DNS rebinding attack puts half a billion IoT devices at risk

By Waqas Armis, an Internet of Things IoT security vendor and cyber-security firm, reports that about half a billion smart devices being used around the globe are vulnerable to a decade-old attack called DNS rebinding. It is the same firm that previously detected the presence of a BlueBorne...

D-Link, Dasan Routers Under Attack In Yet Another Assault

Unpatched D-Link and Dasan GPON router vulnerabilities are being targeted by hackers attempting to build a botnet army, according to research published Friday by eSentire Threat Intelligence. Researchers observed on Thursday a massive uptick in exploit attempts from over 3,000 different source IP...

Chinese Hackers Mount Espionage Campaign During Trump-Putin Summit

Cyberattackers, unsurprisingly, appear to be interested in Donald Trump as an intelligence target – as evidenced by an uncharacteristic spate of strikes against IoT devices in Finland during the American president’s summit there with Russia’s Vladimir Putin. According to researchers, the uptick w...

EU Cybersecurity Act IoT FAIL

The EU recently announced that its plans for a Cybersecurity Act had been backed by industry committee MEPs. This was a significant opportunity for consumer IoT security to be regulated and resolve the current mess. Sadly, they’ve stopped short and made the code voluntary for all but certain...

DDoS Attacks Get Bigger, Smarter and More Diverse

Distributed denial of service attacks, bent on taking websites offline by overwhelming domains or specific application infrastructure with massive traffic flows, continue to pose a major challenge to businesses of all stripes. Being knocked offline impacts revenue, customer service and basic...

Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Default Credentials

Summary The new IPn4Gb provides a rugged, industrial strength wireless solution using the new and ultra fast 4G LTE cellular network infrastructure. The IPn4Gb features integrated Firewall, IPSec / VPN & GRE Tunneling, IP/MAC Access Control Lists. The IPn4Gb can transport critical data to and fro...

A week in security (July 9 – July 15)

Last week, we talked about domestic abuse fuelled by IoT, doing threat intel programs right, blocking ICO fraud, and man-in-the-middle attacks. We also explained why we block shady ad blockers and provided tips to online shoppers for Prime Day. Other news: Reports revealed that low-end Android...

Microhard Systems 3G/4G Cellular Ethernet And Serial Gateway Remote Root

Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Remote Root Exploit Vendor: Microhard Systems Inc. Product web page: http://www.microhardcorp.com Affected version: IPn4G 1.1.0 build 1098 IPn3Gb 2.2.0 build 2160 IPn4Gb 1.1.6 build 1184-14 IPn4Gb 1.1.0 Rev 2 build 1090-2 IPn4Gb 1.1.0 R...

IoT domestic abuse: What can we do to stop it?

Some 40 years ago, the sci-fi/horror film Demon Seed told the tale of a woman slowly imprisoned by a sentient AI, which invaded the smart home system her husband had designed to manage it. The AI locked doors, windows, turned off communications, and even put a synthesised version of her onscreen ...

How the Industry 4.0 Era Will Change the Cybersecurity Landscape

Today’s highly automated and connected smart factories Industry 4.0 were born out of yesterday’s steam engines that mechanized manufacturing Industry 1.0; mass-production lines expanded with the advent of electricity Industry 2.0; and then IT-enabled manufacturing plants ushered in the era of...

Department of Commerce Report on the Botnet Threat

Last month, the US Department of Commerce released a report on the threat of botnets and what to do about it. I note that it explicitly said that the IoT makes the threat worse, and that the solutions are largely economic. The Departments determined that the opportunities and challenges in workin...

Intel® Converged Security Management Engine (Intel® CSME) 11.x issue

Summary: In an effort to continuously improve the robustness of the Intel® Converged Security Management Engine Intel® CSME, Intel has performed a security review of its Intel® CSME with the objective of continuously enhancing firmware resilience. Description: In an effort to continuously improve...

Zero Day Initiative: A 1H2018 Recap

When the Zero Day Initiative ZDI was formed in 2005, the cyber threat landscape was a bit different from what we see today. Threats were a little less sophisticated, but there was one thing that we saw then that we still see now: the shortage of cybersecurity professionals and researchers. The te...

Keeping False Positives in Check

In 2017, seven out of ten organizations said their security risks increased significantly, according to a Ponemon Institute study. This is no surprise given that last year organizations suffered the largest ransomware outbreak in history WannaCry and vulnerabilities such as Meltdown and Spectre...

DNS Rebind Toolkit - A Front-End JavaScript Toolkit For Creating DNS Rebinding Attacks

DNS Rebind Toolkit is a frontend JavaScript framework for developing DNS Rebinding exploits against vulnerable hosts and services on a local area network LAN. It can be used to target devices like Google Home, Roku, Sonos WiFi speakers, WiFi routers, "smart" thermostats, and other IoT devices. Wi...

Newsmaker Interview: VDOO CEO Talks Top IoT Threats

IoT security is like a game of Whac-A-Mole. Fix one CVE and four new bugs pop up. Last month, researchers found a slew of vulnerabilities in Axis cameras that could enable an attacker to access camera video streams, control the camera, add it to a botnet or render it useless. Also in June, IP...

Major Vulnerabilities in Foscam Cameras

For the past several months, VDOO’s security research teams have been undertaking broad-scale security research of leading IoT products, from the fields of safety and security. In most cases, the research was carried out together with the device vendors for the sake of efficiency and transparency...

This Week in Security News: Rules and Regulation

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, House lawmakers approved legislation for securing technology used to power critical infrastructures from cyberattacks. Read on to learn more...

Spoofing Vulnerability

The Azure IoT Device Provisioning AMQP Transport library is vulnerable to spoofing due to improper validation of certificates over the AMQP protocol. The vulnerability affects C SDK, C SDK and Java SDK...

BWS Systems HA-Bridge is Bridge Application for IoTAnd They do not require any certification

BWS Systems HA-Bridge is Bridge Application for IoTAnd They do not require any certification There are 607 HA-Bridge had Exposed on the internet in ZoomEye : https://www.zoomeye.org/searchResult?q=%22HA%20Bridge%22 Bridge Device list unauth acceess Bridge Settings page http://xx.xx.xx.xx/!/system...