Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
4 Hurdles To Securing The Internet Of Things
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/10/2014 | 6:14:15 PM
Re: Add # 5: IoT rarely reboot so miss boot checks
Good ones. Thanks for providing the examples. 
Some Guy
50%
50%
Some Guy,
User Rank: Moderator
9/6/2014 | 1:01:48 AM
Re: Add # 5: IoT rarely reboot so miss boot checks
e.g., when was the last time you rebooted your settop box? WiFi router? NEST? iPhone?
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/5/2014 | 4:36:16 PM
Re: Add # 5: IoT rarely reboot so miss boot checks
I hadn't thought of that one, @SomeGuy. Thanks! Any particular devices you'd use as an example here that illustrate this? 
Some Guy
100%
0%
Some Guy,
User Rank: Moderator
9/5/2014 | 4:26:43 PM
Add # 5: IoT rarely reboot so miss boot checks
To your list I'd add a 5th one. Embedded real-time systems rarely reboot, so a lot of the fundamental underpinnings of cybersecurity that are checked at boot time (e.g., measured boot) don't happen often enough (if at all). If you solve 1-4 without solving this, you are building on quicksand. Maybe it should be # 0.
Sara Peters
100%
0%
Sara Peters,
User Rank: Author
9/5/2014 | 11:41:58 AM
Re: all as bad as the rest
@Kelly  Well I suppose they have to start with taking some responsibility before any of the other challenges are overcome. I wonder if the manufacturers of IoT products will start using more off-the-shelf software. Maybe that would start to make a dent in the patch management problem. 

Sigh. We're going to be talking abnout this for a long time.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/5/2014 | 11:05:03 AM
Re: all as bad as the rest
There are other issues, too, but these were the top of mind ones security experts flagged.

I think the overarching one is the taking responsibility/ownership.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
9/5/2014 | 11:00:22 AM
all as bad as the rest
Wow. I'm sitting here trying to decide which of these problems is the worst, and I can't decide because they're all dreadful. The next question I guess is which one is most likely to be overcome soonest... and I'm not sure about that either. Anyone else?


COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/1/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Attacker Dwell Time: Ransomware's Most Important Metric
Ricardo Villadiego, Founder and CEO of Lumu,  9/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24860
PUBLISHED: 2020-10-01
CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.
CVE-2020-24861
PUBLISHED: 2020-10-01
GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page
CVE-2020-25990
PUBLISHED: 2020-10-01
WebsiteBaker 2.12.2 allows SQL Injection via parameter 'display_name' in /websitebaker/admin/preferences/save.php. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVE-2020-8109
PUBLISHED: 2020-10-01
A vulnerability has been discovered in the ace.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. This can result in denial-of-service. This issue affects: Bitdefender Engines version 7.84892 and prior vers...
CVE-2019-20902
PUBLISHED: 2020-10-01
Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1.