Abstract:

With the widespread deployment of internet of things （IoT） devices, chip vulnerabilities become critical threats to device security. Existing approaches primarily focus on detecting vulnerabilities, while overlooking validating the exploitability of vulnerability, resulting in the problem of false positives. To address this problem, this paper proposes a model-based method for chip vulnerability analysis. The method integrates device models with vulnerability detection data to uncover potential attack chains, and constructs hybrid state machine models representing both device and attacker behaviors to simulate real-world attack scenarios according to kombination of architecture model specificAtion （KARMA）. By conducting behavioral simulation, the method evaluates whether the system exhibits abnormal behavior to determine the exploitability of the detected vulnerability. Experiments using a smart home system as a case study demonstrate the exploitability of the global positioning system （GPS） chip vulnerability in the phone within the system. Furthermore, the vulnerability is successfully exploited in a real-world environment to crash the mobile device, verifying the effectiveness of the proposed method.

Key words: vulnerability validation, hybrid automata, model simulation, kombination of architecture model specificAtion (KARMA)