Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //


05:00 PM

Firms Slow To Secure Flaws In Embedded Devices

While operating systems and PC applications have evolved fast patch mechanisms, the proliferation of slow-to-patch embedded devices leaves companies vulnerable

At the Black Hat Security conference earlier this year, Jerome Radcliffe, a security researcher who has diabetes, showed off weaknesses in the security of a popular insulin pump. Last month, another researcher at security firm McAfee expanded on the attack, showing how the pumps could be easily attacked and that manufacturers were unprepared to fix the problem.

The hack of the insulin pump demonstrates a major problem with embedded devices: Most systems were never designed to be easily updated. With researchers increasingly looking at software systems embedded in automobiles, network routers, printers, and industrial control systems, a growing number of vulnerabilities will be found. Yet fixing those flaws in the field is not easy, says Stuart McClure, general manager of risk and compliance for McAfee.

"It takes a year to get any bit on the device changed," he says. "It is a big problem that has to be overcome in order to secure the systems."

Android phones are another example. While Google fixes the flaws on the devices quickly, many patches languish in manufacturers' development shops or in quality assurance testing at the carrier.

The problems will become only more common. Security researchers are increasingly targeting the embedded software in devices because general-purpose computer systems have become tougher to exploit, says Ron Gula, chief technology officer for Tenable Network Security.

"We got really, really good at securing Microsoft, so what are people doing? They are going after an easier target," Gula says.

For companies worried about vulnerable embedded devices in their networks, the first action should be to identify every network-connected device and look for vulnerable services. No company should be running a telnet service, even inside the corporate network, Gula says.

"There are devices that you might not know are in your network, so scanning is critical," he says.

Cordoning off the devices that are known to be vulnerable from general network access is a good next step. While business users might want remote administration capabilities, such convenience sacrifices security, says Eric Knapp, director of critical infrastructure markets for NitroSecurity.

"As soon as you give them remote access, you open up a potential security hole," Knapp says.

Finally, any company that makes an appliance or embedded device needs to solve the problem of patches that significantly lag vulnerabilities, Tenable's Gula says. Companies should push their vendors to find ways to securely speed up patch deployment, similar to the major software vendors in the personal computer market.

"We are familiar with Microsoft Tuesday; there is nothing like a Cisco Wednesday," Gula says. "You really need transparency with embedded devices to figure out what patches are necessary."

Yet embedded systems will likely always take longer to patch, says Marc Brown, vice president of tools for Wind River. Many embedded device manufacturers will be able to speed up patch distribution and close security holes, especially on network-connected devices. However, more deeply embedded systems, such as industrial control and monitoring equipment, will not have an easy path to patches, he says.

"You will have high-end devices, like Android phones, that will be patchable, and low-end ones that won't be updated and so still have risk," Brown says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-09-21
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the...
PUBLISHED: 2019-09-21
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the se...
PUBLISHED: 2019-09-20
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
PUBLISHED: 2019-09-20
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs ...
PUBLISHED: 2019-09-20
F5 BIG-IP 15.0.0, 14.1.0-, 14.0.0-, 13.0.0-, 12.1.0-, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.