performing-firmware-malware-analysis

执行固件恶意软件分析

何时使用

• 受感染的 IoT 设备或路由器需要进行固件分析，以识别植入的后门
• 调查能在操作系统重装后依然持久化的 UEFI/BIOS rootkit
• 分析固件更新是否存在供应链入侵或恶意修改
• 从 IoT 设备固件镜像中提取并检查嵌入式 Linux 文件系统
• 在疑似硬件或固件层面入侵后验证固件完整性

请勿使用于标准操作系统恶意软件；对于传统系统上的操作系统级恶意软件，请使用 PE/ELF 分析工具。

前提条件

• 已安装 binwalk，用于固件镜像分析与提取（pip install binwalk）
• 支持 ARM/MIPS 架构的 Ghidra，用于嵌入式二进制逆向工程
• UEFI Tool（UEFITool），用于 UEFI 固件解析与分析
• Firmware Analysis Toolkit（FAT）或 EMBA，用于自动化固件分析
• QEMU，用于模拟提取出的固件文件系统
• 适用于 ARM、MIPS 及其他嵌入式架构的交叉编译工具链

工作流

步骤 1：提取并识别固件组件

分析固件镜像结构并提取文件系统：

# Identify embedded filesystems and compressed data
binwalk firmware.bin

# Extract all identified components
binwalk -e firmware.bin

# Recursive extraction with signature scanning
binwalk -eM firmware.bin

# Output typically includes:
# - Bootloader (U-Boot, GRUB, custom)
# - Kernel image (Linux, RTOS)
# - Root filesystem (SquashFS, JFFS2, CramFS, ext4)
# - Configuration data
# - Digital signatures or checksums

# Entropy analysis to find encrypted or compressed regions
binwalk -E firmware.bin

# Identify specific filesystem types
file _firmware.bin.extracted/*

# For SquashFS filesystems
unsquashfs _firmware.bin.extracted/squashfs-root.img
ls squashfs-root/

步骤 2：分析提取出的文件系统

在固件文件系统中搜索恶意修改：

# Directory structure analysis
find squashfs-root/ -type f | head -50

# Search for suspicious files
find squashfs-root/ -name "*.sh" -exec ls -la {} \;
find squashfs-root/ -perm -4000 -type f  # SUID binaries
find squashfs-root/ -name "*.so" -newer squashfs-root/bin/busybox  # Modified libraries

# Check startup scripts for backdoors
cat squashfs-root/etc/init.d/rcS
cat squashfs-root/etc/inittab
ls -la squashfs-root/etc/rc.d/

# Search for hardcoded credentials
grep -rn "password\|passwd\|secret\|key\|token" squashfs-root/etc/ 2>/dev/null
grep -rn "root:" squashfs-root/etc/shadow 2>/dev/null

# Check for unauthorized SSH keys
find squashfs-root/ -name "authorized_keys" -exec cat {} \;

# Network configuration backdoors
cat squashfs-root/etc/hosts
grep -rn "iptables\|nc\|netcat\|ncat" squashfs-root/etc/ squashfs-root/usr/bin/

# Check for reverse shells in cron
find squashfs-root/ -name "crontab" -o -name "cron*" | xargs cat 2>/dev/null

# Identify all ELF binaries for analysis
find squashfs-root/ -type f -exec file {} \; | grep ELF

步骤 3：逆向工程可疑二进制文件

分析提取出的可能是后门的二进制文件：

# Identify architecture and format
file squashfs-root/usr/bin/suspicious_binary

# Extract strings for IOC discovery
strings squashfs-root/usr/bin/suspicious_binary | grep -iE "http|ip|port|shell|connect|exec"

# Cross-reference against known firmware binaries
# Compare SHA-256 hashes with known-good firmware
sha256sum squashfs-root/usr/bin/* > current_hashes.txt
# diff against baseline: diff baseline_hashes.txt current_hashes.txt

# Import into Ghidra for disassembly (select correct architecture)
# ARM:   ARM/AARCH64 (Little Endian for most IoT devices)
# MIPS:  MIPS/MIPS64 (Big or Little Endian depending on device)
# x86:   For UEFI modules

# Analyze with radare2 for quick triage
r2 -A squashfs-root/usr/bin/suspicious_binary
# Commands: afl (function list), pdf @main (disassemble main), iz (strings)

步骤 4：UEFI/BIOS 固件分析

分析系统固件中的 bootkit 和植入程序：

# Extract UEFI firmware volumes with UEFITool
# GUI: UEFITool -> File -> Open -> Select firmware.rom
# CLI: UEFIExtract firmware.rom

# Analyze UEFI firmware with chipsec (requires hardware access)
python chipsec_main.py -m common.bios_wp     # BIOS write protection
python chipsec_main.py -m common.spi_lock     # SPI flash lock
python chipsec_main.py -m common.secureboot   # Secure Boot status
python chipsec_main.py -m common.uefi.s3bootscript  # S3 resume script

# Dump UEFI firmware from live system
python chipsec_util.py spi dump firmware_dump.rom

# Compare with known-good firmware
sha256sum firmware_dump.rom
# Compare against vendor-provided firmware hash

# Scan for known UEFI malware signatures
yara -r uefi_malware_rules.yar firmware_dump.rom

Known UEFI Malware Families:
━━━━━━━━━━━━━━━━━━━━━━━━━━
LoJax:         First in-the-wild UEFI rootkit (APT28/Fancy Bear)
               Modifies SPI flash to drop persistence agent
MosaicRegressor: Modular UEFI framework dropping multiple payloads
CosmicStrand:  UEFI firmware rootkit modifying kernel during boot
BlackLotus:    UEFI bootkit bypassing Secure Boot on Windows 11
ESPecter:      ESP (EFI System Partition) bootkit modifying boot manager
MoonBounce:    SPI flash implant modifying CORE_DXE module
FinSpy UEFI:  Surveillance software with UEFI persistence

步骤 5：模拟固件以进行动态分析

在模拟环境中运行提取出的固件：

# Emulate ARM-based IoT firmware with QEMU
# Mount the extracted filesystem
sudo mount -o loop squashfs-root.img /mnt/firmware

# Chroot into the firmware with QEMU user-mode emulation
sudo cp /usr/bin/qemu-arm-static /mnt/firmware/usr/bin/
sudo chroot /mnt/firmware /bin/sh

# Or use firmadyne for automated firmware emulation
# https://github.com/firmadyne/firmadyne
python3 fat.py firmware.bin

# Network service analysis within emulated firmware
# Scan for open ports and services
nmap -sV localhost -p 1-65535

# Monitor network traffic from emulated firmware
tcpdump -i tap0 -w firmware_traffic.pcap

步骤 6：记录固件分析

汇总全面的固件分析发现：

Analysis documentation should cover:
- Firmware image metadata (vendor, model, version, build date)
- Extraction results (filesystem type, kernel version, architecture)
- Modified files compared to known-good baseline
- Backdoor binaries discovered with reverse engineering findings
- Hardcoded credentials and unauthorized access mechanisms
- Network services and their security posture
- UEFI/BIOS integrity verification results
- Extracted IOCs (IPs, domains, file hashes, SSH keys)
- Remediation recommendations (reflash, replace, update)

关键概念

术语	定义
固件	永久存储在设备硬件（闪存、EEPROM）中的软件，控制设备的低层操作和启动过程
UEFI（统一可扩展固件接口）	取代传统 BIOS 的现代系统固件；提供启动服务、运行时服务和模块化驱动架构
SPI Flash	存储 UEFI/BIOS 固件的串行外设接口闪存芯片；可被读取和修改以实现持久化
安全启动	UEFI 功能，用于验证启动组件的数字签名，以防止启动期间执行未授权代码
SquashFS	常用于嵌入式 Linux 固件的只读压缩文件系统，可实现空间高效存储
Bootkit	感染启动过程（MBR、VBR、UEFI）的恶意软件，可在操作系统之前加载并规避操作系统级安全
固件模拟	在虚拟环境（QEMU、firmadyne）中运行提取出的固件，以便在没有物理硬件的情况下分析行为

工具与系统

• binwalk：固件分析工具，用于扫描、提取和分析固件镜像中的嵌入式文件系统与压缩数据
• UEFITool：开源 UEFI 固件镜像解析与提取工具，用于分析 UEFI 卷、模块和驱动
• chipsec：Intel 的开源平台安全评估框架，包括 SPI flash、安全启动和 UEFI 分析
• firmadyne：面向基于 Linux 的嵌入式设备的自动化固件分析与模拟平台
• Ghidra：NSA 的逆向工程工具，支持 ARM、MIPS 及其他嵌入式架构，用于固件二进制分析

常见场景

场景：调查一台被植入持久后门的路由器

背景：一台网络路由器在恢复出厂设置后仍表现出可疑行为（意外的 DNS 解析、向未知 IP 的流量）。怀疑固件级被入侵。

方法：

1. 使用 JTAG/UART 调试接口或厂商管理工具从路由器中导出固件
2. 使用 binwalk 提取文件系统，并识别 Linux 发行版和内核版本
3. 将文件哈希与厂商提供的已知良好固件镜像进行对比
4. 搜索启动脚本（rcS、inittab、crontab）中的后门条目
5. 使用 Ghidra（ARM/MIPS 架构）分析任何被修改或新增的二进制文件
6. 检查是否存在硬编码凭据、未授权的 SSH 密钥和反向 shell 脚本
7. 模拟固件以观察网络行为并识别 C2 通信

陷阱：

• 没有从实际设备导出固件（从厂商网站下载得到的是干净版本，而非被入侵的版本）
• 忽略可能挂钩系统函数的被修改共享库（.so 文件）
• 遗漏存储在主文件系统之外的固件修改（引导加载程序、配置分区）
• 没有同时检查主固件分区和备份固件分区（某些设备具有双 bank 闪存）

输出格式

FIRMWARE MALWARE ANALYSIS REPORT
===================================
Device:           NetGear R7000 Router
Firmware Version: V1.0.11.116 (modified)
Architecture:     ARM (Little Endian)
Filesystem:       SquashFS (Linux 3.4.103)
Dump Method:      UART debug console

INTEGRITY CHECK
Vendor Firmware Hash:  aaa111bbb222... (clean V1.0.11.116)
Analyzed Firmware Hash: ccc333ddd444... (MISMATCH)
Modified Files:        14 files differ from vendor baseline

BACKDOOR FINDINGS
[!] /usr/bin/httpd_backdoor (new binary, not in vendor firmware)
    Architecture: ARM 32-bit
    Function: Reverse shell to 185.220.101[.]42:4444
    Persistence: Added to /etc/init.d/rcS

[!] /etc/shadow modified
    Root password changed to known hash
    New user 'admin2' added with UID 0

[!] /etc/crontab modified
    Added: */5 * * * * /usr/bin/httpd_backdoor

[!] /root/.ssh/authorized_keys (new file)
    Contains attacker's SSH public key

EXTRACTED IOCs
C2 IP:            185.220.101[.]42
C2 Port:          4444
SSH Key:          ssh-rsa AAAA... attacker@control
Backdoor Hash:    eee555fff666...

REMEDIATION
1. Flash clean vendor firmware via TFTP recovery mode
2. Change all device credentials
3. Update to latest firmware version
4. Enable firmware integrity checking if available
5. Monitor for re-compromise indicators