<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= '//www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-W99KGHJ');</script> Future Tech Pavilion, FUTEX < <script type="text/javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/gohappy/lanrenzhijia.js"></script> __> <script language="javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/ij-ajax/ij-ajax.js"></script> <script language="javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/dojo-ajax/dojo.js"></script> <script language="javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/ij-ajax/_ij_package.js"></script> <script language="javascript"> var IJ = new IJ("https://www.futuretech.org.tw/futuretech/javascripts/ij-ajax/"); /* IJ.loadJs();*/ var menu_move_x = 0; /**/ var menu_move_y = 0; /**/ </script> <script src="https://www.futuretech.org.tw/futuretech/javascripts/jquery/jquery.min.js"></script> <script type="text/javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/jquery.flexslider-min.js"></script> <script type="text/javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/jquery.imagezoom.min.js"></script> <script type="text/javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/owl.carousel.min-2.0.js"></script> <script type="text/javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/slick.min.js"></script> <script type="text/javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/jquery.countdown.min.js"></script> <script type="text/javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/imagesloaded.pkgd.js"></script> <script type="text/javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/swiper.min.js" type="text/javascript"></script> <script type="text/javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/snap.min.js"></script> <script language="javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/timer/jquery.timer.js"></script> <script language="javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/jquery/fancybox/dist/jquery.fancybox.min.js"></script> <script type="text/javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/jquery.countdown.min.js"></script> __> 購物車__> 購物車NEW__> 商品頁樣式2__> <script src="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js" integrity="sha384-JjSmVgyd0p3pXB1rRibZUAYoIIy6OrQ6VrjIEaFf/nJGzIxFDsf4x0xIM+B07jRM" crossorigin="anonymous"></script> <script type="text/javascript" src="https://www.futuretech.org.tw/futuretech/templates/web_style/futuretech_2023/color_1/js/jquery.flexslider-min.js"></script> <script> /**/ window.is_login = 81882; /**/ window.ajax = { key:1, default_setting:{type:'POST', dataType:'json', crossDomain:true, withCredentials:true, async:true}, ajax_trans:function(){if(window.ajax.key == 1){key = 0;return true;}else return false;}, ajax_commit:function(){window.ajax.key == 1}, ajax_connect:function(){ var ajax_this = this; $.ajax({ url:ajax_this.url, type:ajax_this.type, async:ajax_this.async, dataType:ajax_this.dataType, data:{params:ajax_this.params}, crossDomain: ajax_this.crossDomain, xhrFields:{ withCredentials: ajax_this.withCredentials }, beforeSend:function(){ if(!window.ajax.ajax_trans())return false; }, success:function(r){ try{ ajax_this.ajax_access_response(r); }catch(e){ alert('驗證有誤,請稍後再試或洽詢客服。'); } }, error:function(e){ alert("伺服器請求錯誤,請稍後再試。"); }, complete:function(e){ window.ajax.ajax_commit(); } }); } } </script> <script src="./javascripts/jquery/jquery-ui.min.js"></script> <script src="javascripts/imagesloaded.pkgd.js"></script> <script async src="https://www.googletagmanager.com/gtag/js?id=UA-150655771-1"></script> <script> window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'UA-150655771-1'); </script> <script> $(document).ready(function() { var strJson = {'list':'~^(www.)?futuretech.org.tw/futuretech/index.php'}; $.ajax({ url:'api/api.save_google_analytics_data.php', type:'post', dataType:'text', async:false, data:{type:'9',data:strJson, referer_url:''} }); }); </script> <script> function ga_onProductClick(event, p_no, p_name, p_url, p_witem_uid) { var viewportwidth; var viewportheight; if (typeof window.innerWidth != 'undefined'){ viewportwidth = window.innerWidth, viewportheight = window.innerHeight } else if (typeof document.documentElement != 'undefined' && typeof document.documentElement.clientWidth !='undefined' && document.documentElement.clientWidth != 0) { viewportwidth = document.documentElement.clientWidth, viewportheight = document.documentElement.clientHeight }else { viewportwidth = document.getElementsByTagName('body')[0].clientWidth, viewportheight = document.getElementsByTagName('body')[0].clientHeight } /*點擊座標*/ var evt = event ? event : (window.event ? window.event : null); if (document.all) /*IE*/ { var click_x = event.x ; /* 取得滑鼠指標目前的 x 位置*/ var click_y = event.y ; /* 取得滑鼠指標目前的 y 位置*/ } else /* firefox*/ { var click_x = evt.clientX; /* 取得滑鼠指標目前的 x 位置*/ var click_y = evt.clientY; /* 取得滑鼠指標目前的 y 位置*/ } var screen_w = screen.width; var screen_h = screen.height; var _witem_uid = p_witem_uid || ''; var strJson = {'id':p_no, 'name':p_name, 'list':'~^(www.)?futuretech.org.tw/futuretech/index.php', 'click_x':click_x, 'click_y':click_y, 'window_w':viewportwidth, 'window_h':viewportheight, 'screen_w':screen_w, 'screen_h':screen_h}; $.ajax({ url:'api/api.save_google_analytics_data.php', type:'post', dataType:'text', async:false, data:{type:'3',witem_uid:_witem_uid, data:strJson, referer_url:''} }); gtag('event', 'select_content', { "content_type": "product", "items": [ { "id": p_no, "name": p_name, "list_name": "~^(www.)?futuretech.org.tw/futuretech/index.php" } ],"event_callback": function() {document.location = p_url; } }); } </script> <script> var metaData = { web_uid: 87, event_source_url: 'https://www.futuretech.org.tw/futuretech/index.php?action=index', client_ip_address: '118.166.192.56', client_user_agent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36', fbp: 'fb.2.1723443724963.969316202948810603', member: { em: 'alma@ewebs.com.tw', fn: '曹曹', ph: '886919909005', ge: 'm', db: '19700101', ct: '', } }; !function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod? n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n; n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0; t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window, document,'script','https://connect.facebook.net/en_US/fbevents.js'); fbq('init', '2971107439788057', { em: 'alma@ewebs.com.tw', fn: '曹曹', ph: '886919909005', ge: 'm', db: '19700101', }); fbq('track', 'PageView'); </script> <script> function fb_AddToCart(prodNo, value, contents) { value = parseInt(value); if (prodNo && value > 0) { var content_ids = []; content_ids.push(prodNo); var obj = { content_ids: content_ids, content_type: 'product', value: value, currency: 'TWD' }; if (typeof contents != undefined) obj.contents = contents; fbq('track', 'AddToCart', obj); metaData.event_name = 'AddToCart'; metaData.custom_data = obj; console.log('AddToCart - metaData',metaData); $.ajax({ url: 'https://futuretech.org.tw/website/api/api.meta_conversions_api.php', type: 'POST', dataType: 'json', data: { metaData:metaData, nti_eSVCQyVCMiU3RSVCOSVCNyVCMSVCMyVBOSVCRSVBQyVBQiVCMyVCQyVBQiVBRCVCMyVCNSVCQSVBQyVCRCVBRCVCQyVCNCVBQng:'MTcyODAxMTc0N3Z4MnR0M1E1dkQyeUVVV29VWXFUWnJLekFRUXhCUUJx' }, success: function(r){ console.log('AddToCart-suc',r); }, error: function(r){ console.log('AddToCart-err',r); } }); } } </script> <script> function fb_AddToWishlist(prodNo, value) { value = parseInt(value); if (prodNo && value > 0) { var content_ids = []; content_ids.push(prodNo); var obj = { content_ids: content_ids, content_type: 'product', value: value, currency: 'TWD' }; fbq('track', 'AddToWishlist', obj); metaData.event_name = 'AddToWishlist'; metaData.custom_data = obj; console.log('AddToWishlist - metaData',metaData); $.ajax({ url: 'https://futuretech.org.tw/website/api/api.meta_conversions_api.php', type: 'POST', dataType: 'json', data: { metaData:metaData, nti_eSVCQyVCMiU3RSVCOSVCNyVCMSVCMyVBOSVCRSVBQyVBQiVCMyVCQyVBQiVBRCVCMyVCNSVCQSVBQyVCRCVBRCVCQyVCNCVBQng:'MTcyODAxMTc0N3Z4MnR0M1E1dkQyeUVVV29VWXFUWnJLekFRUXhCUUJx' }, success: function(r){ console.log('AddToWishlist-suc',r); }, error: function(r){ console.log('AddToWishlist-err',r); } }); } } </script> <script> function fb_CompleteRegistration() { var obj = { currency:'TWD' }; fbq('track', 'CompleteRegistration', obj); metaData.event_name = 'CompleteRegistration'; metaData.custom_data = obj; console.log('CompleteRegistration - metaData',metaData); $.ajax({ url: 'https://futuretech.org.tw/website/api/api.meta_conversions_api.php', type: 'POST', dataType: 'json', data: { metaData:metaData, nti_eSVCQyVCMiU3RSVCOSVCNyVCMSVCMyVBOSVCRSVBQyVBQiVCMyVCQyVBQiVBRCVCMyVCNSVCQSVBQyVCRCVBRCVCQyVCNCVBQng:'MTcyODAxMTc0N3Z4MnR0M1E1dkQyeUVVV29VWXFUWnJLekFRUXhCUUJx' }, success: function(r){ console.log('CompleteRegistration-suc',r); }, error: function(r){ console.log('CompleteRegistration-err',r); } }); } </script> <script> function fb_Lead() { var obj = { currency:'TWD', value:'' }; fbq('track', 'Lead', obj); metaData.event_name = 'Lead'; metaData.custom_data = obj; console.log('Lead - metaData',metaData); $.ajax({ url: 'https://futuretech.org.tw/website/api/api.meta_conversions_api.php', type: 'POST', dataType: 'json', data: { metaData:metaData, nti_eSVCQyVCMiU3RSVCOSVCNyVCMSVCMyVBOSVCRSVBQyVBQiVCMyVCQyVBQiVBRCVCMyVCNSVCQSVBQyVCRCVBRCVCQyVCNCVBQng:'MTcyODAxMTc0N3Z4MnR0M1E1dkQyeUVVV29VWXFUWnJLekFRUXhCUUJx' }, success: function(r){ console.log('Lead-suc',r); }, error: function(r){ console.log('Lead-err',r); } }); } </script> <script> function fb_ViewContent(prodNo, value, content_name) { var content_ids = []; content_ids.push(prodNo); var obj = { content_ids: content_ids, content_type: 'product', content_name: content_name, value: value, currency: 'TWD' }; fbq('track', 'ViewContent', obj); metaData.event_name = 'ViewContent'; metaData.custom_data = obj; console.log('ViewContent - metaData',metaData); $.ajax({ url: 'https://futuretech.org.tw/website/api/api.meta_conversions_api.php', type: 'POST', dataType: 'json', data: { metaData:metaData, nti_eSVCQyVCMiU3RSVCOSVCNyVCMSVCMyVBOSVCRSVBQyVBQiVCMyVCQyVBQiVBRCVCMyVCNSVCQSVBQyVCRCVBRCVCQyVCNCVBQng:'MTcyODAxMTc0N3Z4MnR0M1E1dkQyeUVVV29VWXFUWnJLekFRUXhCUUJx' }, success: function(r){ console.log('ViewContent-suc',r); }, error: function(r){ console.log('ViewContent-err',r); } }); } </script> <script> function fb_Search(prod_keyword, str_content_ids) { var obj = { content_ids: str_content_ids, content_type: 'product', search_string: prod_keyword }; fbq('track', 'Search', obj); metaData.event_name = 'Search'; metaData.custom_data = obj; console.log('Search - metaData',metaData); $.ajax({ url: 'https://futuretech.org.tw/website/api/api.meta_conversions_api.php', type: 'POST', dataType: 'json', data: { metaData:metaData, nti_eSVCQyVCMiU3RSVCOSVCNyVCMSVCMyVBOSVCRSVBQyVBQiVCMyVCQyVBQiVBRCVCMyVCNSVCQSVBQyVCRCVBRCVCQyVCNCVBQng:'MTcyODAxMTc0N3Z4MnR0M1E1dkQyeUVVV29VWXFUWnJLekFRUXhCUUJx' }, success: function(r){ console.log('Search-suc',r); }, error: function(r){ console.log('Search-err',r); } }); } </script> <script type="application/ld+json"> { "@context":"https://schema.org", "@type":"Corporation", "brand":"", "alternateName":"Future Tech Pavilion, FUTEX", "url":"https://www.futuretech.org.tw/futuretech", "logo":"", "contactPoint":[{ "@type":"ContactPoint", "telephone":"", "contactType":"bill payment", "contactOption":"TollFree", "areaServed":"TW" }] } </script> <script type="text/javascript" src="https://www.futuretech.org.tw/futuretech/javascripts/jquery/jquery.cookie.js"></script> <script> let isIOS = /iPad|iPhone|iPod/.test(navigator.platform) || (navigator.platform === 'MacIntel' && navigator.maxTouchPoints > 1) pad_show_type = 'web'; mobileDeviceDirected = ''; forceDevice = ''; if(isIOS && pad_show_type =='mobile' && !mobileDeviceDirected && location.href.indexOf("forceDevice=mobile") < 0 && forceDevice != 'web'){ url = location.href; if( url.indexOf("?") >= 0 ){ url = url+'&forceDevice=mobile'; }else{ url = url+'?forceDevice=mobile'; } window.location.href = url; } </script>
Technical Name Security Testbed for Commercial IoT Devices Using Firmware Inspection and Hardware Emulation
Project Operator Taiwan Information Security Center of National Taiwan University of Science and Technology
Project Host 鄭欣明
Summary
When we examine COTS IoT devices with various kinds of hardware architectures, we need to connect the IoT devices with a particular security tester physically using debug interface, which is inconvenient, unscalable, and inefficient. To resolve this issue, we build an automatic IoT security testbed, which operates firmware of COTS IoT devices in the compatible system with emulated IoT architectures. 

We utilize the opensource QEMU to emulate the hardware architectures, such as ARM, X86, and MIPS, for various kinds of COTS IoT firmware. Currently we can successfully operate COTS IoT firmware from Zyxel, CISCO, Dlink, and Netgear on top of our testbed and exploit the developed vulnerability testing tool to examine those softwarized COTS IoT firmware simultaneously. The testbed could discover many potential vulnerabilities from the firmwares and generate a testing report for researchers and engineers to evaluate the effectiveness of their proposed IoT operations and products.
Scientific Breakthrough
The existing commercial security testbeds, such as very famous IoT Inspector, are focus on the static analysis of the source code of the IoT devices. However, for those companies who want to test their product, revealing source code is risky and offering firmware binary is more reasonable. Moreover, by performing the firmware on the emulated system, our testbed could precisely trigger the suspicious file, capture the malicious behavior of the operation, and discover logic flaws, unknown and zero-day threats. The main breakthrough of this testbed is that we successfully operate 661 COTS firmwares (with brand Dlink, Zyxel, Netgear) on the emulated hardware architectures, such as ARM, X86, and MIPS. By exploiting public vulnerability testing tools, we found 115 vulnerable COTS IoT firmwares.
Industrial Applicability
For those IoT developing company without stronger security team, our testbed could offer an extensive vulnerability testing to their developed product and a corresponding testing report. The development teams could patch the vulnerabilities accordingly and make sure the product on the market is not vulnerable. For the company with individual security team, the testbed could be cooperated in the produce development cycle where the engineers could leverage this tool to examine the prototype of the product directly and fix the potential bugs in the next version. In both cases, the testbed improves the development quality from the perspective of security and significantly reduce the high cost of handling hacked or intruded IoT devices.
Keyword Commercial IoT device Device Virtualization Dynamic analysis Firmware inspection Fuzzing Hardware emulation IoT malware IoT security security testbed vulnerability testing
Notes
  • Contact
other people also saw