India's largest platform and marketplace for GCCs & AI

Sign in

India's largest platform and marketplace for GCCs & AI
Become a Thought Leader
Become a 3AI Member

Sign in

3AI Digital Library

< Go Back

IoT devices at risk from Amnesia:33

3AI December 11, 2020

A new series of vulnerabilities dubbed Amnesia:33 puts millions of IoT devices at risk of being compromised.

Security researchers from Forescout disclosed the 33 vulnerabilities today. The flaws are found in four open-source TCP/IP libraries used in the firmware of products from over 150 vendors.

According to the researchers’ estimates, millions of consumer and enterprise IoT devices are at risk from Amnesia:33 vulnerabilities.

The affected libraries are uIP, FNET, picoTCP, and Nut/Net. Manufacturers have used these libraries for decades to add TCP/IP support to their products.

Here are the number of vulnerabilities discovered in each library:

  • uIP – 13
  • picoTCP – 10
  • FNET – 5
  • Nut/Nut – 5

uIP, the most vulnerable library, was also found to be used in the highest number of vendors.

Forescout also analysed the following libraries but did not find any vulnerabilities: lwIP, CycloneTCP, and uC/TCP-IP. 

Due to the prevalence of these libraries, just about every type of connected hardware is impacted by Amnesia:33—from SoCs to smart plugs, from IP cameras to servers.

Unlike the previously disclosed Ripple20 vulnerabilities, Amnesia:33 primarily affects the DNS, TCP, and IPv4/IPv6 sub-stacks.

Ripple20 and Amnesia:33 vulnerabilities both predominately consist of Out-of-Bounds Read, followed by Integer Overflow.

IoT devices (46%) represent the highest number of affected device types, according to Forescout’s research. This is followed by OT/BAS and OT/ICS at 19 percent, and then IT at 16 percent.

(Disclaimer: The opinions expressed in this column are that of the writer. The facts and opinions expressed here do not reflect the views of www.xtechalpha.com.)

    3AI Trending Articles

  • Cybersecurity Challenges: Fourth Greatest Danger to Global Economy

    The 2021 World Economic Forum (WEF) Global Risk Report, used for over a decade by organizations around the world as a risk assessment tool, has named “cybersecurity challenges” as the fourth most pressing danger to the global economy. The ranking is determined by responses to a survey conducted among various stakeholders and organizations affiliated with […]

  • AI readiness – CEO’s most strategic agenda

    For the larger mass of professionals, the words “artificial intelligence,” or AI, often conjure up images of robots, the sorts of robots that might someday take their jobs. But at the enterprise level, AI means something different. It has enormous power and potential: it can disrupt, innovate, enhance, and in many cases totally transform a business. […]

  • Lessons in Failing to Apply Blockchain to combat C19

    This year 2020 has seen quite a variety of exciting developments in the blockchain space. To name just a few: the emergence of decentralized finance (DeFi) and non-fungible tokens (NFTs) as major economic forces and sources of crypto network user tractions, the maturation of layer 2 Ethereum solutions and the rollout of a variety of […]

  • 2020 marked a “turning point” for Cybersecurity in Australia

    Australians are on high alert about the threat of cyber attacks following Prime Minister Scott Morrison’s warning in June that Australia was targeted by a sophisticated “state-based” cyber-attack. It was, according to the Australian Cyber Security Centre (ACSC), the most significant and coordinated cyber-targeting against Australian institutions to date. The Prime Minister said while such […]