India's largest platform and marketplace for GCCs & AI

Sign in

India's largest platform and marketplace for GCCs & AI
Become a Thought Leader
Become a 3AI Member

Sign in

3AI Digital Library

< Go Back

IoT devices at risk from Amnesia:33

3AI December 17, 2020

 

A new series of vulnerabilities dubbed Amnesia:33 puts millions of IoT devices at risk of being compromised.

Security researchers from Forescout disclosed the 33 vulnerabilities today. The flaws are found in four open-source TCP/IP libraries used in the firmware of products from over 150 vendors.

According to the researchers’ estimates, millions of consumer and enterprise IoT devices are at risk from Amnesia:33 vulnerabilities.

The affected libraries are uIP, FNET, picoTCP, and Nut/Net. Manufacturers have used these libraries for decades to add TCP/IP support to their products.

Here are the number of vulnerabilities discovered in each library:

  • uIP – 13
  • picoTCP – 10
  • FNET – 5
  • Nut/Nut – 5

uIP, the most vulnerable library, was also found to be used in the highest number of vendors.

Forescout also analysed the following libraries but did not find any vulnerabilities: lwIP, CycloneTCP, and uC/TCP-IP. 

Due to the prevalence of these libraries, just about every type of connected hardware is impacted by Amnesia:33—from SoCs to smart plugs, from IP cameras to servers.

Unlike the previously disclosed Ripple20 vulnerabilities, Amnesia:33 primarily affects the DNS, TCP, and IPv4/IPv6 sub-stacks.

Ripple20 and Amnesia:33 vulnerabilities both predominately consist of Out-of-Bounds Read, followed by Integer Overflow.

IoT devices (46%) represent the highest number of affected device types, according to Forescout’s research. This is followed by OT/BAS and OT/ICS at 19 percent, and then IT at 16 percent.

    3AI Trending Articles

  • A Framework for Analytics & AI Value Realization

    We’re living in times of a great data paradox. One side of the paradox is the explosive growth of data in and around us. Here are some facts reported in IDC’s Global Data Sphere to corroborate this: – 59 Zettabytes – total volume of data processed in the year 2020– 26% CAGR – the forecasted […]

  • Carlyle is the frontrunner to acquire Mphasis from Blackstone

    Carlyle Group is negotiating with at least half a dozen banks and a pension fund to buy out Blackstone’s stake in Mphasis. Binding offers due today. Mumbai: Private equity firm Carlyle Group has emerged as a probable frontrunner to acquire Mphasis Ltd. from Blackstone Group, in what could be the largest buyout in the Indian IT space, according to people familiar […]

  • Cloud Neutrality

    A multibillion-dollar, privately-owned infrastructure is now essential to the modern internet economy. That should freak you out. WE SPENT A lot of years talking about net neutrality—the idea that the companies that provide access to the internet shouldn’t unfairly block, slow down, or otherwise interfere with traffic even if that traffic competes with their services. But there’s […]

  • Property Registration in Karnataka to use Blockchain Technology

    Property registration in Karnataka is all set to become more secure and hassle-free, with the state government developing a system based on blockchain technology for online property documentation. The new system, developed in collaboration with IIT-Kanpur, promises an immutable electronic storage of property data through blockchain. In other words, data once stored cannot be changed, […]