Granted Patent B1

US 12,450,359 · App. 17/837,293 · Granted Oct 21, 2025

Inventors: Ang Cui (New York, NY); Salvatore J. Stolfo (New York, NY)

Assignee: RED BALLOON SECURITY, INC.

G06F21/577G06F8/65G06F21/54G06F2221/033

Abstract

Claims (69)

1. A system for embedded device vulnerability identification and mitigation, comprising:

one or more hardware processors; and

a non-transitory machine-readable storage medium encoded with instructions executable by the one or more hardware processors to perform operations comprising:

injecting at least one security software component into a firmware binary to create a monitored firmware binary;

loading the monitored firmware binary into an embedded device;

collecting live forensic information related to the monitored firmware binary via the injected at least one security software component;

detecting, by the injected at least one security software component, an unauthorized modification to the monitored firmware binary based on the live forensic information and static analysis data, the static analysis data comprising data generated by one or more static analysis techniques before operation of the firmware binary, wherein the unauthorized modification to the monitored firmware binary comprises an unauthorized modification of at least one in memory data item acted upon by one or more functions of the modified firmware binary;

based on the detected unauthorized modification, identifying one or more areas within the monitored firmware binary; and

modifying the identified one or more areas within the monitored firmware binary while the monitored firmware binary is running to create a hardened firmware binary that limits the identified one or more areas within the monitored firmware binary to a reduced set of operating software functions selected to reduce the number of attack vectors available to an attacker based on a given configuration for the embedded device, the modifying comprising one or more of deactivating code strings in the identified one or more areas within the firmware binary, or removing code strings in the identified one or more areas within the firmware binary.

2. The system of claim 1 , wherein injecting the at least one security software component comprises:

identifying one or more injection points within the firmware binary;

randomly selecting at least one injection point; and

injecting the at least one security software component into the randomly selected at least one injection point.

3. The system of claim 1 , wherein the at least one security software component is further designed to gather a plurality of contextual information regarding the detected unauthorized modification.

4. The system of claim 3 , wherein the plurality of contextual information includes one or more of: a path of exploitation; identification of the at least one in memory data item; and identification of one or more functions of the modified firmware binary.

5. The system of claim 1 , wherein the embedded device is deployed within a network of a plurality of embedded devices, the operations further comprising: distributing to the plurality of embedded devices one or more security modifications associated with creating the hardened firmware binary, or commands to create the one or more security modifications.

6. The system of claim 1 , wherein injecting the at least one security software component occurs when the embedded device is in an offline state.

7. The system of claim 1 , the operations further comprising:

collecting a plurality of live forensic information related to the hardened firmware binary via at least one forensic component included within the hardened firmware binary;

aggregating the plurality of live forensic information and static analysis data generated by one or more static analysis techniques applied to the hardened firmware binary;

identifying one or more vulnerabilities within the hardened firmware binary based on the aggregated live forensic information and the static analysis data;

determining one or more additional security modifications based on the identified vulnerabilities; and

modifying the hardened firmware binary utilizing the determined one or more additional security modifications.

8. The system of claim 1 , wherein the modifying comprises deactivating code strings in the identified one or more areas within the firmware binary.

9. The system of claim 1 , wherein the modifying comprises removing code strings in the identified one or more areas within the firmware binary.

10. The system of claim 1 , wherein the modifying further comprises:

obfuscating code strings in the identified one or more areas within the firmware binary.

11. A non-transitory machine-readable storage medium encoded with instructions executable by one or more hardware processors of a computing component for embedded device vulnerability identification and mitigation, the machine-readable storage medium comprising instructions to cause the one or more hardware processors to perform operations comprising:

injecting at least one security software component into a firmware binary to create a monitored firmware binary;

loading the monitored firmware binary into an embedded device;

collecting live forensic information related to the monitored firmware binary via the injected at least one security software component;

detecting, by the injected at least one security software component, an unauthorized modification to the monitored firmware binary based on the live forensic information and static analysis data, the static analysis data comprising data generated by one or more static analysis techniques before operation of the firmware binary, wherein the unauthorized modification to the monitored firmware binary comprises an unauthorized modification of at least one in memory data item acted upon by one or more functions of the modified firmware binary;

based on the detected unauthorized modification, identifying one or more areas within the monitored firmware binary; and

modifying the identified one or more areas within the monitored firmware binary while the monitored firmware binary is running to create a hardened firmware binary that limits the identified one or more areas within the monitored firmware binary to a reduced set of operating software functions selected to reduce the number of attack vectors available to an attacker based on a given configuration for the embedded device, the modifying comprising one or more of deactivating code strings in the identified one or more areas within the firmware binary, or removing code strings in the identified one or more areas within the firmware binary.

12. The medium of claim 11 , wherein injecting the at least one security software component comprises:

identifying one or more injection points within the firmware binary;

randomly selecting at least one injection point; and

injecting the at least one security software component into the randomly selected at least one injection point.

13. The medium of claim 11 , wherein the at least one security software component is further designed to gather a plurality of contextual information regarding the detected unauthorized modification.

14. The medium of claim 13 , wherein the plurality of contextual information includes one or more of: a path of exploitation; identification of the at least one in memory data item; and identification of one or more functions of the modified firmware binary.

15. The medium of claim 11 , wherein the embedded device is deployed within a network of a plurality of embedded devices, the operations further comprising: distributing to the plurality of embedded devices one or more security modifications associated with creating the hardened firmware binary, or commands to create the one or more security modifications.

16. The medium of claim 11 , wherein injecting the at least one security software component occurs when the embedded device is in an offline state.

17. The medium of claim 11 , the operations further comprising:

collecting a plurality of live forensic information related to the hardened firmware binary via at least one forensic component included within the hardened firmware binary;

aggregating the plurality of live forensic information and static analysis data generated by one or more static analysis techniques applied to the hardened firmware binary;

identifying one or more vulnerabilities within the hardened firmware binary based on the aggregated live forensic information and the static analysis data;

determining one or more additional security modifications based on the identified vulnerabilities; and

modifying the hardened firmware binary utilizing the determined one or more additional security modifications.

18. A method of embedded device vulnerability identification and mitigation, comprising:

injecting at least one security software component into a firmware binary to create a monitored firmware binary;

loading the monitored firmware binary into an embedded device;

collecting live forensic information related to the monitored firmware binary via the injected at least one security software component;

detecting, by the injected at least one security software component, an unauthorized modification to the monitored firmware binary based on the live forensic information and static analysis data, the static analysis data comprising data generated by one or more static analysis techniques before operation of the firmware binary, wherein the unauthorized modification to the monitored firmware binary comprises an unauthorized modification of at least one in memory data item acted upon by one or more functions of the modified firmware binary;

based on the detected unauthorized modification, identifying one or more areas within the monitored firmware binary; and

modifying the identified one or more areas within the monitored firmware binary while the monitored firmware binary is running to create a hardened firmware binary that limits the identified one or more areas within the monitored firmware binary to a reduced set of operating software functions selected to reduce the number of attack vectors available to an attacker based on a given configuration for the embedded device, the modifying comprising one or more of deactivating code strings in the identified one or more areas within the firmware binary, or removing code strings in the identified one or more areas within the firmware binary.

19. The method of claim 18 , wherein injecting the at least one security software component comprises:

identifying one or more injection points within the firmware binary;

randomly selecting at least one injection point; and

injecting the at least one security software component into the randomly selected at least one injection point.

20. The method of claim 18 , wherein the at least one security software component is further designed to gather a plurality of contextual information regarding the detected unauthorized modification.

21. The method of claim 20 , wherein the plurality of contextual information includes one or more of: a path of exploitation; identification of the at least one in memory data item; and identification of one or more functions of the modified firmware binary.

22. The method of claim 18 , wherein the embedded device is deployed within a network of a plurality of embedded devices, the method further comprising: distributing to the plurality of embedded devices one or more security modifications associated with creating the hardened firmware binary, or commands to create the one or more security modifications.

23. The method of claim 18 , wherein injecting the at least one security software component occurs when the embedded device is in an offline state.

24. The method of claim 18 , further comprising:

collecting a plurality of live forensic information related to the hardened firmware binary via at least one forensic component included within the hardened firmware binary;

aggregating the plurality of live forensic information and static analysis data generated by one or more static analysis techniques applied to the hardened firmware binary;

identifying one or more vulnerabilities within the hardened firmware binary based on the aggregated live forensic information and the static analysis data;

determining one or more additional security modifications based on the identified vulnerabilities; and

modifying the hardened firmware binary utilizing the determined one or more additional security modifications.

Assignments (1)

Continuity (5)

References Cited (400)