Security researchers from Forescout and JSOFhave discovered and analyzed vulnerabilities Name: Wreck, which could allow attackers to compromise Internet of Things (IoT) devices.
The nine security vulnerabilities affect millions of IoT devices and allow cybercriminals to take the devices offline, them remotely, and exploit them in attacks that could be leveraged to gain broader access to affected networks.
See also: Over 60% increase in ransomware and IoT malware detections
The vulnerabilities, which affect four TCP/IP stacks – communication protocols commonly used in IoT devices – are related to Domain Name System (DNS) implementations, and criminals can use them for Denial of Service (DoS) attacks and remote code execution (RCE). It is possible that more than 100 million IoT devices are affected.
Security researchers at Forescout and JSOF analyzed the vulnerabilities, which they named Name:Wreck due to the way that parsing of domain names can affect DNS implementations in the TCP/IP stack, leading to possible attacks.
The report follows Forescout's previous research into vulnerabilities in IoT devices and is part of Project Memoria, an initiative that examines vulnerabilities in TCP/IP stacks and recommends mitigation solutions. The vulnerabilities were discovered in popular stacks including Nucleus NET, FreeBSD , and NetX.
See also: Bug bounties: Increase in hackers reporting bugs for web, IoT, mobile
Security patches have already been released for the vulnerabilities, but oftentimes they are difficult to apply to IoT devices, meaning that many devices may remain vulnerable to attacks.
According to Daniel dos Santos, research director at Forescout Research Labs, attackers can use vulnerabilities to gain access to networks and can then decide what type of attack to carry out.
For example, they can take IoT devices offline by sending malicious packets that crash the device. They can also execute code to spread within the network.
According to the researchers, healthcare organizations could be prime targets, as attackers would be able to access medical devices and steal private health data or even take devices offline, putting patients' lives at risk.
The vulnerabilities could also help attackers gain access to corporate networks, steal sensitive information, and impact business operations.
Therefore, organizations must promptly apply the necessary security updates to protect their networks.
See also: SolarWinds patches critical vulnerabilities in Orion platform
“Full protection against Name:Wreck vulnerabilities requires updating devices running the vulnerable IP stacks, so we encourage all organizations to ensure they have the most up-to-date patches for all devices,” dos Santos said.
In some cases, it may not be possible to apply updates to IoT devices. In those cases, there are other measures that organizations can take to protect their networks.
“In addition to patching, which of course everyone should try, there are other things that can be done, such as network segmentation and network traffic monitoring,” dos Santos said.
Source: ZDNet
