US 12,450,359 B1
Method and apparatus for securing embedded device firmware
Ang Cui, New York, NY (US); and Salvatore J. Stolfo, New York, NY (US)
Assigned to RED BALLOON SECURITY, INC., New York, NY (US)
Filed by RED BALLOON SECURITY, INC., New York, NY (US)
Filed on Jun. 10, 2022, as Appl. No. 17/837,293.
Application 16/846,931 is a division of application No. 14/868,204, filed on Sep. 28, 2015, granted, now 10,657,262, issued on May 19, 2020.
Application 17/837,293 is a continuation of application No. 16/846,931, filed on Apr. 13, 2020, granted, now 11,361,083.
Claims priority of provisional application 62/076,749, filed on Nov. 7, 2014.
Claims priority of provisional application 62/056,555, filed on Sep. 28, 2014.
Claims priority of provisional application 62/056,553, filed on Sep. 28, 2014.
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/57 (2013.01); G06F 8/65 (2018.01); G06F 21/54 (2013.01)
CPC G06F 21/577 (2013.01) [G06F 8/65 (2013.01); G06F 21/54 (2013.01); G06F 2221/033 (2013.01)] 24 Claims
OG exemplary drawing
 
1. A system for embedded device vulnerability identification and mitigation, comprising:
one or more hardware processors; and
a non-transitory machine-readable storage medium encoded with instructions executable by the one or more hardware processors to perform operations comprising:
injecting at least one security software component into a firmware binary to create a monitored firmware binary;
loading the monitored firmware binary into an embedded device;
collecting live forensic information related to the monitored firmware binary via the injected at least one security software component;
detecting, by the injected at least one security software component, an unauthorized modification to the monitored firmware binary based on the live forensic information and static analysis data, the static analysis data comprising data generated by one or more static analysis techniques before operation of the firmware binary, wherein the unauthorized modification to the monitored firmware binary comprises an unauthorized modification of at least one in memory data item acted upon by one or more functions of the modified firmware binary;
based on the detected unauthorized modification, identifying one or more areas within the monitored firmware binary; and
modifying the identified one or more areas within the monitored firmware binary while the monitored firmware binary is running to create a hardened firmware binary that limits the identified one or more areas within the monitored firmware binary to a reduced set of operating software functions selected to reduce the number of attack vectors available to an attacker based on a given configuration for the embedded device, the modifying comprising one or more of deactivating code strings in the identified one or more areas within the firmware binary, or removing code strings in the identified one or more areas within the firmware binary.