India's largest platform and marketplace for AI & Analytics leaders & professionals

Sign in

India's largest platform and marketplace for AI & Analytics leaders & professionals

3AI Digital Library

IoT devices at risk from Amnesia:33

3AI December 11, 2020

A new series of vulnerabilities dubbed Amnesia:33 puts millions of IoT devices at risk of being compromised.

Security researchers from Forescout disclosed the 33 vulnerabilities today. The flaws are found in four open-source TCP/IP libraries used in the firmware of products from over 150 vendors.

According to the researchers’ estimates, millions of consumer and enterprise IoT devices are at risk from Amnesia:33 vulnerabilities.

The affected libraries are uIP, FNET, picoTCP, and Nut/Net. Manufacturers have used these libraries for decades to add TCP/IP support to their products.

Here are the number of vulnerabilities discovered in each library:

  • uIP – 13
  • picoTCP – 10
  • FNET – 5
  • Nut/Nut – 5

uIP, the most vulnerable library, was also found to be used in the highest number of vendors.

Forescout also analysed the following libraries but did not find any vulnerabilities: lwIP, CycloneTCP, and uC/TCP-IP. 

Due to the prevalence of these libraries, just about every type of connected hardware is impacted by Amnesia:33—from SoCs to smart plugs, from IP cameras to servers.

Unlike the previously disclosed Ripple20 vulnerabilities, Amnesia:33 primarily affects the DNS, TCP, and IPv4/IPv6 sub-stacks.

Ripple20 and Amnesia:33 vulnerabilities both predominately consist of Out-of-Bounds Read, followed by Integer Overflow.

IoT devices (46%) represent the highest number of affected device types, according to Forescout’s research. This is followed by OT/BAS and OT/ICS at 19 percent, and then IT at 16 percent.

(Disclaimer: The opinions expressed in this column are that of the writer. The facts and opinions expressed here do not reflect the views of www.xtechalpha.com.)

    3AI Trending Articles

  • From Analytics to Gen AI: Understanding the AI & ML foundations of LLM’s

    Featured Article: Author: Nikhil Bimbrahw, Genpact From the moment we wake up, to the moment we go back to sleep, technology is everywhere. The highly digital life we live in and the development of our technological world has become the new normal. According to the International Telecommunication Union (ITU), almost 50% of the world’s population uses the […]

  • Inventory Redeployment through Optimized and Automated Recommendations

    Featured Article: Author: Shrinath Bhat, Senior Data Scientist, AB InBev Supply Chain of Future (SCoF) Analytics team’s vision, which is a part of Growth Analytics Centre (GAC): the global analytics hub for Ab-InBev, is to create value via adoption of cutting-edge practices in Supply Chain domain with a series of digital transformations and advanced analytics […]

  • AI revolution in SMB-Challenges and Way Forward

    Featured Article: Author: Raj Sadasivam, Jana Analysis As most of us would agree, we are on the cusp of the third major revolution in the history of mankind. The invention of letter press in the 15th century by Gutenberg was the first and the internet revolution in the 1990s being the second. Now the world […]

  • Carlyle is the frontrunner to acquire Mphasis from Blackstone

    Carlyle Group is negotiating with at least half a dozen banks and a pension fund to buy out Blackstone’s stake in Mphasis. Binding offers due today. Mumbai: Private equity firm Carlyle Group has emerged as a probable frontrunner to acquire Mphasis Ltd. from Blackstone Group, in what could be the largest buyout in the Indian IT space, according to people familiar […]