$\mu$IPS: Software-Based Intrusion Prevention for Bare-Metal Embedded Systems

Abstract

Many embedded systems are low-cost bare-metal systems where the firmware executes directly on hardware without an OS. Bare-metal systems typically lack many security primitives, including the well-known Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP), and their integrity can be compromised using a single vulnerability. Proposed defenses have not yet been deployed due to their requirements for firmware source code availability or hardware modifications. We present $\mu$IPS, the first Intrusion Prevention System (IPS) for bare-metal systems that requires no modification to the hardware and can be applied to stripped binaries without access to the source code. $\mu$IPS enforces fine-grained control-flow protection targeting both forward and backward edges. To achieve that, $\mu$IPS introduces a novel Trusted Execution Environment (TEE) to provide memory isolation at runtime while handling the hardware limitations of bare-metal systems. $\mu$IPS also provides Remote Integrity Check (RIC) mechanism to validate the integrity of control-flow protection policies and the TEE code, and secure Over-The-Air (OTA) update mechanism to deploy the updated policies. We evaluate $\mu$IPS against ten real-world representative firmware. $\mu$IPS imposes a $31\%$ execution overhead on average on binary instrumented firmware. $\mu$IPS reduces exposure to Return-Oriented Programming (ROP) attacks by $99\%$.

Appendices

A Firmware Information

We present in Table 7 the detailed information about the real firmware used in our evaluation (Sect. 6).

Table 7. The representative set of firmware used for the evaluation of $\mu$IPS.

B Security Analysis

To demonstrate the ability of $\mu$IPS to prevent any control-flow hijacking attack, we modified the HTTP Server firmware introducing three types of memory corruption vulnerabilities: a buffer overflow [25], a format string enabling arbitrary write [33] and a stack pivot [20]. We analyze each of the three and describe how $\mu$IPS prevents the exploitation.

Buffer Overflow. A buffer overflow allows an attacker to overwrite values on the stack. The ARMv7-M architecture can store a return address either in a special register called Link Register (LR) or on the stack. Consequently, since the LR register is not memory mapped, the attacker can tamper with the execution flow by overwriting the return address only when stored on the stack. However, if the attacker succeeds, once the vulnerable function returns, the $\mu$IPS instrumentation invokes the TEE to check if the return address equals the one on top of the shadow stack. Since it has been manipulated, this check will fail, and the attack prevented. Furthermore, $\mu$IPS blocks shellcode-based buffer overflow attacks as the stack is non-executable due to the W$\oplus$X policy enforced by the MPU.

Arbitrary Write. With an arbitrary write, an attacker can precisely overwrite data on arbitrary memory locations, including the stack, flash memory, and even peripheral registers. Like buffer overflow, the attacker can overwrite the saved return address on the stack, but the attack would be detected with the $\mu$IPS shadow stack. It is also possible to overwrite the flash memory including the code regions; however, the MPU denies this operation by enforcing the W$\oplus$X policy. Additionally, the attacker may attempt to write to the memory-mapped MPU configuration registers to disable or relax the MPU policy. Still, this operation requires privileges that are never granted to potentially vulnerable firmware. An attacker may also attempt to leverage a gadget that pops an address from the stack to the LR, but such a gadget never exists because the LR is written only by branch-with-link instructions. Finally, an attacker may corrupt the exception handler data structure where registers, including the Program Counter (PC), are saved to restore the execution once an interrupt has finished. However, such an operation requires privileges that are never granted to the firmware. As a result, $\mu$IPS prevents the attack in all the presented cases.

Stack Pivot. If an attacker controls the position of the stack, e.g., through the Stack Pointer (SP) register, it can relocate it to point to a buffer it controls so that, once the function returns, it pops the return address from the stack. This attack assumes that the return address is stored on the stack, not in the LR. However, the $\mu$IPS instrumentation invokes the TEE to validate the return address with the one on top of the shadow stack. Since the two values differ, $\mu$IPS prevents the attack.