From Log4j to Trend Micro Home Security, here are the most important vulnerabilities we saw last year
With 2021 wrapped up, we’re taking a look back at a year that saw a 50% rise in IoT attacks in just six months. Our prediction for 2022: more of the same – and companies getting competitive about their proactive approaches to product security.
The past year’s top 12 vulnerabilities encompass everything from software supply chain issues to configuration flaws to hard-coded passwords and crypto keys. Let’s take a look at the most impactful vulnerabilities – and the ones that tell us the most about what the future holds for IoT security.
According to the Cybersecurity and Infrastructure Security Agency (CISA), Apache’s affected software library “is very broadly used in a variety of consumer and enterprise services, websites, and applications—as well as in operational technology products—to log security and performance information.”
The critical remote code execution (RCE) vulnerability, dubbed Log4Shell, affects versions 2.0 to 2.14.1 and, if exploited, would allow an unauthenticated user to control the connected system for anything from data theft to cryptomining.
According to CISA, hundreds of millions of devices are likely to be affected by Log4Shell and the agency’s director, Jen Easterly, told industry leaders the vulnerability, “is one of the most serious I’ve seen in my entire career, if not the most serious.”
Large companies like Cisco and VMware released patches for their affected products. Not addressing the vulnerability could have some dire consequences, as researchers have tied the vulnerability to two botnets.
For manufacturers that use third-party packages, it’s hard to know what’s in them unless you have a tool like the Finite State platform that can find those vulnerabilities in real-time without tedious and extensive manual testing.
Finite State Tip:
Philips had a rough month of November. Early in the month it disclosed a vulnerability in its TASY Electronic Medical Record (EMR) HTML5 system, where “a successful SQL injection attack can result in confidential patient data being exposed or extracted from the TASY database.” A few days later it found three vulnerabilities in its MRI software solutions.
The worst came later in the month, when its IoT medical device interface products and platform showed vulnerabilities, according to the company’s disclosures. The Cybersecurity & Infrastructure Security Agency (CISA) also released advisories.
Vulnerabilities in Philips' Patient Information Center iX (PIC iX) and Efficia CM Series devices and the company's IntelliBridge EC40 and EC80 systems allow access to patient data and the ability to launch denial of service attacks if exploited. Philips released a remediation for improper input validation in PIC iX C.03.06 in the third quarter of 2021. It plans to remediate the use of a hard-coded cryptographic key and insecure cryptographic algorithm vulnerabilities by the end of 2022.
Hard-coded passwords are notoriously easy to hack, so that vulnerability is particularly worrisome in a medical device that handles patient information. With the rise of IoT attacks within healthcare, medical facilities need to consider something that was never part of the equation before: their own attack surface.
Finite State tip:
The stakes are a bit lower on this one, although in the wrong hands these vulnerabilities could have been more disruptive. This story came out of one of the Black Hat sessions where Kya Supa, a security consultant at LEXFO, told everyone about the time he hacked his capsule hotel. Show of hands: Who has ever wanted to teach a noisy neighbor a lesson? Supa used the iPod touch given at check-in, meant to control his room, to start messing with the noisy neighbor that wouldn’t pipe down.
In a presentation deck, Supa outlined exactly how he did it. He used six vulnerabilities and exploited them to take advantage of controls in other capsules. Via the iPod touch, guests could control the light, change the position of the adjustable bed, and control the ventilation fan. Supa’s goal was to make his noisy neighbor, Bob, believe in ghosts for at least one night.
According to Supa, the hotel was thankful to be made aware of the vulnerabilities it had created by making these capsules “smart” with iPod touch controls and made the necessary adjustments to fix those issues.
Supa’s story is amusing—well, maybe not to Bob—but also serves as a cautionary tale about how IoT devices can easily be weaponized. Manufacturers are creating new IoT and connected devices and embedded systems faster than security measures that protect these devices. At Finite State, we have the solution to keep your company safe because not all hackers are as kind as Kya Supa.
Finite State tip:
In May, we learned that Trend Micro's Home Network Security Station had bugs that left the device vulnerable. Ironically, the product that gets plugged into home routers is meant to prevent internet-connected devices from being hacked.
Researchers at Cisco Talos found three vulnerabilities in the device, two of which are elevations of privilege. The third is a hard-coded password vulnerability that exists in the SFTP Log Collection Server function. If exploited, attackers could carry out denial of service (DoS) attacks, escalate privileges, and execute code. Trend Micro remediated the issue through an update.
While the researchers didn’t observe any exploits in the wild, it’s still unnerving for consumers that were hoping to protect their devices to find a vulnerability in the security system. This is one of the reasons we at Finite State are in full support of requiring manufacturers to create a Software Bill of Materials (SBOM). This is the best way to know what is in a connected device before it is deployed.
Finite State tip:
An advisory from the Cybersecurity and Infrastructure Agency (CISA) found in June that defibrillator management software by Zoll was littered with vulnerabilities. According to the advisory, “Successful exploitation of these vulnerabilities could allow remote code execution, allow an attacker to gain access to credentials, or impact confidentiality, integrity, and availability of the application.”
The actual defibrillators weren’t at risk of being compromised, but the software had six vulnerabilities that put data in the crosshairs for attackers. One of the vulnerabilities showed that credentials were stored in plaintext, allowing attackers to gain access to sensitive information. The highest scoring vulnerability was a CVSS v3 base score of 9.9 for the bug in the web application that allows virtually any user to upload a malicious file.
As healthcare organizations make a digital transformation, they have more to consider than just ease of use or cost. According to a report by Medigate and CrowdStrike, 82% of surveyed healthcare organizations reported at least one form of IoT cyberattack since May 2020. Attack surface and exposure to critical systems are now part of the calculation as healthcare systems modernize their tools.
Finite State tip:
Analysis from Forescout Research Labs informed a report called NUCLEUS:13, which identifies a baker’s dozen vulnerabilities within the Nucleus TCP/IP stack, which is a real-time operating system used in systems for aerospace, industrial, and medical applications.
Risks range from enabling remote code execution, denial of service (DoS), and information leaks. The highest scoring vulnerabilities in the bunch were improper null terminations in which the FTP server does not properly validate the length of the “MKD/XMKD, PWD/XPWD, and USER” commands, leading to stack-based buffer overflows. According to a CISA advisory, “This may result in denial-of-service conditions and remote code execution.”
Siemens, which owns Nucleus, acknowledged the vulnerabilities, has already fixed the majority of them through software updates, and recommends countermeasures for products where updates are not available. Researchers “found close to 5,500 devices from 16 vendors in place at 127 customers. Thirteen of these customers had more than 100 vulnerable devices, with healthcare being the most impacted sector.”
Finite State tip: