Firmware Border Binaries and Multi-Binary Taint Analysis

In general, most software security operates on the basis of sources and sinks - vulnerable data, input, influence, etc. comes from a known source, and eventually reaches a vulnerable sink. When thinking of a single binary, this concept can be fairly straightforward: If a binary takes input via argv that eventually ends up in a system() call and leads to command execution, argv() is the source, and…