Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/29/2014
09:15 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Internet Of Things Contains Average Of 25 Vulnerabilities Per Device

New study finds high volume of security flaws in such IoT devices as webcams, home thermostats, remote power outlets, sprinkler controllers, home alarms, and garage door openers.

A new study published this week found that among even among just a small sample of some of the most popular and prevalent Internet of Things (IoT) devices, researchers uncovered 250 vulnerabilities -- many of which were severe and resulted in remote code execution, including vulnerabilities to Heartbleed, denial of service, and cross-site scripting.

Conducted by researchers at HP Fortify, the study was meant to demonstrate what may be found when a more comprehensive and disciplined approach is taken to examining this growing new class of devices.

Daniel Miessler, practice principle for Fortify On Demand at HP Fortify, who led the project, says many of the vulnerability discoveries announced about IoT devices over the last couple of years have been one-off findings.

"We haven't really seen a comprehensive approach when people talk about it -- they might talk about one vulnerability on the device or one relevant Internet vulnerability," he says, explaining that what makes IoT devices different is their multi-faceted nature. "When you think about what all is involved in an Internet of Things device, you've got the device itself, network access, authentication, the Internet component; and all these pieces together are what stack up to be the Internet of Things device. If you're not looking at the big picture, you're missing a lot of stuff."

This is why Miessler earlier this year collaborated with researchers Craig Smith and Jason Haddix to come up with the OWASP Internet of Things Top Ten Project, which delineates the top 10 security problems seen in IoT devices and tips on how to prevent them. For the study, he used that list as a backbone for testing 10 common devices, including a webcam, home thermostat, sprinkler controller, home alarm, and garage door opener.

Among those 10 devices, HP Security Research found an average of 25 vulnerabilities per device. Seven out of 10 of the devices when combined with their cloud and mobile applications gave attackers the ability to identify valid user accounts through enumeration. Nine out of 10 devices collected at least one piece of personal information through the device or related cloud or mobile app; and six of the devices had user interfaces vulnerable to a range of web flaws such as persistent XSS.

"We had one where you were able to log in and get root access to the device, and from there you could actually run and execute commands, pivot over to various locations on the internal  network," Miessler tells us.

He explains that, though many IoT devices are marketed to consumers, these rampant vulnerabilities have quite a bit of relevance for enterprises as well.

"They're not going to be closed to the devices we have here: TVs, webcams, home thermostats. They're not adverse to rolling out prosumer versions of these products, and we're already getting pings from our large corporate customers asking how secure these exact devices are."

And that's not to mention other very corporate devices such as SCADA networks, which exhibit the same multi-faceted attack surfaces as consumer IoT devices, he says. The biggest thing he wants enterprises to realize is they need to broaden their testing horizons lest they miss some very glaring vulnerabilities.

"It's not just cloud, it's not just the device, and it's not just network security," says Miessler. "People shouldn't view it as a one-dimensional problem."

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
markoer
50%
50%
markoer,
User Rank: Apprentice
7/30/2014 | 6:06:36 AM
Re: Ok, but....
Thanks a lot, Kelly!
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
7/29/2014 | 2:43:42 PM
Re: Ok, but....
Here you go: http://fortifyprotect.com/HP_IoT_Research_Study.pdf

The link has now been added to the story, too. Thanks!
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
7/29/2014 | 2:41:22 PM
Re: Ok, but....
Here you go: http://fortifyprotect.com/HP_IoT_Research_Study.pdf

The link has now been added to the story, too. Thanks!
markoer
50%
50%
markoer,
User Rank: Apprentice
7/29/2014 | 12:08:28 PM
Ok, but....
...where is the link to the HP study?...
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
7/29/2014 | 10:53:30 AM
Re: 25 vulns/device
I think we have come to accept that all things are vulnerable, so it really boils down to a risk vs benefit/utility analysis. If vulnerabilities can be mitigated without outweighing the benefit or utility, then it becomes an organizational decision. On a personal level, my smartphone is an essential need, but the need to control my home thermostat remotely just doesn't have the same level of utility as my phone, and is the last thing I need to worry about. I guess it all comes down to a matter of priorities.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/29/2014 | 9:44:33 AM
25 vulns/device
That seems pretty high to me, but how does that compare to, for instance, a typical smartphone or tablet? I'd also be curious to know if OWASP has info abut which are most vulnerabe IoT devices on the market.
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
State of SMB Insecurity by the Numbers
Ericka Chickowski, Contributing Writer,  10/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16404
PUBLISHED: 2019-10-21
Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter.
CVE-2019-17400
PUBLISHED: 2019-10-21
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.
CVE-2019-17498
PUBLISHED: 2019-10-21
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a ...
CVE-2019-16969
PUBLISHED: 2019-10-21
In FusionPBX up to 4.5.7, the file app\fifo_list\fifo_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS.
CVE-2019-16974
PUBLISHED: 2019-10-21
In FusionPBX up to 4.5.7, the file app\contacts\contact_times.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.