CVE-2018-0270

CVE-2018-0270 describes a CSRF vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) that could let an unauthenticated, remote attacker perform arbitrary actions with the privileges of the logged-in user by tricking them into following a malicious link....

Cisco IoT Field Network Director Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco IoT Field Network Director IoT-FND could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and alter the data of existing users and groups on an affected device. The vulnerability is due to...

Hijacking Philips Hue

We were filming a smart home hacking piece on the 5th May this year. Like most home users, the Wi-Fi PSK wasn’t strong enough, so we cracked it and joined the network. The user had a Philips Hue lighting system. None of us here had looked at Hue before - we made an assumption after the previous...

Riccardo Di Blasio joins Wallarm as an advisor

We are excited to welcome Riccardo Di Blasio to Wallarm advisory team. Riccardo is a well known industry executive who brings his experience running go-to-market operations and managing business worldwide for large internationals like EMC Corp and VMware, including RSA Security. Riccardo’s...

A week in security (May 7 – May 13)

Last week on Labs, we looked at the case of a fake Android AV, an annoying adware that goes by the name of Kuik, the return of threat actors behind the Shopper Stop tech scam, a new Netflix phishing scam, the recent zero-day vulnerability in Internet Explorer, and the insufficiency of merely...

SiteOmat Station Automation Software Multiple Vulnerabilities

A few months ago, while undertaking unrelated research into online connected devices, we uncovered something surprising and realized almost immediately that we could be looking at a critical security threat. What we found was a simple purple web interface that was in fact a link to a real-life ga...

Calamp.com Incorrect Privilege Assignment

There is also a full write up on https://medium.com/@evstykas/remote-smart-car-hacking-with-just-a-phone-2fe7ca682162 Vulnerability Security Advisory ======================================================================= title: Incorrect Privilege Assignment product: lenderoutlook on...

5 Powerful Botnets Found Exploiting Unpatched GPON Router Flaws

Well, that did not take long. Within just 10 days of the disclosure of two critical vulnerabilities in GPON router at least 5 botnet families have been found exploiting the flaws to build an army of million devices. Security researchers from Chinese-based cybersecurity firm Qihoo 360 Netlab have...

Microsoft Azure IoT SDK Man-in-the-Middle Spoofing Vulnerability

Microsoft C, C and Java SDK for Azure IoT is a software development kit for developing Azure IoT Internet of Things platform applications based on the C, C and Java languages, respectively, from Microsoft Corporation, USA. A security vulnerability exists in the Microsoft C, C and Java SDK for Azu...

Bugs in Logitech Harmony Hub Put Connected IoT Devices at ‘High Risk’

Vulnerabilities found in the Logitech Harmony Hub can give adversaries root access to the device – allowing attackers to control other smart home devices linked to it, such as smart locks and connected surveillance cameras. Researchers at FireEye’s Mandiant Red team identified four vulnerabilitie...

CVE-2018-8119

A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability." This affects C SDK, C SDK, Java SDK...

CVE-2018-8119

A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability." This affects C SDK, C SDK, Java SDK...

Spoofing

A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability." This affects C SDK, C SDK, Java SDK...

CVE-2018-8119

A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability." This affects C SDK, C SDK, Java SDK...

CVE-2018-8119

The CVE-2018-8119 entry describes a spoofing vulnerability in the Azure IoT Device Provisioning AMQP Transport library, where certificate validation over AMQP is improper. Affected are the Azure IoT C#, C, and Java SDKs (Device Provisioning AMQP Transport) and the vulnerability enables impersonat...

Hacking LIFX Smart LED Light bulbs to steal WiFi Passwords

Context Information Security firm has discovered a security vulnerability in LIFX smart LED light bulbs that can be remotely controlled by mobile devices. Researchers at Context Information Security have discovered a security flaw in a WiFi enabled, smart LED light LIFX bulb that can be remotely...

Sierra Wireless Patches Critical Vulns in Range of Wireless Routers

Sierra Wireless has patched two critical vulnerabilities for its range of wireless gateways that would leave the enterprise devices helpless to an array of remote threats, including the charms of the Reaper IoT botnet. The more critical of the two with a 9.4 CVSSv3 Temp Score is a...

Azure IoT SDK Spoofing Vulnerability

A spoofing vulnerability exists for the C and Java SDKs in the Azure IoT Device Provisioning AMQP Transport library which improperly validates certificates over the AMQP protocol. The same vulnerability exists for the C SDK in the Azure IoT Device library running on Windows devices. An attacker w...

BACKDOOR IN SONY IPELA ENGINE IP CAMERAS

EC Consult has found a backdoor in Sony IPELA Engine IP Cameras, mainly used professionally by enterprises and authorities. This backdoor allows an attacker to run arbitrary code on the affected IP cameras. An attacker can use cameras to take a foothold in a network and launch further attacks,...

Multiple Microsoft Azure IoT SDKs CVE-2018-8119 Man in the Middle Spoofing Vulnerability

Description Multiple Microsoft Azure IoT SDKs are prone to a security vulnerability that may allow attackers to conduct spoofing attacks. A man-in-the-middle attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies...