Unveiling firmware weaknesses: An approach for large-scale security analysis

The COVID-19 pandemic has driven widespread adoption of remote work, altering corporate network perimeters to include Small-Office and Home-Office (SOHO) Routers and exposing infrastructures to IoT threats. We researched and developed a scalable vulnerability analysis method for embedded systems, focusing on vulnerability enumeration and automated source code analysis. In Brazil, we studied 159 router models, obtaining firmware samples from 131. Our analysis revealed more vulnerabilities in official firmware compared to open-source versions, highlighting the security benefits of the latter. Using Binary Code Similarity Analysis (BCSA), we created BinclustRE, a tool for grouping similar binaries to prioritize impactful firmware samples analysis.