Microsoft Azure IoT SDK CVE-2018-8479 Spoofing Vulnerability

Description Microsoft Azure IoT SDK is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. Successful exploits may allow attackers to perform man-in-the-middle attacks or impersonate server, which will aid in further attacks. Technologies Affected Microsoft C S...

Intel® IoT Developers Kit Permissions Advisory

Summary: A potential security vulnerability in Intel® IoT Developers Kit may allow escalation of privilege. Intel is releasing IoT Developers Kit updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2018-12163 Description: A DLL injection vulnerability in the Intel...

Mirai, Gafgyt Botnets Return to Target Infamous Apache Struts, SonicWall Flaws

Researchers have discovered new variants for the infamous Mirai and Gafgyt IoT botnets – now targeting well-known vulnerabilities in Apache Struts and SonicWall. The new Mirai strain targets the Apache Struts flaw associated with the 2017 Equifax breach, while the Gafgyt variant uses a...

This Week in Security News: Tracking and Hacking

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Google revealed a secret deal with Mastercard that allows it to track what users buy offline. Also, Senate and House representatives warn th...

The Risk of IoT Security Complacency

Trend Micro recently surveyed 1,150 IT executives globally. We found a gap between the perceived risk from IoT and the planned mitigation for that risk. Most senior executives recognize that IoT can introduce security risk to the organization, but few will invest resources to remediate that risk...

Libelium Meshlium IoT Gateway Detection

Detection of Libelium Meshlium IoT Gateway. The script sends a connection request to the server and attempts to detect Libelium Meshlium IoT Gateway and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

Alleged ‘Satori’ IoT Botnet Operator Sought Media Spotlight, Got Indicted

A 20-year-old from Vancouver, Washington was indicted last week on federal hacking charges and for allegedly operating the "Satori" botnet, a malware strain unleashed last year that infected hundreds of thousands of wireless routers and other "Internet of Things" IoT devices. This outcome is hard...

Authentication flaw

An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. Devices did not authenticate themselves to the cloud in device to...

Code injection

An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. The process of registering a device with a cloud account was based o...

Command injection

An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. The SSL/TLS server certificate in the device to cloud communication...

Critical Flaws in Syringe Pump, Device Gateways Threaten Patient Safety

Two previously undocumented, critical vulnerabilities in widely deployed medical devices have sparked patient-safety and data-privacy concerns. Flaws in the Qualcomm Life Capsule Datacaptor Terminal Server and the Becton Dickinson BD Alaris TIVA Syringe Pump have been acknowledged by the vendors...

Newsmaker Interview: Derek Manky on ‘Self-Organizing Botnet Swarms’

For over five years Derek Manky, global security strategist at Fortinet and FortiGuard Labs, has been helping the private and public sector identify and fight cybercrime. His job also includes working with noted groups: Computer Emergency Response, NATO NICP, INTERPOL Expert Working Group and the...

Mirai Variant Cross-Compiles Attack Code with Aboriginal Linux

Criminals behind a Mirai botnet have been spotted using an unusual technique: Leveraging an open-source project called Aboriginal Linux to create a compiled binary, with versions of the malware tailored to each targeted platform. The malware authors are leveraging Aboriginal – a legitimate tool f...

Back to Basics: Why We Need to Encourage More Secure IoT Development

The Internet of Things IoT is radically reshaping the way we live and work. Before our very eyes, organizations are becoming more agile, efficient and cost effective to run, all while consumers marvel at the wonders of the smart home, fitness trackers and connected cars. There’s just one major...

Belkin IoT Smart Plug Flaw Allows Remote Code Execution in Smart Homes

A vulnerability in a popular Wi-Fi–connected electric outlet for smart homes would allow a remote attacker to take over smart TVs and other devices, as well as execute code – potentially exposing tens of thousands of consumers to cryptomining, ransomware, information disclosure, botnet enslavemen...

IoT botnet of heaters & ovens can cause massive widespread power outages

By Uzair Amir Botnet of Smart Power-Consuming Appliances May Cause Widespread Power Outages. Digital technology has revolutionized the way we use appliances and perform day-to-day chores. Nowadays, our air conditioners are smart enough to be turned off or on remotely, washing machines send us a...

This Week in Security News: Banks and Botnets

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, the FBI warned U.S. banks of a wide-scale cybercrime campaign called “ATM cash-out,” in which hackers use cloned ATM cards for fraudulent...

Open MQTT Servers Raise Physical Threats in Smart Homes

Tens of thousands of consumer-grade Internet of Things IoT servers have been found wide-open on the internet, allowing cybercriminals to potentially compromise homeowners’ physical security. Bad actors can gain complete access to smart-home footprints to track owners’ movements, see if smart door...

BlackIoT Botnet: Can Water Heaters, Washers Bring Down the Power Grid?

We live in a world where washing machines text us when a load of laundry is finished and refrigerators can email grocery lists; but for all the convenience, it turns out that these high-wattage appliances can potentially be marshaled into something very inconvenient indeed: A wide-scale attack on...

Carrier Grade Security Means … Using Carrier Grade Security

It’s a common mistake in enterprises to copy-paste security solutions from a peer. Strategies can be recycled, but sadly with even very similar businesses almost always have radically different IT and security requirements. I recall one hospital that looked at a nearly identical peer hospital tha...