Enhancing Large-Scale Vulnerability Analysis in Wi-Fi Routers: towards developing an integrated framework

Abstract

In this dissertation, we investigate cybersecurity in Wi-Fi routers, an area of rising importance due to the exponential increase of IoT devices and their significance in connecting these devices to the Internet. Our study is motivated by a notable growth in the interest of malicious agents in these devices, evidenced by increased cyberattacks, particularly during critical times such as the COVID-19 pandemic. Additionally, we observe an increase in cybersecurity regulations and strategies in Brazil, emphasizing the need to strengthen cybersecurity measures. We conduct a systematic literature review to establish the state of the art in our research domain, comparing twelve related works and highlighting the main features of each methodology. The works explore the implementation of static and dynamic analysis techniques for vulnerability detection. However, we identify gaps for contribution related to the validation of previously reported vulnerabilities and indications of failures identified by source code analyzers. In this work, we direct our efforts toward identifying vulnerabilities in Wi-Fi router firmware images, emphasizing the analysis of the administration interface provided by the embedded web server. We develop and refine an integrated framework that uses specialized tools in static and dynamic analysis and enables the emulation of firmware images without the need for physical hardware access. Among the integrated tools, Semgrep stands out for static analysis; Nuclei, aimed at dynamic analysis; and FirmAE, which able firmware emulation. Our findings highlight the need for policy changes and better practices in the production and maintenance of Wi-Fi routers, benefiting both suppliers and end-users. We have developed a scalable and adaptable methodology for large-scale cybersecurity assessments, combining automated scans with manual analysis, which allowed us to create 58 new templates for the Nuclei tool and identify three new vulnerabilities CVE-2022- 46552, CVE-2023-6580, and CVE-2024-0769.