BugProve

BugProve offers an IoT analysis tool to help engineers run automated firmware security checks, no source code is needed. The scans show the first results within 5 minutes of firmware upload while balancing time and accuracy to minimize false positives.

It decompiles suspicious binaries, analyzes them, and provides feedback on any elements with known or unknown (zero-day) vulnerabilities.

The tool performs static binary code analysis and concolic analysis and also provides security checks that are only applicable to embedded firmware. By offering visibility into security issues hiding in the SDK in use, it tackles some of the supply chain risks.

The unique feature of BugProve is its automated zero-day vulnerability scan, which checks the code and flags potential issues.

Overall, a 2-week long manual security evaluation can be completed in a day.

The tool has been launched with a Free Plan, which allows the security community to use it freely, and is also expected to help IoT bug bounty hunting as long as it is compliant with the terms of the platform offering the bounty program.