Search for: All records

As IoT devices with microcontroller (MCU)-based firmware become more common in our lives, memory corruption vulnerabilities in their firmware are increasingly targeted by adversaries. Fuzzing is a powerful method for detecting these vulnerabilities, but it poses unique challenges when applied to IoT devices. Direct fuzzing on these devices is inefficient, and recent efforts have shifted towards creating emulation environments for dynamic firmware testing. However, unlike traditional software, firmware interactions with peripherals that are significantly more diverse presents new challenges for achieving scalable full-system emulation and effective fuzzing. This paper reviews 27 state-of-the-art works in MCU-based firmware emulation and its applications in fuzzing. Instead of classifying existing techniques based on their capabilities and features, we first identify the fundamental challenges faced by firmware emulation and fuzzing. We then revisit recent studies, organizing them according to the specific challenges they address, and discussing how each specific challenge is addressed. We compare the emulation fidelity and bug detection capabilities of various techniques to clearly demonstrate their strengths and weaknesses, aiding users in selecting or combining tools to meet their needs. Finally, we highlight the remaining technical gaps and point out important future research directions in firmware emulation and fuzzing. 

To study the security properties of the Internet of Things (IoT), firmware analysis is crucial. In the past, many works have been focused on analyzing Linux-based firmware. Less known is the security landscape of MCU-based IoT devices, an essential portion of the IoT ecosystem. Existing works on MCU firmware analysis either leverage the companion mobile apps to infer the security properties of the firmware (thus unable to collect low-level properties) or rely on small-scale firmware datasets collected in ad-hoc ways (thus cannot be generalized). To fill this gap, we create a large dataset of MCU firmware for real IoT devices. Our approach statically analyzes how MCU firmware is distributed and then captures the firmware. To reliably recognize the firmware, we develop a firmware signature database, which can match the footprints left in the firmware compilation and packing process. In total, we obtained 8,432 confirmed firmware images (3,692 unique) covering at least 11 chip vendors across 7 known architectures and 2 proprietary architectures. We also conducted a series of static analyses to assess the security properties of this dataset. The result reveals three disconcerting facts: 1) the lack of firmware protection, 2) the existence of N-day vulnerabilities, and 3) the rare adoption of security mitigation. 

Abstract Due to their diverse potential in advanced electronics and energy technologies, electrically conducting metal‐organic frameworks (MOFs) are drawing significant attention. Although hexagonal 2D MOFs generally display impressive electrical conductivity because of their dual in‐plane (through bonds) and out‐of‐plane (through π‐stacked ligands) charge transport pathways, notable differences between these two orthogonal conduction routes cause anisotropic conductivity and lower bulk conductivity. To address this issue, we have developed the first redox‐complementary dual‐ligand 2D MOF Cu₃(HHTP)(HHTQ), featuring a π‐donor hexahydroxytriphenylene (HHTP) ligand and a π‐acceptor hexahydroxytricycloquinazoline (HHTQ) ligand located at alternate corners of the hexagons, which form either parallel HHTP and HHTQ stacks (AA stacking) or alternating HHTP/HHTQ stacks (AB stacking) along the c‐axis. Regardless of the stacking pattern, Cu₃(HHTP)(HHTQ) supports more effective out‐of‐plane conduction through either separate π‐donor and π‐acceptor stacks or alternating π‐donor/acceptor stacks, while promoting in‐plane conduction through the pushpull‐like heteroleptic coordination network. As a result, Cu₃(HHTP)(HHTQ) exhibits higher bulk conductivity (0.12 S/m at 295 K) than single‐ligand MOFs Cu₃(HHTP)₂(7.3 × 10⁻²S/m) and Cu₃(HHTQ)₂(5.9 × 10⁻⁴S/m). This work introduces a new design approach to improve the bulk electrical conductivity of 2D MOFs by supporting charge transport in both in‐ and out‐of‐plane direcations. 

Calcium–alumino–silicate–hydrate (CaO–Al2O3–SiO2–H2O, or C–A–S–H) gel, which is the binding phase of cement-based materials, greatly influences concrete mechanical properties and durability. However, the atomic-scale kinetics of the aluminosilicate network condensation remains puzzling. Here, based on reactive molecular dynamics simulations of C–A–S–H systems formation with varying Al/Ca molar ratios, we study the kinetic mechanism of the hydrated aluminosilicate gels upon precipitation. We show that the condensation activation energy decreases with the Al/Ca molar ratio, which suggests that the concentration of the Al polytopes has a great effect on controlling the kinetics of the gelation reaction. Significantly, we demonstrate that 5-fold Al atoms are mainly forming at high Al/Ca molar ratios since there are insufficient hydrogen cations or extra calcium cations to compensate the negatively charged Al polytopes at high Al/Ca molar ratios during accelerated aging.