CVE-2019-0729: Use of Insufficiently Random Values

An Elevation of Privilege vulnerability exists in the way Azure IoT Java SDK generates symmetric keys for encryption, allowing an attacker to predict the randomness of the key, aka 'Azure IoT Java SDK Elevation of Privilege Vulnerability'...

CVE-2019-0741

An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information Disclosure Vulnerability'...

CVE-2019-0729

An Elevation of Privilege vulnerability exists in the way Azure IoT Java SDK generates symmetric keys for encryption, allowing an attacker to predict the randomness of the key, aka 'Azure IoT Java SDK Elevation of Privilege Vulnerability'...

CVE-2019-0741

The CVE-2019-0741 entry describes an information-disclosure vulnerability in the Microsoft Azure IoT Java SDK where sensitive user data is logged. Affected component/file: the Java SDK’s logging of sensitive information. Root cause: logs may contain confidential data if logs are exposed, enabling...

CVE-2019-0741: Insertion of Sensitive Information into Log File

An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information Disclosure Vulnerability'...

CVE-2019-0729

The CVE-2019-0729 entry concerns Microsoft Azure IoT Java SDK. The connected MSRC advisory specifies the root cause as improper randomness in symmetric key generation, enabling an attacker to derive/predict the generated keys and gain elevated privileges. Affected component: Azure IoT Java SDK (k...

CVE-2019-0741

An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information Disclosure Vulnerability'...

CVE-2019-0729

An Elevation of Privilege vulnerability exists in the way Azure IoT Java SDK generates symmetric keys for encryption, allowing an attacker to predict the randomness of the key, aka 'Azure IoT Java SDK Elevation of Privilege Vulnerability'...

Privilege escalation

An Elevation of Privilege vulnerability exists in the way Azure IoT Java SDK generates symmetric keys for encryption, allowing an attacker to predict the randomness of the key, aka 'Azure IoT Java SDK Elevation of Privilege Vulnerability'...

Information disclosure

An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information Disclosure Vulnerability'...

RSA Conference 2019: How to Be Better, on Trust, AI and IoT

SAN FRANCISCO – The slogan of this year’s RSA Conference is “Better” – and accordingly, Tuesday morning’s keynotes zeroed in on reversing some of the disturbing sociological trends that have been festering of late. That includes “information warfare,” meant to undermine citizens’ trust in media a...

Beauty Out of Chaos: Elevating Cybersecurity to an Art Form – Part 1

How many of you can remember what it was like managing IT security 10 years ago? How about two decades? The truth is that the landscape was so utterly different back then that any comparisons with today are a little unfair. Yet they’re useful in one key regard: to teach us just how complex and...

Cisco, Talos tout importance of IoT security at RSA keynote

--- Matt Watchinski, the vice president of Cisco Talos, delivers a keynote address at the RSA Conference in San Francisco on Tuesday. By Jonathan Munshaw of Cisco Talos and Liza Meak of The Network, Cisco’s technology news site. By 2020, Gartner predicts 20 billion connected devices will be onlin...

BSides SF 2019: Remote-Root Bug in Logitech Harmony Hub Patched and Explained

SAN FRANCISCO – Users of Logitech’s Harmony Hub have been wide open to an attack for years because of four unpatched vulnerabilities that left any IoT device connected at risk to remote takeover. The bugs were patched by Logitech in November, but for the first time the researchers that discovered...

PT-2019-11251

Name of the Vulnerable Software and Affected Versions: Azure IoT Java SDK affected versions not specified Description: An information disclosure issue exists due to the way the Azure IoT Java SDK handles logging of sensitive information. Recommendations: At the moment, there is no information abo...

PT-2019-11250

Name of the Vulnerable Software and Affected Versions: Azure IoT Java SDK affected versions not specified Description: An issue exists in the Azure IoT Java SDK related to the generation of symmetric keys for encryption. This allows an attacker to predict the randomness of the key. Recommendation...

Can your Printer Hack your Secrets: Appweb Authorization Bypass

How IoT can pave the way for data breaches: Understanding the Appweb Authorization Bypass An engineering POV into everyday vulnerability. The everyday things you rely on may leave you vulnerable to attack. And it may not be the things themselves, but what is hiding inside. Are your IoT devices,...

How to Attack and Defend a Prosthetic Arm

The IoT world has long since grown beyond the now-ubiquitous smartwatches, smartphones, smart coffee machines, cars capable of sending tweets and Facebook posts and other stuff like fridges that send spam. Today's IoT world now boasts state-of-the-art solutions that quite literally help people...

CVE-2018-13912

CVE-2018-13912 describes an Arbitrary write in Qualcomm camera components when a kernel address is provided in compat mode on a wide range of Snapdragon platforms (e.g., Snapdragon Auto/Connectivity/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables; various SDM/SD variants). The issue ap...

CVE-2018-11932

Improper input validation can lead RW access to secure subsystem from HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in versions MDM9650, MDM9655, MSM8996AU,...