How to secure your IoT deployment during the security talent shortage

Businesses across industries are placing bigger and bigger bets on the Internet of Things IoT as they look to unlock valuable business opportunities. But time and time again, as I meet with device manufacturers and businesses considering IoT deployments, there are concerns over the complexity of...

Kids Tracker Watches: CloudPets, exploiting athletes and hijacking reality TV

Kids smart tracker watch security: everyone has missed the point. It’s not a few thousand here and there. It’s at least 47 million, probably around 150 million exposed tracking devices. It all points back to two or three lazy device manufacturers, much like Mirai v1 did There have been lots of...

Echobot IoT Botnet Casts a Wide Net with Raft of Exploit Additions

A variant of the Mirai Internet of Things IoT botnet known as “Echobot” has added 13 more vulnerability exploits to its bag of infiltration tricks, according to researchers. These target a range of devices, including routers, firewalls, IP cameras, server management utilities, a programmable logi...

Why Ring Doorbells Perfectly Exemplify the IoT Security Crisis

A new wave of reports about the home surveillance cameras getting hijacked by creeps is painfully familiar...

Your Smart Christmas Lights Are Safer Than They Were Last Year

Thinking about putting up smart Christmas lights but worried about your internet of things IoT security? You can rest a bit easier this year because at least one festive light option is a bit safer than it used to be, new research has found. Manufacturers of the Twinkly smart lights have taken in...

CVE-2019-10592

Possible integer overflow while multiplying two integers of 32 bit in QDCM API of get display modes as there is no check on the maximum mode count in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

CVE-2019-2288

Out of bound write in TZ while copying the secure dump structure on HLOS provided buffer as a part of memory dump in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired...

Design/Logic Flaw

Use after free issue occurs when command destructors access dynamically allocated response buffer which is already deallocated during previous command teardwon sequence in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice ...

Design/Logic Flaw

Snapshot of IB can lead to invalid address access due to missing check for size in the related function in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

Design/Logic Flaw

Out of bound read would occur while trying to read action category and action ID without validating the action length of the Rx Frame body in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile,...

Hardcoded credentials

HLOS could corrupt CPZ page table memory for S1 managed VMs in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845, SDM670, SDM710,...

CVE-2019-2337

CVE-2019-2337 describes a buffer-read flaw in Qualcomm’s Snapdragon hardware/firmware where EMM may read beyond the declared message length while skipping unknown IES. The issue is linked to multiple Snapdragon platforms (Auto, Compute, Consumer IoT, Industrial IoT, Mobile, Wearables) and a long ...

CVE-2019-2319

CVE-2019-2319 affects Qualcomm Snapdragon platforms (Auto, Compute, Connectivity, IoT, Mobile, etc.) where the HLOS may corrupt CPZ page table memory for S1 managed VMs. Root cause is memory corruption in the CPZ page table handling. The CVSSv3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) yield...

CVE-2019-2310

Out of bound read would occur while trying to read action category and action ID without validating the action length of the Rx Frame body in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile,...

CVE-2019-10571

Snapshot of IB can lead to invalid address access due to missing check for size in the related function in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

CVE-2019-10571

CVE-2019-10571 targets Qualcomm Snapdragon family GPUs/graphics drivers (listed APQ/MSM/SDM devices) with a memory-access flaw: a missing size check in a function can lead to invalid address access. Public references show vendor advisories (Qualcomm November 2019 bulletin) and cross-links in Red ...

CVE-2019-10530

CVE-2019-10530 involves a kernel-level buffer overflow caused by a missing check for data truncation in Qualcomm Snapdragon kernel components. Affected are numerous Snapdragon families (Auto, Consumer IoT, Industrial IoT, Mobile, Voice & Music, Wearables) across many SDM and Snapdragon Snapdragon...

CVE-2019-10545

CVE-2019-10545 is a Qualcomm/ Snapdragon GPU-related vulnerability: a null pointer dereference in the kernel due to a missing LLC support check in the GPU. Affected are Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Mobile, and Snapdragon Voice ...

PT-2019-11939

Name of the Vulnerable Software and Affected Versions QDCM API versions affected versions not specified Description The issue is related to a possible integer overflow while multiplying two integers of 32 bit in the QDCM API of get display modes. This occurs because there is no check on the maxim...

Serious Security Flaws Found in Children's Connected Toys

Various connected toys for children – hot off the shelves from this holiday shopping season – have been found with deep-rooted security issues, including missing authentication for device pairing and a lack of encryption for connected online accounts. The research, formed by a partnership between...