Open Source Flaw ‘Devil’s Ivy’ Puts Millions of IoT Devices at Risk | Software

Millions of IoT devices are vulnerable to cybersecurity attacks due to a vulnerability initially discovered in remote security cameras,
Senrio reported this week.

The firm found the flaw in a security camera developed by Axis Communications, one of the world’s biggest manufacturers of the devices.

The Model 3004 security camera is used for security at the Los Angeles International Airport and other places, according to Senrio.

The problem turned out to be a stack buffer overflow vulnerability, which the firm dubbed “Devil’s Ivy.”

Axis notified the security firm that 249 different models of the camera were affected by the vulnerability. It found only three models that were unaffected.

Buried Deep

The problem lies deep in the communication layer of
gSOAP, an open source third-party toolkit that is used by all kinds of device makers for IoT technology, according to Senrio.

gSOAP manager Genivia reported that the toolkit has been downloaded more than 1 million times, according to Senrio. Most of the downloads likely involved developers. Major companies including IBM, Microsoft, Adobe and Xerox are customers of the firm.

Genivia
issued a new patch for gSOAP within 24 hours of being alerted to the vulnerability, and said it notified customers of the problem, according to CEO Robert van Engelen.

The obscure flaw was caused by an intended integer underflow, followed by a second unintended integer underflow that triggered the bug, he told LinuxInsider.

“The trigger happens when at least 2 GB of XML data is uploaded to a Web server,” van Engelen explained. “This bug was not discovered by proprietary static analysis tools or by our source code users who looked at the source code since 2002.

Certain ONVIF devices act as Web servers, making them vulnerable when configured to accept more than 2 GB of XML data, he noted.

Wide-Ranging Problem

Many large manufacturers are using the same source, the ONVIF forum, for their networking protocol libraries, noted Ryan Spanier, director of research at
Kudelski Security.

Because it is a shared library, the vulnerability exists in a large number of devices, he told LinuxInsider.

“Companies regularly integrate hardware and software into their devices that they did not write themselves,” Spanier said. “In some ways, this is similar to the Mirai botnet, but in that case they targeted an insecure backdoor present in a chip used by multiple camera manufacturers.”

The Mirai botnet, which struck last year, was one of the biggest incidents ever recorded, targeting the KrebsOnSecurity blog with a massive DDoS attack that measured 620 gigabytes per second.

An incident like Devil’s Ivy was inevitable, observed Bryan Singer, director of industrial cybersecurity services at
IOActive.

“In the veritable push to technology, it is all too common that the drive towards first-to-market functionality will badly outpace solid, secure design,” he told LinuxInsider. “Unfortunately, this head-smack moment is all too common.”

Vendors need to audit components appropriately for security purposes, Dustin Childs, communications manager for Trend Micro’s zero day initiative, told LinuxInsider, as “misunderstood or poorly implemented open source software allows attackers a path to bypass security mechanisms.”

David Jones is a freelance writer based in Essex County, New Jersey. He has written for Reuters, Bloomberg, Crain’s New York Business and The New York Times.

The post Open Source Flaw ‘Devil’s Ivy’ Puts Millions of IoT Devices at Risk | Software appeared first on Nigerian News 24/7 | ElotiTV.com.


by Eloti TV via Nigerian News 24/7 | ElotiTV.com

Comments

Post a Comment

Popular posts from this blog

A Genius Former Hacker Explains How to Keep Your Business Safe From Cyber Attacks

Image
Free Webinar | August 16th Find out how to optimize your website to give your customers experiences that will have the biggest ROI for your business. Register Now » With an IQ of 197, Walter “Scorpion” O’Brien has the fifth highest intelligence in the world. After hacking into NASA on a lark, O’Brien was offered a job as a government contractor solving for high-level cybersecurity risks. Today, the genius hacker is a multimillionaire who continues his work as founder and CEO of Scorpion Computer Services, employing the brightest minds and best communicators around the globe. Entrepreneur Network partners Scott Duffy and Alan Taylor caught up with O’Brien at Cassell’s Hamburgers in Los Angeles where Chef Christian prepares the mouthwatering B’fast Burger. Tune in for simple tips to minimize cyber threats for your small business. Related:  Betting Big and Crafting a Winning Elevator Pitch with Dan Fleyshman Watch more videos from Business & Burgers on their  You...
Read more

Great Place to Work and Nigerian companies

The new Country Director for Great Place To Work Nigeria, an affiliate of Peoples Productivity Solutions (PPS) Africa, the parent company of Great Place to Work UK, Dr. Gonzalo Shoobridge, has pledged the company’s commitment to partnering with Nigerian companies on global best practices. Great Place to Work is a global research, consulting and training firm, which helps organisations identify, create and sustain great workplaces through the development of high trust workplace cultures. Speaking at the fifth award ceremony of Great Place to Work Nigeria, recently in Lagos, Shoobridge said: “We are bringing best practices here so we can share them with Nigerian organisations that want to become best work places.” According to him, the objective was to have best workplaces in Nigeria, “because if we improve the workplace, we are going to improve the society as a whole.” Shoobridge, who brings over 20 years experience in diverse international business development and human resource co...
Read more

PDP Convention: Babatope calls for Makarfi-led NCC’s resignation

Image
By Dapo Akinrefon FORMER Minister of Transport, Chief Ebenezer Babatope has called on members of the Caretaker Committee of the People’s Democratic Party, PDP, headed by Senator Ahmed Makarfi to resign accusing it of plotting to distort the processes that will midwife a new leadership for the party. Babatope, in a statement, accused Makarfi of working towards handing over the chairmanship seat to a candidate supported by Governor Nyesom Wike of Rivers State. The former minister disclosed that there is a plan to distort the process of electing a national chairman of the party warning that any attempt to force upon the party a “discredited and dubious leadership will provoke a mass decamping of the Yoruba people from the PDP.” He said: “There is no doubt in my mind now that Makarfi’s Caretaker Committee is virtually and entirely compromised. The statement issued today by Barrister Abdulahi Jalo, a former Deputy National Publicity Secretary of the PDP and a well known close ally of...
Read more