Authentication, Firmware, Internet and IoT

IoT Unravelled Part 3: Security

Troy Hunt

NOVEMBER 25, 2020

In part 1 of this series, I posited that the IoT landscape is an absolute mess but Home Assistant (HA) does an admirable job of tying it all together. I also looked at custom firmware and soldering and why, to my mind, that was a path I didn't need to go down at this time. Now for the big challenge - security. Let's dive into it.

IoT

IoT Firmware Risk Manufacturing

P2P Weakness Exposes Millions of IoT Devices

Krebs on Security

APRIL 26, 2019

iLnkP2p is bundled with millions of Internet of Things (IoT) devices, including security cameras and Webcams, baby monitors, smart doorbells, and digital video recorders. He found that 39 percent of the vulnerable IoT things were in China; another 19 percent are located in Europe; seven percent of them are in use in the United States.

IoT

IoT Firewall Manufacturing Computers and Electronics

CVE-2021-20090 actively exploited to target millions of IoT devices worldwide

Security Affairs

AUGUST 7, 2021

Threat actors are actively exploiting a critical authentication bypass issue (CVE-2021-20090 ) affecting home routers with Arcadyan firmware. Threat actors actively exploit a critical authentication bypass vulnerability, tracked as CVE-2021-20090 , impacting home routers with Arcadyan firmware to deploy a Mirai bot.

IoT

IoT Firmware Authentication Wireless

UDP Technology IP Camera firmware vulnerabilities allow for attacker to achieve root

Malwarebytes

JULY 28, 2021

Researchers at RandoriSec have found serious vulnerabilities in the firmware provided by UDP Technology to Geutebrück and many other IP camera vendors. According to the researchers the firmware supplier UDP Technology fails to respond to their reports despite numerous mails and LinkedIn messages. History lessons. Mitigation.

Firmware

Firmware Technology Authentication IoT

The Internet of Things Is Everywhere. Are You Secure?

Security Boulevard

MARCH 18, 2021

From smart homes that enable you to control your thermostat from a distance to sensors on oil rigs that help predict maintenance to autonomous vehicles to GPS sensors implanted in the horns of endangered black rhinos , the internet of things is all around you. With the increase in connected devices comes an increase in IoT attacks.

Internet

Internet Internet IoT Software

Overview of IoT threats in 2023

SecureList

SEPTEMBER 21, 2023

IoT devices (routers, cameras, NAS boxes, and smart home components) multiply every year. The first-ever large-scale malware attacks on IoT devices were recorded back in 2008, and their number has only been growing ever since. Telnet, the overwhelmingly popular unencrypted IoT text protocol, is the main target of brute-forcing.

IoT

IoT DDOS Passwords Malware

Key Developments in IoT Security

Thales Cloud Protection & Licensing

JULY 15, 2021

Key Developments in IoT Security. Remember the early days of the emergence of Internet of Things (IoT) devices? Vulnerabilities have been discovered in many of these IoT devices. Ellen has extensive experience in cybersecurity, and specifically, the understanding of IoT risk. Thu, 07/15/2021 - 10:09.

IoT

IoT Data privacy Technology Risk

Use cases of secure IoT deployment

Thales Cloud Protection & Licensing

MAY 31, 2021

Use cases of secure IoT deployment. In our previous blog post , we discussed the challenges for securing IoT deployments, and how businesses and consumers benefit from authenticating and validating IoT software and firmware updates. Tue, 06/01/2021 - 06:55. Use case 1: Fortune 500 Healthcare Company.

IoT

IoT Computers and Electronics Manufacturing Firmware

Why Healthcare IoT Requires Strong Machine Identity Management

Security Boulevard

MAY 30, 2022

Why Healthcare IoT Requires Strong Machine Identity Management. The healthcare industry has been leveraging IoT devices for years, steadily increasing its use in facilities and patient care. By 2027, the IoT in Healthcare market is expected to reach $290 billion , up from just $60 billion in 2019. brooke.crothers.

Healthcare

Healthcare IoT Manufacturing Risk

EU to Force IoT, Wireless Device Makers to Improve Security

eSecurity Planet

NOVEMBER 1, 2021

The European Union is poised to place more demands on manufacturers to design greater security into their wireless and Internet of Things (IoT) devices. has made some strides on IoT security at the federal level; it remains to be seen if the EU initiative will spur the U.S. IoT market growth. IoT Security Neglected.

Wireless

Wireless IoT Manufacturing Mobile

Guest Blog: TalkingTrust. What’s driving the security of IoT?

Thales Cloud Protection & Licensing

MARCH 10, 2021

What’s driving the security of IoT? There are so many reasons why manufacturers connect their products to the Internet, whether it’s industrial machines, medical devices, consumer goods or even cars. First off, connected vehicles and IoT devices are highly attractive targets to hackers. Thu, 03/11/2021 - 07:39.

IoT

IoT Firmware Manufacturing Encryption

IoT Cybersecurity: 5 Major Vulnerabilities and How to Tackle Them

Security Affairs

OCTOBER 13, 2020

The number of sensors and smart devices connected to the internet is exponentially rising, which are the 5 Major Vulnerabilities for IoT devices. If you take a look at the global market for IoT, you can easily spot the trend. IoT devices are exposed to cybersecurity vulnerabilities. IoT is a complicated concept.

IoT

IoT Cybersecurity Manufacturing Internet

Ubiquiti: Change Your Password, Enable 2FA

Krebs on Security

JANUARY 11, 2021

Ubiquiti , a major vendor of cloud-enabled Internet of Things (IoT) devices such as routers, network video recorders, security cameras and access control systems, is urging customers to change their passwords and enable multi-factor authentication.

Passwords

Passwords Authentication Firmware Accountability

Critical Success Factors to Widespread Deployment of IoT

Thales Cloud Protection & Licensing

FEBRUARY 16, 2021

Critical Success Factors to Widespread Deployment of IoT. Digital technology and connected IoT devices have proliferated across industries and into our daily lives. Finally, IoT devices are being used extensively in smart vehicles and home appliances to provide enhanced user experiences. Threat vectors on IoT.

IoT

IoT Manufacturing Energy and Utilities Data collection

Spyware in the IoT – the Biggest Privacy Threat This Year

SiteLock

AUGUST 27, 2021

Simply defined, the internet of things (IoT) is a network of Internet-connected objects able to collect and exchange data. In today’s digital-driven world, IoT connects almost everything including homes, offices, and vehicles, allowing users the convenience of activating and operating nearly any device remotely.

IoT

IoT Spyware VPN Passwords

To Make the Internet of Things Safe, Start with Manufacturing

Thales Cloud Protection & Licensing

SEPTEMBER 11, 2018

This aptly describes the Internet of Things (IoT), where many small things are coming together to shape what we all hope will deliver a great leap in the way we live and do business. According to Maciej Kranz, Cisco VP for strategic innovation, writing for IoTechExpo.com , “[In 2018] IoT security will become the No.

Manufacturing

Manufacturing Internet Internet IoT

Attackers Exploit Flaw that Could Impact Millions of Routers, IoT Devices

eSecurity Planet

AUGUST 10, 2021

In a recent blog post , the researchers said the bad actors are looking to leverage a path traversal vulnerability that could affect millions of home routers and other Internet of Things (IoT) devices that use the same code base and are manufactured by at least 17 vendors. ” Network Vulnerability Assessment Difficult.

IoT

IoT DDOS Internet Internet

IoT and Machine Identity Management in Financial Services

Security Boulevard

JUNE 28, 2022

IoT and Machine Identity Management in Financial Services. How is IoT changing the financial sector? IoT has already positively impacted the financial sector and will only continue to in the future. The most notable and well-documented example of investment in the IoT infrastructure has been by retail banks.

Financial Services

Financial Services IoT Banking Retail

Home routers are being hijacked using vulnerability disclosed just 2 days ago

Malwarebytes

AUGUST 9, 2021

Router firmware. Under the description of CVE-2021-20090 you will find: “a path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.”.

Firmware

Firmware DDOS Internet Internet

Zyxel 0day Affects its Firewall Products, Too

Krebs on Security

FEBRUARY 26, 2020

. “We’ve now completed the investigation of all Zyxel products and found that firewall products running specific firmware versions are also vulnerable,” Zyxel wrote in an email to KrebsOnSecurity. “Hotfixes have been released immediately, and the standard firmware patches will be released in March.”

Firewall

Firewall Firmware VPN IoT

Experts share details of five flaws that can be chained to hack Netgear RAX30 Routers

Security Affairs

MAY 11, 2023

Industrial and IoT cybersecurity firm Claroty disclosed technical details of five vulnerabilities that be exploited to hack some Netgear router models. “NETGEAR strongly recommends that you download the latest firmware as soon as possible.” The remaining ones are authentication bypass and command injection flaws.

Hacking

Hacking Firmware Authentication DNS

Both Mirai and Hoaxcalls IoT botnets target Symantec Web Gateways

Security Affairs

MAY 19, 2020

Palo Alto Networks Unit 42 researchers observed both the Mirai and Hoaxcalls botnets using an exploit for a post-authentication Remote Code Execution vulnerability in legacy Symantec Web Gateways 5.0.2.8. Experts note that the exploit is only effective for authenticated sessions and the affected devices are End of Life (EOL) from 2012.

IoT

IoT DDOS Authentication Advertising

Realtek-based routers, smart devices are being gobbled up by a voracious botnet

Malwarebytes

AUGUST 24, 2021

Mirai hoovers up vulnerable Internet of Things (IoT) devices and adds them to its network of zombie devices, which can then be used to launch huge Distributed Denial of Service (DDoS) attacks. Realtek chipsets are found in many embedded IoT devices. At least 65 vendors are affected. Exactly what Mirai wants. Vulnerabilities.

Firmware

Firmware IoT Internet Internet

Realtek SDK flaws exploited to deliver Mirai bot variant

Security Affairs

AUGUST 24, 2021

On August 15, firmware security company IoT Inspector published details about the flaws. “On August 16th, three days ago, multiple vulnerabilities in a software SDK distributed as part of Realtek chipsets were disclosed by IoT Inspector Research Lab [1]. ” reported IoT Inspector.

IoT

IoT Firmware Internet Internet

TLStorm flaws allow to remotely manipulate the power of millions of enterprise UPS devices

Security Affairs

MARCH 9, 2022

Researchers from IoT security company Armis have discovered three high-impact security flaws, collectively tracked as TLStorm, affecting APC Smart-UPS devices. The researchers discovered that the firmware upgrades are not properly signed and validated. SecurityAffairs – hacking, IoT). ” continues Armis. Pierluigi Paganini.

Firmware

Firmware IoT Authentication Backups

Building a foundation of trust for the Internet of Things

Thales Cloud Protection & Licensing

DECEMBER 13, 2018

Invariably, Internet of Things (IoT) strategies form the backbone of those efforts. Enormous quantities of data can be generated by and collected from a wide variety of IoT devices. The diversity of IoT devices and lack of standardisation also poses challenges. The goal is then to analyse it and take impactful action.

Internet

Internet Internet IoT Manufacturing

The Hacker Mind: Hacking IoT

ForAllSecure

APRIL 22, 2021

It seems everything smart is hackable, with IoT startups sometimes repeating security mistakes first made decades ago. The next day I cut the string, There's a parallel here to IoT light bulbs that change colors. Problem is, MAC addresses are not great for authentication. How then does one start securing it?

IoT

IoT Hacking Internet Internet

The Hacker Mind: Hacking IoT

ForAllSecure

APRIL 22, 2021

It seems everything smart is hackable, with IoT startups sometimes repeating security mistakes first made decades ago. The next day I cut the string, There's a parallel here to IoT light bulbs that change colors. Problem is, MAC addresses are not great for authentication. How then does one start securing it?

IoT

IoT Hacking Internet Internet

VulnRecap 1/16/24 – Major Firewall Issues Persist

eSecurity Planet

JANUARY 16, 2024

Potential results of the exploits include authentication bypass and command injection. January 11, 2024 Smart Thermostat from Bosch Puts Offices in Danger Type of vulnerability: Malicious commands sent from an attacker to the thermostat, including potentially replacing firmware with rogue code. Versions 9.x

Firewall

Firewall Firmware IoT Authentication

Hacking the Twinkly IoT Christmas lights

Security Affairs

DECEMBER 24, 2018

Security researchers discovered some flaws in the Twinkly IoT lights that could be exploited display custom lighting effects and to remotely turn off them. ” Once the mobile app has discovered the IP address of the lights, it authenticates with them, receives an authentication token and retrieves information about the device.

IoT

IoT Hacking DNS Authentication

MY TAKE: ‘Digital trust’ has a huge role to play mitigating cybersecurity threats, going forward

The Last Watchdog

MAY 23, 2022

They require integrity, authentication, trusted identity and encryption. Then the Internet took off and trusting the connection between a user’s device and a web server became of paramount importance. Modern digital systems simply could not exist without trusted operations, processes and connections. Failure is not an option.

Digital transformation

Digital transformation Computers and Electronics Cybersecurity Encryption

Understanding IoT Security Challenges – An Interview with an Industry Expert

Thales Cloud Protection & Licensing

SEPTEMBER 12, 2018

The Internet of Things (IoT) is rapidly growing and expected to affect all industry verticals as well as our private lives. In this blog, we reached out to our technology partner Nexus to better understand the challenges that the industry faces to ensure safe deployment and management of IoT technologies. Weak authentication.

IoT

IoT Computers and Electronics Authentication Marketing

AT&T Alien Labs finds new Golang malware (BotenaGo) targeting millions of routers and IoT devices with more than 30 exploits

CyberSecurity Insiders

NOVEMBER 11, 2021

Deployed with more than 30 exploits, it has the potential of targeting millions of routers and IoT devices. Ax with firmware 1.04b12 and earlier. NETGEAR DGN2200 devices with firmware through 10.0.0.50. Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.2, 7)C0 NAS520 before firmware V5.21(AASZ.3)C0

Malware

Malware IoT Firmware Authentication

The High-Stakes Game of Ensuring IoMT Device Security

SecureWorld News

FEBRUARY 17, 2024

Being constantly connected to the internet, they are either protected by basic passwords or, in some cases, have no password protection at all. Challenges in securing IoMT devices The Internet of Medical Things (IoMT) is essentially a subset of the wider Internet of Things (IoT) concept.

Healthcare

Healthcare Manufacturing Internet Internet

Millions of home routers on Mirai Botnet Radar

CyberSecurity Insiders

AUGUST 13, 2021

Tenable researchers claim hackers are exploiting a security flaw termed authentication-bypass vulnerability that is impact routers and internet of things (IoT) devices. What’s interesting about this attack campaign is the hackers are targeting devices running on the firmware that is being supplied by Arcadyan.

Firmware

Firmware DDOS Malware Manufacturing

Millions of IoT Devices exposed to remote hacks due to iLnkP2P flaws

Security Affairs

APRIL 26, 2019

Experts discovered security flaws in the iLnkP2P peer-to-peer (P2P) system that exposes millions of IoT devices to remote attacks. The iLnkP2P system allows users to remotely connect to their IoT devices using a mobile phone or a PC. Potentially affected IoT devices include cameras and smart doorbells. Pierluigi Paganini.

IoT

IoT Hacking Manufacturing Advertising

Experts found 15 flaws in Netgear JGS516PE switch, including a critical RCE

Security Affairs

MARCH 14, 2021

Netgear has released security and firmware updates for its JGS516PE Ethernet switch to address 15 vulnerabilities, including a critica remote code execution issue. “The switch internal management web application in firmware versions prior to 2.6.0.43 ” reads the advisory published by NCC Group.”

Firmware

Firmware Authentication Hacking Software

D-Link issues beta hotfix for multiple flaws in DIR-3040 routers

Security Affairs

JULY 17, 2021

Network equipment vendor D-Link has released a firmware hotfix to fix multiple vulnerabilities in the DIR-3040 AC3000-based wireless internet router. Network equipment vendor D-Link has released a firmware hotfix to address multiple vulnerabilities affecting the DIR-3040 AC3000-based wireless internet router.

Firmware

Firmware Wireless Passwords Internet

Spotlight: CTIA’s IoT Cybersecurity Certification is a Big Deal. Here’s why.

The Security Ledger

MARCH 13, 2019

Forget about Congress's latest attempt to regulate IoT security. The post Spotlight: CTIA’s IoT Cybersecurity Certification is a Big Deal. Forget about Congress’s latest attempt to regulate IoT security. to reign in insecure IoT endpoints. CTIAs new certification is the toothiest standard going.

IoT

IoT Cybersecurity Internet Internet

ZoomEye IoT search engine cached login passwords for tens of thousands of Dahua DVRs

Security Affairs

JULY 16, 2018

A security researcher discovered that the IoT search engine ZoomEye has cached login passwords for tens of thousands of Dahua DVRs. The IoT search engine ZoomEye has cached login passwords for tens of thousands of Dahua DVRs, the discovery was made by security researcher Ankit Anubhav, Principal Researcher at NewSky Security.

IoT

IoT Engineering Passwords Firmware

Machine Identities are Essential for Securing Smart Manufacturing

Security Boulevard

FEBRUARY 28, 2022

The Industrial Internet of Things (IIoT) puts networked sensors and intelligent devices directly on the manufacturing floor to collect data, drive artificial intelligence and do predictive analytics. The following are six advantages of IoT in the manufacturing industry. Machine Identities are Essential for Securing Smart Manufacturing.

Manufacturing

Manufacturing IoT Authentication Artificial Intelligence

Flaws in Medtronic MyCareLink can allow attackers to take over implanted cardiac devices

Security Affairs

DECEMBER 15, 2020

Experts from IoT security firm Sternum discovered vulnerabilities discovered in Medtronic’s MyCareLink Smart 25000 Patient Reader product that could be exploited to take control of a paired cardiac device. The flaw could be exploited by an attacker to remotely execute code taking over the device. ” states the advisory.

Firmware

Firmware Authentication Mobile IoT

Cybersecurity and its impact on the home

CyberSecurity Insiders

NOVEMBER 23, 2021

As CNBC rightly outlines, the internet is already only semi-accessible when it comes to people living with disability. IoT vulnerabilities. The IoT relies on data-sharing. This makes them susceptible to attack, and as ZDNet outlines, there have been countless new vulnerability exploiting tools constructed just to attack the IoT.

Cybersecurity

Cybersecurity IoT Wireless Risk

Flaws in Wyze cam devices allow their complete takeover

Security Affairs

MARCH 31, 2022

The three flaws reported by the cybersecurity firm are: An authentication bypass tracked CVE-2019-9564 A stack-based buffer overflow, tracked as CVE-2019-12266 , which could lead to remote control execution. The vendor addressed the unauthenticated access to the content of the SD card with the release of firmware updates on January 29, 2022.

IoT

IoT Firmware Marketing Authentication

IoT Unravelled Part 3: Security

P2P Weakness Exposes Millions of IoT Devices

Trending Sources

CVE-2021-20090 actively exploited to target millions of IoT devices worldwide

UDP Technology IP Camera firmware vulnerabilities allow for attacker to achieve root

The Internet of Things Is Everywhere. Are You Secure?

Overview of IoT threats in 2023

Key Developments in IoT Security

Use cases of secure IoT deployment

Why Healthcare IoT Requires Strong Machine Identity Management

EU to Force IoT, Wireless Device Makers to Improve Security

Guest Blog: TalkingTrust. What’s driving the security of IoT?

IoT Cybersecurity: 5 Major Vulnerabilities and How to Tackle Them

Ubiquiti: Change Your Password, Enable 2FA

Critical Success Factors to Widespread Deployment of IoT

Spyware in the IoT – the Biggest Privacy Threat This Year

To Make the Internet of Things Safe, Start with Manufacturing

Attackers Exploit Flaw that Could Impact Millions of Routers, IoT Devices

IoT and Machine Identity Management in Financial Services

Home routers are being hijacked using vulnerability disclosed just 2 days ago

Zyxel 0day Affects its Firewall Products, Too

Experts share details of five flaws that can be chained to hack Netgear RAX30 Routers

Both Mirai and Hoaxcalls IoT botnets target Symantec Web Gateways

Realtek-based routers, smart devices are being gobbled up by a voracious botnet

Realtek SDK flaws exploited to deliver Mirai bot variant

TLStorm flaws allow to remotely manipulate the power of millions of enterprise UPS devices

Building a foundation of trust for the Internet of Things

The Hacker Mind: Hacking IoT

The Hacker Mind: Hacking IoT

VulnRecap 1/16/24 – Major Firewall Issues Persist

Hacking the Twinkly IoT Christmas lights

MY TAKE: ‘Digital trust’ has a huge role to play mitigating cybersecurity threats, going forward

Understanding IoT Security Challenges – An Interview with an Industry Expert

AT&T Alien Labs finds new Golang malware (BotenaGo) targeting millions of routers and IoT devices with more than 30 exploits

The High-Stakes Game of Ensuring IoMT Device Security

Millions of home routers on Mirai Botnet Radar

Millions of IoT Devices exposed to remote hacks due to iLnkP2P flaws

Experts found 15 flaws in Netgear JGS516PE switch, including a critical RCE

D-Link issues beta hotfix for multiple flaws in DIR-3040 routers

Spotlight: CTIA’s IoT Cybersecurity Certification is a Big Deal. Here’s why.

ZoomEye IoT search engine cached login passwords for tens of thousands of Dahua DVRs

Machine Identities are Essential for Securing Smart Manufacturing

Flaws in Medtronic MyCareLink can allow attackers to take over implanted cardiac devices

Cybersecurity and its impact on the home

Flaws in Wyze cam devices allow their complete takeover

Stay Connected