  Attackers can exploit known vulnerabilities to infiltrate a device's firmware
and the communication between firmware binaries, in order to pass between them.
To improve cybersecurity, organizations must identify and mitigate the risks of
the firmware they use. An attack graph (AG) can be used to assess and visually
display firmware's risks by organizing the identified vulnerabilities into
attack paths composed of sequences of actions attackers may perform to
compromise firmware images. In this paper, we utilize AGs for firmware risk
assessment. We propose MIRAGE (Multi-binary Image Risk Assessment with Attack
Graph Employment), a framework for identifying potential attack vectors and
vulnerable interactions between firmware binaries; MIRAGE accomplishes this by
generating AGs for firmware inter-binary communication. The use cases of the
proposed firmware AG generation framework include the identification of risky
external interactions, supply chain risk assessment, and security analysis with
digital twins. To evaluate the MIRAGE framework, we collected a dataset of 703
firmware images. We also propose a model for examining the risks of firmware
binaries, demonstrate the model's implementation on the dataset of firmware
images, and list the riskiest binaries.
