Chronos: Large-Scale Online Firmware Version Detection via Inadvertent Chronological Fingerprints

Abstract

The rapid proliferation of network devices has created a critical security challenge: widespread deployment of systems running vulnerable firmware versions. Firmware version identification is essential for security management, but existing methods face a fundamental limitation: they cannot simultaneously achieve fine-grained accuracy and large-scale practicality. In this paper, we present Chronos, a novel approach exploiting temporal signatures inadvertently embedded during firmware development. This enables fine-grained version identification without firmware access, achieving both accuracy and large-scale practicality. We evaluate Chronos on 7,740 real-world samples across 9 brands, achieving 84% fingerprint generation coverage with 96.5% precision and 91.8% recall. Our large-scale measurement reveals widespread security vulnerabilities: only 14.4% of devices run current firmware, with 17.2% exposed to known vulnerabilities—69.1% classified as High or Critical severity. The code is available at https://doi.org/10.5281/zenodo.18175223.