Last week, JSOF published 19 vulnerabilities found in Internet of Things devices. The collection of vulnerabilities was given the name Ripple20.
JSOF is a team of experienced cyber security professionals, with a wide and deep understanding of software, technology, and security. They have deemed this situation as high risk because it affects hundreds of millions of devices. The vulnerabilities include multiple remote code executions. Some examples of such code execution are industrial control devices. They could be set to malfunction at a preset time or date. A good example is an intravenous infusion pump used in the healthcare world could have its behavior changed by this vulnerability. Imagine a drip rate changing or adding more medication than it is intended to for a patient. Even worse is that a malicious actor could hide vulnerable codes in the back end of these devices for years as they operate under normal conditions. Then one day a malicious hack is sent out for execution and this will make the devices a zero-day hack or act like sleeper agents.
Where do these vulnerabilities stem from?
The discovered vulnerabilities stem from Treck’s TCP/IP library. This is used to allow computers to communicate over long distances. Essentially, information is broken down into small packets and “sent individually over many different routes at the same time.” The “IP” in TCP/IP ensures that the packets are sent to the correct destination. Once those packets reach their destination, they are then reassembled. TCP is the portion that collects and reassembles the data to its correct form to fulfill an execution.
Many Internet of Things devices use TCP/IP, and has been in use since the 1970’s. Additionally, more than 50 major vendors may be affected. This means the vulnerabilities have been spread far and wide over a few decades.
Why is this such a big deal?
Per JSOF, “in all scenarios, an attacker can gain complete control over the targeted device remotely, with no user interaction required.” While many of the vulnerabilities were discovered in the past and there have been patch updates established, a lot of these devices continue to operate on outdated versions of TCP/IP.
Some vulnerabilities are rated as critical; meaning there could be severe ramifications if updates aren’t implemented prior to the exploit is pushed out. One such example is in the DNS protocol, which could potentially be exploited over the internet, from outside of the network. This could even occur on devices that aren’t connected to the internet.
Ok, how do we fix it?
The first step a corporation should take is to perform a risk assessment. This assessment will assist in the discovery of the potentially impacted devices. After the discovery, an update of the devices will be required. If that isn’t feasible, then a workaround will need to be in place to ensure the devices and people are safe from being comprised in the future. Treck states they have updated the latest version of TCP/IPv4/v6. Therefore, updates or mitigations are readily available. The biggest concern for corporations should not be “Do we have infected devices?”, but moreover “We discovered the known devices and have an action plan on implementing a fix”.
