FuzzyBin: Enhanced Border Binary Identification by Leveraging Fuzzy Hashing Algorithms

The rapid growth of IoT devices has led to the development of various methods to analyze firmware vulnerabilities and uncover potential security risks. One promising approach is to focus on binaries exploited as attack vectors, particularly those that handle user input, referred to as border binaries. However, existing methods often depend on narrowly defined identification rules. Consequently, they may fail to detect binaries that handle user input but lie outside the scope of these rules, resulting in overlooked vulnerabilities. In this paper, we introduce FuzzyBin, a novel approach for the comprehensive identification of border binaries. The key insight behind FuzzyBin is that border binaries share execution logic with well-known web server binaries. Building on this observation, FuzzyBin systematically identifies border binaries by examining their similarity to web server binaries. Specifically, FuzzyBin employs fuzzy hashing as a powerful technique for similarity analysis. Additionally, it incorporates a function filtering mechanism to focus on the primary functions within each binary, thereby enhancing detection accuracy. We evaluate FuzzyBin on 13 firmware samples from various vendors, demonstrating its superior detection coverage and processing time compared to state-of-the-art tools.