Attacks/Breaches

9/16/2016
02:35 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

IoT Village at DEF CON 24 Uncovers Extensive Security Flaws in Connected Devices

Researchers Discover 47 New Security Vulnerabilities across 23 Devices and 21 Manufacturers; Executive Leadership from FTC and FCC Weigh in.

BALTIMORE, MD – September 14, 2016. New dangers in both home security and municipal power facilities were revealed as the results of the 2nd Annual IoT Village, which was held at DEF CON 24, were released today by Independent Security Evaluators (ISE) who organized the event. More than 47 new vulnerabilities were discovered across 23 different devices from 21 brand name manufacturers.

Amongst many, one of the most unnerving exploits was presented by researcher Fred Bret-Mounet, who showed an attacker could shut down the equivalent of a small to mid-sized power generation facility by accessing the flaw in solar panels manufactured by Tigro Energy.

In another, researcher Anthony Rose discovered that 75% of the smart locks he investigated could be easily compromised, letting an attacker open the lock on a victim’s front door. Another researcher, who goes by the handle “jmaxxz,” discovered a series of vulnerabilities with August locks which, if exploited, would mean that “anyone you've ever let use your phone, or ever given access to your home as a guest via your smart lock could enter your home without your knowledge or permission.” he said. Smart locks are one of the fastest growing consumer products serving the smart home.

Afflicted manufacturers this year included global enterprises such as Samsung, Subaru, and Trane, as well as smaller startups such as QuickLock, Elecycle, and Blossom. Vulnerabilities ranged from fundamental design flaws such as use of plaintext passwords and hard coded passwords, to susceptibility to longstanding attack techniques such as buffer overflows, and command injection.

Between talks, workshops, and onsite hacking contests, IoT Village’s goal is to uncover security vulnerabilities in order to draw attention to the need for greater security considerations in the devices that comprise the Internet of Things (IoT). Since its inception as platform for security research, IoT Village has discovered security flaws in 50 devices from 39 different manufacturers.

“In the past two years, IoT Village has uncovered 113 critical, previously unknown vulnerabilities across both consumer and business products from some of the largest brand names in the world,” said Ted Harrington, Executive Partner at ISE and one of the organizers of IoT Village. “These discoveries are significant contributions to security research but also illustrate the pressing need for security improvements in IoT devices.” IoT Village has proven so successful that it is now held at security events all across the country beyond just DEF CON.

This year, IoT Village caught the attention of the federal government. Rear Admiral (ret.) David Simpson, a Bureau Chief of the Federal Communications Commission, spoke at the event and noted that IoT Village is taking strides towards “making things harder” for attackers, by putting the spotlight on these issues. Terrell McSweeny, commissioner of the Federal Trade Commission, also spoke at IoT Village, discussing the FTC’s law enforcement actions challenging inadequate data security in connected devices. “We believe that improved security is going to be achieved through a synergy between government, manufacturers, and the security community,” added Harrington. “The contributions of both Admiral Simpson and Commissioner McSweeny are invaluable to that effort.”

IoT Village next runs at DerbyCon, from Sept 21-25 in Louisville, KY. More information about IoT Village can be found at the official event website.

About IoT Village
IoT Village is a traveling security event focused on highlighting and resolving security flaws in the connected devices that comprise the Internet of Things (“IoT”). It is composed of talks, workshops, live hacking demos, and an onsite hacking contest. In its 2015 debut, IoT Village served as a platform to publish 66 previously unknown critical security vulnerabilities across 27 different devices types and 18 different manufacturers.

About ISE
Founded in 2005 out of the PhD program at the Johns Hopkins’ Information Security Institute, ISE is a security consulting firm comprised of hackers, computer scientists, reverse engineers, and cryptographers who help companies defend against sophisticated adversaries through manual, white box security assessments. ISE is widely recognized as being the first company to hack the iPhone.

Contact:
Ted Harrington Independent Security Evaluators
[email protected] Baltimore, MD, USA
+1 (443)-270-2296

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Mueller Probe Yields Hacking Indictments for 12 Russian Military Officers
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/13/2018
10 Ways to Protect Protocols That Aren't DNS
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-10727
PUBLISHED: 2018-07-20
camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive ...
CVE-2018-8018
PUBLISHED: 2018-07-20
Apache Ignite 2.5 and earlier serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a spe...
CVE-2018-14415
PUBLISHED: 2018-07-20
An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen.
CVE-2018-14418
PUBLISHED: 2018-07-20
In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.
CVE-2018-14419
PUBLISHED: 2018-07-20
MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.