India's largest platform for AI & Analytics leaders, professionals & aspirants

Sign in

India's largest platform for AI & Analytics leaders, professionals & aspirants

3AI Digital Library

IoT devices at risk from Amnesia:33

3AI December 11, 2020

A new series of vulnerabilities dubbed Amnesia:33 puts millions of IoT devices at risk of being compromised.

Security researchers from Forescout disclosed the 33 vulnerabilities today. The flaws are found in four open-source TCP/IP libraries used in the firmware of products from over 150 vendors.

According to the researchers’ estimates, millions of consumer and enterprise IoT devices are at risk from Amnesia:33 vulnerabilities.

The affected libraries are uIP, FNET, picoTCP, and Nut/Net. Manufacturers have used these libraries for decades to add TCP/IP support to their products.

Here are the number of vulnerabilities discovered in each library:

  • uIP – 13
  • picoTCP – 10
  • FNET – 5
  • Nut/Nut – 5

uIP, the most vulnerable library, was also found to be used in the highest number of vendors.

Forescout also analysed the following libraries but did not find any vulnerabilities: lwIP, CycloneTCP, and uC/TCP-IP. 

Due to the prevalence of these libraries, just about every type of connected hardware is impacted by Amnesia:33—from SoCs to smart plugs, from IP cameras to servers.

Unlike the previously disclosed Ripple20 vulnerabilities, Amnesia:33 primarily affects the DNS, TCP, and IPv4/IPv6 sub-stacks.

Ripple20 and Amnesia:33 vulnerabilities both predominately consist of Out-of-Bounds Read, followed by Integer Overflow.

IoT devices (46%) represent the highest number of affected device types, according to Forescout’s research. This is followed by OT/BAS and OT/ICS at 19 percent, and then IT at 16 percent.

(Disclaimer: The opinions expressed in this column are that of the writer. The facts and opinions expressed here do not reflect the views of www.xtechalpha.com.)

    3AI Trending Articles

  • Data Governance: Three trends in 2021

    In 2021, the focus of financial services will be inclined to enable digital customer journeys as well as to sustain and grow revenue streams.   Actively governing data will make managing it more formalized thus making it more available, less complex to understand, and protect the customers’ data rights. Three principles and associated formalized dimensions […]

  • Human Behavior & Human Data: Beyond Big Data

    In recent years, there has been a lot of hype around “big” data in the marketing world. Big data is extremely helpful with gathering quantitative information about new trends, behaviors and preferences, so it’s no wonder companies invest a lot of time and money sifting through and analyzing massive sets of data. However, what big data fails […]

  • Upside AI to use ML to make Fundamental Investment Decisions

    The pandemic has made humans more dependent on technology, be it for working, shopping and now even for investing. Upside AI — a SEBI registered Portfolio Management Service (PMS) is among the first funds in India to use machine learning to make fundamental investment decisions. The technology-focused fund believes that the next Warren Buffett would […]

  • Practical insights and best practices for Fine Tuned LLM based use cases for Governed Enterprises

    Featured Article: Author: Aditya Khandekar, President, Corridor Platforms India Objective There has been a lot of hype around Large Language Models (LLM) and their potential, but harnessing them to build real-world enterprise grade use cases is hard. This blog highlights key best practices and insights for building LLM powered use cases with a working example. […]