Come Join the CAFSA

## Overview

In this talk, Collin Mulliner introduces an open-source tool called **Firmware Analyzer** designed to provide continuous, automated firmware security quality assurance (QA). Modern embedded products—such as automotive systems, IoT devices, customized Android hardware, and consumer electronics—rely on full operating systems (typically Linux, Android, or QNX) combining a kernel, user space, and real file systems.

Building secure devices is challenging due to rapid development cycles: features are constantly added, network ports are opened, debugging capabilities like SSH are temporarily introduced, and access controls change. If mistakes slip through to production, they cause a severe "ripple effect," resulting in disabled security mechanisms, non-functional products, broken update paths (e.g., from shipping incorrect public keys), product recalls, or brand damage. Firmware Analyzer automates security checks to verify that production builds meet security and quality standards before release.

---

## Scope and Core Philosophy

The presenter emphasizes that Firmware Analyzer targets structural, configuration, and operational firmware integrity rather than source-code vulnerabilities:

- **Not a Vulnerability/CVE Scanner:** The tool does not search for software bugs, binary flaws, or CVEs in the codebase, as existing static and binary analysis tools already address those areas (though external scripts can be plugged into the analyzer's scripting engine). - **Targeting Real Firmware Images:** It evaluates full/factory firmware updates (e.g., packaged in zip or CPIO archives) rather than delta updates or intermediate build stages, reflecting the final shipping state and allowing analysis of commercial off-the-shelf (COTS) devices. - **Focus on Production Hygiene:** Key inspection goals include verifying secure boot configurations, ensuring debug/test binaries and symbols are removed, confirming hardened compiler flags, checking for correct production cryptographic material (preventing leaked private keys or test keys), and validating access control configurations (e.g., avoiding world-readable `/etc/shadow` files or unintended SSH daemons).

---

## Technical Architecture and Methodology

Firmware Analyzer assesses unpacked file system images directly through a rule-driven engine:

- **Non-Root / Unmounted Analysis:** The tool parses file system images directly without requiring root privileges or mounting filesystem drivers. It supports ext-family filesystems, vFAT, squashfs, and plain unpacked directories. - **Deep Metadata Inspection:** Beyond file contents, the engine analyzes file ownership, permissions, attributes, directory structures, and SELinux labels. - **Differential Image Comparison:** It natively supports automated diffing between two firmware image versions, identifying exactly what files, permissions, and configurations changed over time. - **Extensible Scripting and Rules:** Expert-defined rules dictate required or forbidden file types, ownership, attributes, and contents, with support for running external utilities for deeper file inspection. - **Structured Output:** The engine emits JSON reports designed for straightforward post-processing and ingestion into cloud-based logging and telemetry platforms.

---

## Integration and Deployment Strategies

To maximize impact, Firmware Analyzer is designed for deployment at strategic points across the engineering lifecycle:

1. **Continuous Integration (CI):** Running the analyzer on every build or pull request flags misconfigurations early and blocks developers from merging insecure changes. 2. **Production Signing Gate:** Positioned as a prerequisite check before firmware reaches the production code-signing system, preventing unsigned or incorrectly configured builds from receiving valid signatures. 3. **Acceptance Testing:** Evaluating third-party vendor firmware and commercial off-the-shelf devices prior to procurement or deployment.