Detection of Plaintext Login Information in Firmware

Many devices with firmware such as the Internet of Things (IoT) provides high levels of convenience, but it introduces the risk of private data leakage. There were reports of some firmware containing hardcoded login information that allows anybody to login to the firmware via the Internet. In this study, we propose a method to detect the user input function and the value comparison function between the user input value and the embedded string for firmware. Finding the user-input function is a very important method because it plays a major role in detecting vulnerabilities in firmware. When an attacker attempts to log in to an IoT device, they enter a password equivalent to the firmware's embedded password, such as strcmp(“password”, user_input_value). In our experiments, we applied our method to 226 real product binaries. As a result, we found two programs that were communicating IDs and passwords in plain text. To the best of our knowledge, both cases have not been reported yet.