bring our system emulation engine to the next level
After months of testing, building kernels (shoutout to @HoxhaEndri), analyzing, fixing, refactoring, testing again and screaming multiple times we are now quite happy with the results! Enjoy the following benchmark results of some of our firmware test sets:
The original FirmAE corpus was created somewhere before 2020. So, today this corpus is quite outdated. Nevertheless, as the FirmAE project was already optimized to a 79% success rate with at least one network service available we were interested if we can further improve this high success rate. We took this corpus as an initial benchmark indicator to ensure our performance is not too bad. The following overview gives some insights into the results from all three system emulation frameworks: firmadyne, FirmAE and EMBA
While firmadyne was the initial framework and other environments like FirmAE and also EMBA were built around the same approach, it had only 16% of success rate. This means in only 16% of the firmware tests firmadyne was able to bring the firmware automatically to a state where network services were reachable. FirmAE improved this rate to 79% success rate. And now, EMBA got this rate to 95% success rate with at least one network service available. Altogether EMBA was able to identify more than 6000 network services on 1074 systems.
The Fraunhofer FKIE builds regularly the so-called Home Router Security Report (Check this report). We used these reports as inspiration and built some firmware sets over time:
On a fresh and unoptimized firmware corpus we can get a better idea of more real-world results of the different engines. Neither firmadyne, nor FirmAE were trained on this firmware corpus. This resulted in significantly lower success rates:
The firmadyne results dropped down to 5% (from 16% on the FirmAE corpus) of success rate and the FirmAE rates dropped to 30% (from 79% on the FirmAE corpus). In comparison EMBA was able to double the FirmAE results and fully automatically emulate 87% of firmware to a state where at least one network service was available. In total EMBA detected more than 600 network services on 126 analyzed firmware images.
With the integration of the dependency track API it is now also possible to automatically transfer the generated SBOM into your dependency track instance and track all the vulnerabilities in a beautiful vulnerability and SBOM management tool:
This integration mechanism enhances your vulnerability handling and pentesting process massively and shows the flexibility of EMBA.
The testset of the year 2022 looked a bit like a duplication of the results of 2020. Firmadyne got 2% of the tested firmware to a reachable network service, FirmAE already improved the state to 16% and EMBA climbed up to 76%. This time with around 400 reachable network services on 121 analyzed firmware images:
Also on a more modern testset from 2024 the picture changed not that much. Firmadyne now has only 1% success rate, FirmAE improved the emulation results to 17% and EMBA stays quite stable at 77%:
These stable emulation results across a huge amount of different firmware images from different vendors with different architectures from different time periods highlight the magic of EMBA and give us a quite good base for further development.
Additionally, we want to take a look at the following highlights:
Beside your ongoing support with feedback, testing, working on issues and spreading EMBA you can now also support EMBA as a sponsor.
Check it out here and start being an essential part of the future of EMBA.
Breaking News: Check also our new shop for EMBA merch here.
It is always a pleasure to welcome new contributors to EMBA. This time we welcome:
Besides all our newcomers we also want to thank the other, regular contributors!
We had never before so many bug reports, contributors and helping hands! Big kudos to all of you!
How can you reach us and stay up to date? Just take one of these channels (or all):
Now, start your fresh Kali Linux (put enough CPU power and RAM into it) and install EMBA:
This will install all pre-requisites, including the docker base image and the CVE database, which will need some bandwith, harddrive space and time.
Afterwards, you are ready to analyse your first firmware with EMBA:
For updating your outdated EMBA installation, please check the update section in our wiki.
What's Changed
New Contributors
Full Changelog: v1.5.2-SBOM-next-generation-EMBA...v2.0.0-A-brave-new-world
This discussion was created from the release EMBA v2.0.0 - A brave new world of firmware analysis.
Beta Was this translation helpful? Give feedback.
All reactions