{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,20]],"date-time":"2026-01-20T16:37:41Z","timestamp":1768927061581,"version":"3.49.0"},"reference-count":34,"publisher":"Springer Science and Business Media LLC","issue":"3-4","license":[{"start":{"date-parts":[[2022,7,15]],"date-time":"2022-07-15T00:00:00Z","timestamp":1657843200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2022,7,15]],"date-time":"2022-07-15T00:00:00Z","timestamp":1657843200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100002347","name":"Bundesministerium f\u00fcr Bildung und Forschung","doi-asserted-by":"publisher","award":["01IS18065E"],"award-info":[{"award-number":["01IS18065E"]}],"id":[{"id":"10.13039\/501100002347","id-type":"DOI","asserted-by":"publisher"}]},{"name":"IHP GmbH \u2013 Leibniz-Institut f\u00fcr innovative Mikroelektronik"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Ann. Telecommun."],"published-print":{"date-parts":[[2023,4]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Code-reuse attacks pose a threat to embedded devices since they are able to defeat common security defences such as non-executable stacks. To succeed in his code-reuse attack, the attacker has to gain knowledge of some or all of the instructions of the target firmware\/software. In case of a bare metal firmware that is protected from being dumped out of a device, it is hard to know the running instructions of the target firmware. This consequently makes code-reuse attacks more difficult to achieve. This paper presents a novel approach how an attacker can gain knowledge of some of these instructions by sniffing unencrypted incremental updates. These updates exist to reduce the radio reception power for resource-constrained devices. It will be demonstrated how a return-oriented programming (ROP) attack can be accomplished on a MSP430 MCU using only the passively sniffed incremental updates. The generated updates of the R3diff and Delta Generator (DG) differencing algorithms will be under assessment. The evaluation reveals that both of them can be exploited by the attacker and how an attacker can maximize his information gain when dealing with more than one update. It also shows that the DG generated updates leak more information than the R3diff generated updates. This stresses the fact that even delta updates need to be protected with encryption. To defend against this attack, different countermeasures that consider different power consumption scenarios are proposed, but yet to be evaluated.<\/jats:p>","DOI":"10.1007\/s12243-022-00917-8","type":"journal-article","created":{"date-parts":[[2022,7,15]],"date-time":"2022-07-15T16:04:27Z","timestamp":1657901067000},"page":"209-220","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["Finding gadgets in incremental code updates for return-oriented programming attacks on resource-constrained devices"],"prefix":"10.1007","volume":"78","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3274-2469","authenticated-orcid":false,"given":"Kai","family":"Lehniger","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Abdelaziz","family":"Saad","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Peter","family":"Langend\u00f6rfer","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2022,7,15]]},"reference":[{"key":"917_CR1","doi-asserted-by":"publisher","unstructured":"Dong W, Mo B, Huang C, Liu Y, Chen C (2013) R3: Optimizing relocatable code for efficient reprogramming in networked embedded systems. In: 2013 Proceedings IEEE INFOCOM, pp 315\u2013319. https:\/\/doi.org\/10.1109\/INFCOM.2013.6566786","DOI":"10.1109\/INFCOM.2013.6566786"},{"key":"917_CR2","doi-asserted-by":"publisher","unstructured":"Kachman O, Balaz M (2016) Optimized differencing algorithm for firmware updates of low-power devices. In: 2016 IEEE 19Th international symposium on design and diagnostics of electronic circuits systems (DDECS), pp 1\u20134. https:\/\/doi.org\/10.1109\/DDECS.2016.7482473","DOI":"10.1109\/DDECS.2016.7482473"},{"key":"917_CR3","doi-asserted-by":"publisher","first-page":"71907","DOI":"10.1109\/ACCESS.2019.2919760","volume":"7","author":"K Zandberg","year":"2019","unstructured":"Zandberg K, Schleiser K, Acosta F, Tschofenig H, Baccelli E (2019) Secure firmware updates for constrained iot devices using open standards: a reality check. IEEE Access 7:71907\u201371920","journal-title":"IEEE Access"},{"key":"917_CR4","unstructured":"A Firmware Update Architecture for Internet of Things.\u00a0https:\/\/tools.ietf.org\/html\/draft-ietf-suit-architecture-16. Accessed 14 July 2022\u00a0"},{"key":"917_CR5","doi-asserted-by":"publisher","unstructured":"AbdElaal ASA, Lehniger K, Langend\u00f6rfer P (2021) Incremental code updates exploitation as a basis for return oriented programming attacks on resource-constrained devices. In: 2021 5Th cyber security in networking conference (CSNet), pp 55\u201362. https:\/\/doi.org\/10.1109\/CSNet52717.2021.9614275","DOI":"10.1109\/CSNet52717.2021.9614275"},{"key":"917_CR6","doi-asserted-by":"crossref","unstructured":"Arakadakis K, Charalampidis P, Makrogiannakis A, Fragkiadakis A (2020) Firmware over-the-air programming techniques for IoT networks \u2013 A survey. In ACM Computing Surveys (CSUR), pp 1\u201336","DOI":"10.1145\/3472292"},{"key":"917_CR7","doi-asserted-by":"publisher","unstructured":"Lehniger K, Weidling S (2019) The impact of diverse execution strategies on incremental code updates for wireless sensor networks. In: Benavente-Peces C, Ahrens A, Camp O (eds) Proceedings of the 8th international conference on sensor networks, SENSORNETS 2019, Prague, Czech Republic, February 26-27, 2019, pp 30\u201339. https:\/\/doi.org\/10.5220\/0007383400300039","DOI":"10.5220\/0007383400300039"},{"key":"917_CR8","doi-asserted-by":"publisher","unstructured":"Kachman O, Balaz M (2020) Efficient patch module for single-bank or dual-bank firmware updates for embedded devices. In: 2020 23Rd international symposium on design and diagnostics of electronic circuits systems (DDECS), pp 1\u20136. https:\/\/doi.org\/10.1109\/DDECS50862.2020.9095744","DOI":"10.1109\/DDECS50862.2020.9095744"},{"key":"917_CR9","doi-asserted-by":"publisher","unstructured":"Arakadakis K, Fragkiadakis A (2020) Incremental firmware update using an efficient differencing algorithm: poster abstract. In: Proceedings of the 18th Conference on Embedded Networked Sensor Systems. SenSys 2020. J Assoc Comput Mach pp 691\u2013692. https:\/\/doi.org\/10.1145\/3384419.3430471","DOI":"10.1145\/3384419.3430471"},{"key":"917_CR10","unstructured":"Tridgell A (1999) Efficient algorithms for sorting and synchronization. Doctoral dissertation. The Australian National University"},{"key":"917_CR11","doi-asserted-by":"publisher","unstructured":"Jaein J, Culler D. (2004) Incremental network programming for wireless sensors. In: 2004 First annual IEEE communications society conference on sensor and ad hoc communications and networks, 2004. IEEE SECON 2004., pp 25\u201333. https:\/\/doi.org\/10.1109\/SAHCN.2004.1381899","DOI":"10.1109\/SAHCN.2004.1381899"},{"key":"917_CR12","doi-asserted-by":"publisher","unstructured":"Hu J, Xue CJ, He Y, Sha EH (2009) Reprogramming with minimal transferred data on wireless sensor network. In: 2009 IEEE 6Th international conference on mobile adhoc and sensor systems, pp 160\u2013167. https:\/\/doi.org\/10.1109\/MOBHOC.2009.5337000","DOI":"10.1109\/MOBHOC.2009.5337000"},{"key":"917_CR13","doi-asserted-by":"publisher","unstructured":"Mo B, Dong W, Chen C, Bu J, Wang Q (2012) An efficient differencing algorithm based on suffix array for reprogramming wireless sensor networks. In: 2012 IEEE international conference on communications (ICC), pp 773\u2013777. https:\/\/doi.org\/10.1109\/ICC.2012.6364214","DOI":"10.1109\/ICC.2012.6364214"},{"key":"917_CR14","doi-asserted-by":"publisher","first-page":"91","DOI":"10.1016\/j.comcom.2019.03.014","volume":"139","author":"O Kachman","year":"2019","unstructured":"Kachman O, Bal\u00e1z M, Mal\u00edk P (2019) Universal framework for remote firmware updates of low-power devices. Comput Commun 139:91\u2013102","journal-title":"Comput Commun"},{"key":"917_CR15","unstructured":"Linux kernel patch from the Openwall Project (1997) https:\/\/www.openwall.com\/linux\/README.shtml"},{"key":"917_CR16","unstructured":"Non-Executable Stack Patch (1997)\u00a0http:\/\/lkml.iu.edu\/hypermail\/linux\/kernel\/9706.0\/0341.html. Accessed 14 July 2022\u00a0"},{"key":"917_CR17","unstructured":"Solar\u2019s Clearification of the possible bypasses.\u00a0https:\/\/www.openwall.com\/linux\/README.shtml. Accessed 14 July 2022\u00a0"},{"key":"917_CR18","doi-asserted-by":"publisher","unstructured":"Shacham H (2007) The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86). CCS \u201907.Association for Computing Machinery, 552\u2013561. https:\/\/doi.org\/10.1145\/1315245.1315313","DOI":"10.1145\/1315245.1315313"},{"key":"917_CR19","unstructured":"Cowan C, Pu C, Maier D, Walpole J, Bakke P, Beattie S, Grier A, Wagle P, Zhang Q, Hinton H (1998) Stackguard: automatic adaptive detection and prevention of buffer-overflow attacks. In: USENIX Security Symposium, vol 98, San Antonio, TX. 63\u201378"},{"key":"917_CR20","unstructured":"Team P (2003) Pax address space layout randomization (ASLR).\u00a0http:\/\/pax.grsecurity.net\/docs\/aslr.txt. Accessed 14 July 2022\u00a0"},{"issue":"1","key":"917_CR21","first-page":"1","volume":"18","author":"S Falas","year":"2021","unstructured":"Falas S, Konstantinou C, Michael MK (2021) A modular end-to-end framework for secure firmware updates on embedded systems. ACM J Emerg Technol Comput Syst 18(1):1\u201319","journal-title":"ACM Journal on Emerging Technologies in Computing Systems (JETC)"},{"key":"917_CR22","unstructured":"Serna FJ (2012) Cve-2012-0769, the case of the perfect info leak. In: Blackhat conference, feb"},{"key":"917_CR23","doi-asserted-by":"crossref","unstructured":"Snow KZ, Monrose F, Davi L, Dmitrienko A, Liebchen C, Sadeghi A-R (2013) Just-in-time code reuse: On the effectiveness of fine-grained address space layout randomization. In: 2013 IEEE symposium on security and privacy. IEEE, pp 574\u2013588","DOI":"10.1109\/SP.2013.45"},{"key":"917_CR24","unstructured":"Goodspeed T, Francillon A (2009) Half-blind attacks: mask rom bootloaders are dangerous. In: Proceedings of the 3rd USENIX conference on offensive technologies. USENIX Association, pp 6\u20136"},{"key":"917_CR25","doi-asserted-by":"publisher","unstructured":"Bittau A, Belay A, Mashtizadeh A, Mazi\u00e8res D, Boneh D (2014) Hacking blind. In: 2014 IEEE Symposium on security and privacy, pp 227\u2013242. https:\/\/doi.org\/10.1109\/SP.2014.22","DOI":"10.1109\/SP.2014.22"},{"issue":"4","key":"917_CR26","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/s11704-021-0342-8","volume":"16","author":"T Zhang","year":"2022","unstructured":"Zhang T, Cai M, Zhang D, Huang H (2022) Sebrop: blind rop attacks without returns. Front Comp Sci 16(4):1\u201318","journal-title":"Frontiers of Computer Science"},{"issue":"11","key":"917_CR27","doi-asserted-by":"publisher","first-page":"168","DOI":"10.1145\/356989.357005","volume":"35","author":"D Lie","year":"2000","unstructured":"Lie D, Thekkath C, Mitchell M, Lincoln P, Boneh D, Mitchell J, Horowitz M (2000) Architectural support for copy and tamper resistant software. Acm Sigplan Notices 35(11):168\u2013177","journal-title":"Acm Sigplan Notices"},{"key":"917_CR28","unstructured":"Lee J, Jang J, Jang Y, Kwak N, Choi Y, Choi C, Kim T, Peinado M, Kang BB (2017) Hacking in darkness: Return-oriented programming against secure enclaves. In: 26Th USENIX security symposium (USENIX security 17), pp 523\u2013539"},{"key":"917_CR29","doi-asserted-by":"publisher","unstructured":"Bettayeb M, Nasir Q, Talib MA (2019) Firmware update attacks and security for iot devices: Survey. In: Proceedings of the ArabWIC 6th annual international conference research track. ArabWIC 2019.\u00a0J Assoc Comput Mach\u00a0https:\/\/doi.org\/10.1145\/3333165.3333169","DOI":"10.1145\/3333165.3333169"},{"key":"917_CR30","unstructured":"CWE Top 25 Most Dangerous Software Errors (2019) Common Weakness Enumeration. https:\/\/cwe.mitre.org\/top25\/archive\/2019\/2019_cwe_top25.html (accessed 14 July\u00a02022)"},{"key":"917_CR31","unstructured":"CWE Top 25 Most Dangerous Software Weaknesses (2020) Common Weakness Enumeration. https:\/\/cwe.mitre.org\/top25\/archive\/2022\/2020_cwe_top25.html (accessed 14 July\u00a02022)"},{"key":"917_CR32","unstructured":"Inventory RC (2020) Mona. https:\/\/github.com\/corelan\/mona"},{"key":"917_CR33","unstructured":"Schirra S (2020) Ropper. https:\/\/github.com\/sashs\/Ropper"},{"key":"917_CR34","unstructured":"Salwan J (2020) ROPgadget. https:\/\/github.com\/JonathanSalwan\/ROPgadget"}],"container-title":["Annals of Telecommunications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s12243-022-00917-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s12243-022-00917-8\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s12243-022-00917-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,3,21]],"date-time":"2023-03-21T03:18:07Z","timestamp":1679368687000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s12243-022-00917-8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,7,15]]},"references-count":34,"journal-issue":{"issue":"3-4","published-print":{"date-parts":[[2023,4]]}},"alternative-id":["917"],"URL":"https:\/\/doi.org\/10.1007\/s12243-022-00917-8","relation":{},"ISSN":["0003-4347","1958-9395"],"issn-type":[{"value":"0003-4347","type":"print"},{"value":"1958-9395","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,7,15]]},"assertion":[{"value":"9 January 2022","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"16 June 2022","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"15 July 2022","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent to participate"}},{"value":"Not applicable.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval"}},{"value":"Not applicable.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"<!--Emphasis Type='Bold' removed-->Consent for publication"}},{"value":"Not applicable.","order":5,"name":"Ethics","group":{"name":"EthicsHeading","label":"<!--Emphasis Type='Bold' removed-->Competing interests"}}]}}