Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //


05:00 PM

Firms Slow To Secure Flaws In Embedded Devices

While operating systems and PC applications have evolved fast patch mechanisms, the proliferation of slow-to-patch embedded devices leaves companies vulnerable

At the Black Hat Security conference earlier this year, Jerome Radcliffe, a security researcher who has diabetes, showed off weaknesses in the security of a popular insulin pump. Last month, another researcher at security firm McAfee expanded on the attack, showing how the pumps could be easily attacked and that manufacturers were unprepared to fix the problem.

The hack of the insulin pump demonstrates a major problem with embedded devices: Most systems were never designed to be easily updated. With researchers increasingly looking at software systems embedded in automobiles, network routers, printers, and industrial control systems, a growing number of vulnerabilities will be found. Yet fixing those flaws in the field is not easy, says Stuart McClure, general manager of risk and compliance for McAfee.

"It takes a year to get any bit on the device changed," he says. "It is a big problem that has to be overcome in order to secure the systems."

Android phones are another example. While Google fixes the flaws on the devices quickly, many patches languish in manufacturers' development shops or in quality assurance testing at the carrier.

The problems will become only more common. Security researchers are increasingly targeting the embedded software in devices because general-purpose computer systems have become tougher to exploit, says Ron Gula, chief technology officer for Tenable Network Security.

"We got really, really good at securing Microsoft, so what are people doing? They are going after an easier target," Gula says.

For companies worried about vulnerable embedded devices in their networks, the first action should be to identify every network-connected device and look for vulnerable services. No company should be running a telnet service, even inside the corporate network, Gula says.

"There are devices that you might not know are in your network, so scanning is critical," he says.

Cordoning off the devices that are known to be vulnerable from general network access is a good next step. While business users might want remote administration capabilities, such convenience sacrifices security, says Eric Knapp, director of critical infrastructure markets for NitroSecurity.

"As soon as you give them remote access, you open up a potential security hole," Knapp says.

Finally, any company that makes an appliance or embedded device needs to solve the problem of patches that significantly lag vulnerabilities, Tenable's Gula says. Companies should push their vendors to find ways to securely speed up patch deployment, similar to the major software vendors in the personal computer market.

"We are familiar with Microsoft Tuesday; there is nothing like a Cisco Wednesday," Gula says. "You really need transparency with embedded devices to figure out what patches are necessary."

Yet embedded systems will likely always take longer to patch, says Marc Brown, vice president of tools for Wind River. Many embedded device manufacturers will be able to speed up patch distribution and close security holes, especially on network-connected devices. However, more deeply embedded systems, such as industrial control and monitoring equipment, will not have an easy path to patches, he says.

"You will have high-end devices, like Android phones, that will be patchable, and low-end ones that won't be updated and so still have risk," Brown says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-12
A Cross SIte Scripting (XSS) vulnerability exists in Dhcms 2017-09-18 in guestbook via the message board, which could let a remote malicious user execute arbitrary code.
PUBLISHED: 2021-05-12
Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update' via the 'surname' parameter.
PUBLISHED: 2021-05-12
Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/saveNote' via the 'nota' parameter.
PUBLISHED: 2021-05-12
Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter.
PUBLISHED: 2021-05-12
Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter.