India's largest platform and marketplace for AI & Analytics leaders & professionals

Sign in

India's largest platform and marketplace for AI & Analytics leaders & professionals

3AI Digital Library

IoT devices at risk from Amnesia:33

3AI December 11, 2020

A new series of vulnerabilities dubbed Amnesia:33 puts millions of IoT devices at risk of being compromised.

Security researchers from Forescout disclosed the 33 vulnerabilities today. The flaws are found in four open-source TCP/IP libraries used in the firmware of products from over 150 vendors.

According to the researchers’ estimates, millions of consumer and enterprise IoT devices are at risk from Amnesia:33 vulnerabilities.

The affected libraries are uIP, FNET, picoTCP, and Nut/Net. Manufacturers have used these libraries for decades to add TCP/IP support to their products.

Here are the number of vulnerabilities discovered in each library:

  • uIP – 13
  • picoTCP – 10
  • FNET – 5
  • Nut/Nut – 5

uIP, the most vulnerable library, was also found to be used in the highest number of vendors.

Forescout also analysed the following libraries but did not find any vulnerabilities: lwIP, CycloneTCP, and uC/TCP-IP. 

Due to the prevalence of these libraries, just about every type of connected hardware is impacted by Amnesia:33—from SoCs to smart plugs, from IP cameras to servers.

Unlike the previously disclosed Ripple20 vulnerabilities, Amnesia:33 primarily affects the DNS, TCP, and IPv4/IPv6 sub-stacks.

Ripple20 and Amnesia:33 vulnerabilities both predominately consist of Out-of-Bounds Read, followed by Integer Overflow.

IoT devices (46%) represent the highest number of affected device types, according to Forescout’s research. This is followed by OT/BAS and OT/ICS at 19 percent, and then IT at 16 percent.

(Disclaimer: The opinions expressed in this column are that of the writer. The facts and opinions expressed here do not reflect the views of www.xtechalpha.com.)

    3AI Trending Articles

  • Mental Health Startup Wysa backed by Google In Series A Round

    Wysa is artificial intelligence (AI)-driven virtual coach that combines empathetic listening with evidence-based therapeutic techniques Bengaluru-based mental health startup Wysa is looking to raise funds from Google, the company’s filings with the ministry of corporate affairs (MCA) confirm.  The filings, which contain Wysa parent Touchkin Eservices Private Limited’s articles of association (AOA), read, ‘“Series A1 […]

  • Global Captive Centers – The true enablers of Collaboration (Part-1)

    Featured Article: Author: Vinodh Ramachandran, Neiman Marcus Group Through my experience working for large retail GCCs I. have observed that most retailers, in addition to having a central data & analytics team (typically within tech rolling up to the CIO), also have analytics teams within the businesses running independently and managing all their data, reporting […]

  • CES 2021 conference stress importance of security education

    Experts at the CES 2021 conference stress importance of security education The “second age” of quantum computing is poised to bring a wealth of new opportunities to the cybersecurity industry – but in order to take full advantage of these benefits, the skills gap must be closed. This was the takeaway of a discussion between […]

  • Future Proofing GCCs

    For a while now, India has been driving back-office functions for some of the large enterprises across the world. However, over the past few years, it has taken giant strides towards becoming the innovation hub of the world, by adding strategic value to multi-billion-dollar businesses from around the world, through Global Capability Centres (GCCs) based […]