Ripple20 bug - The curse of IoT continues

 19 different vulnerabilities, four of them critical, are affecting hundreds of millions of internet of things (IoT) 

https://threatpost.com/millions-connected-devices-ripple20-bugs/156599/

We can stop using Facebook and Whatsapp for conveying our messages , our light bulbs can do that for us (One minor problem, they can do it without your consent)

.Good news is that it is not easy (at this point in time)as additional gadgets and multiple steps are involved.

https://threatpost.com/lamphone-hack-lightbulb-vibrations-eavesdrop/156551/

Starbleed Vulnerability - A new security bug that impacts Xilinx FPGA chipsets.- Why is it important? - These chips are in many safety-critical applications today, from cloud data centers and mobile phone base stations to encrypted USB-sticks and industrial control systems

. This vulnerability allows an attacker to crack the bitstream encryption and tamper with the operations stored inside the bitstream, allowing the attacker to load their own malicious code on vulnerable devices. Intellectual properties included in the bitstream can be stolen. It is also possible to insert hardware Trojans into the FPGA by manipulating the bitstream.


https://www.zdnet.com/article/starbleed-bug-impacts-fpga-chips-used-in-data-centers-iot-devices-industrial-equipment/

Smart Speaker or Smart Snooper, maybe we whould call it "Smart Sneaker" - Forget big brother , your own pet electronics might be spying on you. Study estimates that activations of smart speakers when it wasn't you who uttered any wake word occur between 1.5 and 19 times a day. The average time of activation is 43 seconds.

https://www.zdnet.com/article/dont-worry-alexa-and-friends-only-record-you-up-to-19-times-a-day/

I did not know that there are vacuum cleaners with video cameras (that also allows hackers to view the video). Makes total sense, It will CLEAN your house and may also help (robbers) to CLEAN-UP your house.

https://threatpost.com/unpatched-security-flaws-open-connected-vacuum-to-takeover/153142/

Finally, UK has an IoT Law

The Law Mandates:

1. IoT device passwords must be unique. 
2. Manufacturers must also provide a public point of contact so that anyone can report a flaw. 
3. Manufacturers must also explicitly state the minimum length of time for which devices will receive security updates.

https://threatpost.com/mandatory-iot-security-uk-proposal/152217/

One common (forgotten) security issue that exists in our home - Vulnerabilities that will NEVER be patched because the system in unsupported (EOL) (Router, TV, IoT, or anything that can connect to internet).

For Example - The security researchers disclosed their findings to D-Link on September 22. Within 24 hours the hardware vendor had confirmed the vulnerability, and three days later, D-Link said that as the products are at End of Life (EOL) support, no patch will be released.

https://www.zdnet.com/article/d-link-routers-contain-remote-code-execution-vulnerability/

Does it matter if our TV is tracking us - Analysis of 81 devices including ones from Samsung, LG and Roku - 72 of the devices sent data to a destination that was not the device manufacturer itself Moreover, data firms use TV IP addresses to link what people are watching to what they do and see on smartphones, tablets and laptops, he said. “It’s like your TV is following you around,”

The Princeton report discovered that information being sent from devices also originates with channels being viewed through the use of trackers, which are predominantly managed by Google and Facebook. Eighty-nine percent of Amazon Fire TV channels and 69 percent of Roku channels contained trackers collecting information about viewing habits and preferences, researchers found.

These trackers also feature information that can uniquely identify the device and where it’s being used, including device serial numbers and IDs; Wi-Fi network names; and Wi-Fi identifiers known as MAC addresses.

https://threatpost.com/smart-tvs-leak-data/148482/

Own one of these - SonicWall firewall, Xerox Printer or Trend Micro IPS? - You may want to check this out. Two billion critical infrastructure devices at risk of hacking (could lead to a WannaCry-like situation says SCMagazine).

Affected IoT from vendors
ABB
Avaya
Belden Industrial Devices
Dräger
ExtremeNetworks
GE Healthcare
NetApp
Philips
Rockwell Automation
Schneider Electric
Siemens
Sonicwall Firewalls
TrendMicro IPS
Woodward
Xerox Printers



https://www.armis.com/urgent11/

Most common problem in IT Security are People ( phishing,misconfiguration) , 3rd party risk (too many, complex,visibility issues issues) and IoT. I thought IoT should be comparatively easier but, it seems we are still ignoring it.

Although things like smartphones and desktop computers are often top of mind when it comes to security, it’s often the printer, camera, or decoder that leaves a door open for a hacker to exploit.

In multiple cases, Microsoft saw Fancy Bear get access to targeted networks because the IoT devices were deployed with default passwords. In another case, the latest security update was not applied. Using those devices as a starting point, the hackers established a beachhead and looked for further access.

https://www.technologyreview.com/f/614062/russian-hackers-fancy-bear-strontium-infiltrate-iot-networks-microsoft-report/

We watch TV , ever wonder what could happen if if TV is watching us

Guy finds  a video of himself and his wife on an X-rated website.Later , “cybersecurity experts” discovered that a hacker had hijacked control of the camera in his smart TV and captured footage of him as he “canoodled” with his wife on the sofa.

https://www.grahamcluley.com/did-a-hacked-smart-tv-upload-footage-of-couple-having-sofa-sex-to-a-porn-website/

If you absolutely have to have Alexa or Google Assistant in your home, heed the following advice:

DO NOT put a digital assistant in a child's room.

1. Change the Default Password on Your Wi-Fi Router
2. Set the Voice Lock
3. Decide Whether You Want to Shop By Voice
4. Understand that Privacy Rights in the US Are on the Way – but Are Not Law Yet
5. Be Smart About Where you Locate Your Devices
6. Be Aware that Smart TVs Come With Digital Assistants


Make sure to set the voice lock for just the adults in the home.

Make sure you receive follow-up emails confirming your purchases, and check your credit card statements to make sure fraudsters aren't running up charges on your account

When the TV gets old and you pass it along to a friend or take it to the dump, find out how to erase all the data. 

https://www.darkreading.com/vulnerabilities---threats/6-security-tips-before-you-put-a-digital-assistant-to-work/d/d-id/1333783

Remember the saying "knowledge is power" - It is valuable today because "where there is a computer , there's a vulnerability". The problem is, computers are everywhere and it is important to know how these vulnerabilities affect us.

Example - Schneider Electric car charging stations - One of the vulnerabilities, (patched last month) enables access with maximum privileges to the charging station and could allow an attacker to stop the charging process and switch the device to the reservation mode making it inaccessible to customers until the machine is rebooted.

Two other vulnerabilities found , CVE-2018-7801 and  CVE-2018-7802 allow hackers to gain access to the device with maximum privileges and bypass authorization to gain access to the web interface with full privileges, respectively

The attacker could even unlock the charging cable from the device while it is in the process of charging a vehicle allowing them to steal the entire cable ultimately leading to financial losses for the energy sector and uncharged vehicles for customers.


https://www.scmagazine.com/home/security-news/positive-technologies-researchers-have-released-details-concerning-the-vulnerabilities-patched-last-month-in-the-schneider-electric-car-charging-stations/

Google Home Smart speaker is a nice gadget to show to our friends. Here is some not-so good news. Remember Magellan (not the explorer) SQLite vulnerability, your gadget is also affected by it. Meaning, it could lead to remote code execution, leaking program memory or it can cause program crashes.

The good news is there is no evidence of it being used in the wild (but,it could change anytime)

https://www.scmagazine.com/home/security-news/remote-code-execution-flaw-found-in-google-home-smart-speaker/

Security Tips for Smart TVs:

1. Turn off the WiFi.
2. Review the privacy settings
3. Keep software/firmware updated
4. Cover the camera when not in use
5. Mind the microphone.

For More check Here:
https://www.wombatsecurity.com/blog/5-security-tips-for-smart-tvs

IoT - There were 8.4 Billion devices in 2017 and could increase to 20+ Billion by 2020. how can we secure them?. Check this infographic for more details

GET IT HERE:

https://www.wombatsecurity.com/blog/infographic-iot-security-qa-and-checklist

Ever heard of SB 327 law? - It is California's new law, which will take effect in January 2020, requires all "connected devices" to have a "reasonable security feature." More important, default passwords are not allowed.

Connected Device includes IoT , reasonable security, that's a bit vague


More Here:

https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201720180SB327

FreeRTOS riddled with severe vulnerabilities - Why care, becuase, there is a high possibility that you own one of the IoT Devices (includes those from Amazon) that is running this OS.

The bugs could allow hackers to crash connected devices in smart homes or critical infrastructure systems, leak information from the devices’ memory, and take them over.


FreeRTOS and SafeRTOS, for their part, “have been used in a wide variety of industries: IoT, Aerospace, Medical, Automotive, and more,” according to the company’s post. “Due to the high risk nature of devices in some of these industries, zLabs decided to take a look at the connectivity components that are paired with these OS’s. Clearly, devices that have connectivity to the outside world are at a higher degree of risk of being attacked.”


https://threatpost.com/aws-freertos-bugs-allow-compromise-of-iot-devices/138455/

Good News - Securing Wireless Infusion Pumps - NIST has a Special Publication for IoMT (Internet of Medical Things) - 1800-8:

NCCoE  developed this  by using standards-based, commercially available technologies and industry best practices to help healthcare delivers strengthen the security of the wireless infusion pump ecosystem within health care facilities.

https://csrc.nist.gov/publications/detail/sp/1800-8/final

It feels good when we can show-off our new Internet enabled home gadgets . Just be aware that sometimes, a misconfigured DIY smart-home hubs for home automation could allow attackers to track owners’ movements, see if smart doors and windows are opened or closed, and even open garage doors.

The servers in question are 49,000 Message Queuing Telemetry Transport (MQTT) servers, which are publicly visible due to misconfigured MQTT protocol, according to research released Thursday from Avast. This includes more than 32,000 servers with no password protection.

“The MQTT protocol is used to interconnect and control smart-home devices, via smart-home hubs,”

While the MQTT protocol itself is secure, a lack of security awareness combined with poor built-in protections can create a number of threat vectors, even when a server is partially protected.

“It is frighteningly easy to gain access and control of a person’s smart home, because there are still many poorly secured protocols dating back to bygone technology eras when security was not a top concern,” Hron said. “Consumers need to be aware of the security concerns of connecting devices that control intimate parts of their home to services they don’t fully understand and the importance of properly configuring their devices.”

https://threatpost.com/open-mqtt-servers-raise-physical-threats-in-smart-homes/136586/