English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Nowadays, IoT devices integrate a wealth of third-party components (TPCs) infirmware to shorten the development cycle. TPCs usually have strict usagespecifications, e.g., checking the return value of the function. Violating theusage specifications of TPCs can cause serious consequences, e.g., NULL pointerdereference. Therefore, this massive amount of TPC integrations, if notproperly implemented, will lead to pervasive vulnerabilities in IoT devices.Detecting vulnerabilities automatically in TPC integration is challenging fromseveral perspectives: (1) There is a gap between the high-level specificationsfrom TPC documents, and the low-level implementations in the IoT firmware. (2)IoT firmware is mostly the closed-source binary, which loses a lot ofinformation when compiling from the source code and has diverse architectures.  To address these challenges, we design and implement UVScan, an automated andscalable system to detect TPC usage violations in IoT firmware. In UVScan, wefirst propose a novel natural language processing (NLP)-based rule extractionframework, which extracts API specifications from inconsistently formatted TPCdocuments. We then design a rule-driven NLP-guided binary analysis engine,which maps the logical information from the high-level TPC document to thelow-level binary, and detects TPC usage violations in IoT firmware acrossdifferent architectures. We evaluate UVScan from four perspectives on fourpopular TPCs and six ground-truth datasets. The results show that UVScanachieves more than 70% precision and recall, and has a significant performanceimprovement compared with even the source-level API misuse detectors.

UVSCAN: Detecting Third-Party Component Usage Violations in IoT Firmware