CVE-2019-10580

CVE-2019-10580 describes a local use-after-free in the Qualcomm Snapdragon kernel: when a listener is unregistered, the listener’s private data may already have been freed. Affected are Snapdragon Auto/Compute/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables platforms (listed in the des...

Large, Complex DDoS Attacks on the Rise in 2020

While we've highlighted both record PPS and BPS attacks mitigated on the Akamai Prolexic Platform over the past few weeks, these attacks are part of a broader trend of increasingly large and complex DDoS activity. We have seen clear indications across the industry of high-water mark DDoS attacks...

Podcast: Security Lessons Learned In Times of Uncertainty

Derek Manky With the coronavirus pandemic breaking out, and corporate workforces going remote, “uncertainty is a key word” for 2020, Derek Manky, Chief, Security Insights & Global Threat Alliances at Fortinet’s FortiGuard Labs, said. The uncertain times led to an outpouring of cybercriminal...

CVE-2020-11624

An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. They do not require users to change the default password for the admin account. They only show a pop-up window suggesting a change but...

Default credentials

An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. They do not require users to change the default password for the admin account. They only show a pop-up window suggesting a change but...

CVE-2020-11624

Technical details about CVE-2020-11624 are not publicly provided in the supplied documents. Monitor for updates and advisories for AvertX cameras (HD838/HD438) to obtain concrete impact and remediation information.

CVE-2020-11624

An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. They do not require users to change the default password for the admin account. They only show a pop-up window suggesting a change but...

Sharp Spike in Ransomware in U.S. as Pandemic Inspires Attackers

The COVID-19 pandemic continues to shape the face of cybercrime in 2020, with ransomware and attacks on internet of things IoT devices seeing sharp increases in the U.S. for the first half of the year. According to SonicWall’s 2020 Cyber Threat Report ransomware attacks are up, particularly in th...

XSS Vulnerability in 158net Website Building System of Guangxi Sense IOT Technology Co.

158net is the station building system of Guangxi Perception IOT Technology Co. Ltd. 158net station building system XSS vulnerability, attackers can use the vulnerability to obtain sensitive information such as user cookies...

This Week in Security News: Trend Micro Research Discovers Cybercriminal Turf War on Routers and a Massive Twitter Breach Compromises Some of the World’s Most Prominent Accounts

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, read about Trend Micro’s report on the botnet battle for IoT territory and how attacker groups are trying to gain control of vulnerable...

Threat modelling and IoT hubs

IoT hubs are increasingly being used to provide a single point of access to the myriad of smart devices in the home. One ring to rule them all, if rather than multiple apps for different devices. When reviewing devices we often start with the single biggest security threat: unauthorised access to...

Why Application Security Should Be Considered An Enabler For Business

If you ask Alex, he won't admit being old-fashioned. He has been working in the IT industry for a while now and accepts that security is important for the business's health. But reluctant to take security as the business enabler. In today's environment, moving to digitization is a critical step...

GReAT Ideas follow-up

On June 17, we hosted our first "GReAT Ideas. Powered by SAS" session, in which several experts from our Global Research and Analysis Team shared insights into APTs and threat actors, attribution, and hunting IoT threats. Here is a brief summary of the agenda from that webinar: Linking attacks to...

Smartwatch Hack Could Trick Dementia Patients into Overdosing

Researchers are warning vulnerabilities in a smartwatch application for dementia patients could allow an attacker to convince patients to overdose. The vulnerabilities stem from the SETracker application, which is developed by Chinese developer 3G Electronics based out of Shenzhen City. The app,...

Half a Million IoT Passwords Leaked

It is amazing that this sort of thing can still happen: ...the list was compiled by scanning the entire internet for devices that were exposing their Telnet port. The hacker then tried using 1 factory-set default usernames and passwords, or 2 custom, but easy-to-guess password combinations. Telne...

RIOT buffer overflow vulnerability

RIOT RIOT-OS is a set of operating systems for applications in the IoT field. A buffer error vulnerability exists in the base64 decoder in RIOT version 2020.04, which stems from the program not properly checking boundaries. A remote attacker can exploit this vulnerability to execute arbitrary cod...

IoT Security Principles

The BSA -- also known as the Software Alliance, formerly the Business Software Alliance which explains the acronym -- is an industry lobbying group. They just published "Policy Principles for Building a Secure and Trustworthy Internet of Things." They call for: Distinguishing between consumer and...

Buffer Overflow Vulnerability in Multiple Realtek Products

Realtek RTL8195AM and others are an IoT microcontroller from Realtek Semiconductor Taiwan, China. A buffer overflow vulnerability exists in several Realtek products. A remote attacker can exploit this vulnerability to execute arbitrary code on a system with the help of specially crafted EAPOL-Key...

Afternoon Cyber Tea: Cybersecurity & IoT: New risks and how to minimize them

Recently, Microsoft announced our acquisition of CyberX, a comprehensive network-based security platform with continuous threat monitoring and analytics. This solution builds upon our commitment to provide a unified IoT security solution that addresses connected devices spread across both...

Securing the International IoT Supply Chain

Together with Nate Kim former student and Trey Herr Atlantic Council Cyber Statecraft Initiative, I have written a paper on IoT supply chain security. The basic problem we try to solve is: how to you enforce IoT security regulations when most of the stuff is made in other countries? And our...