India's largest platform and marketplace for AI & Analytics leaders & professionals

Sign in

India's largest platform and marketplace for AI & Analytics leaders & professionals
Become a Thought Leader
Become a 3AI Member

Sign in

3AI Digital Library

< Go Back

IoT devices at risk from Amnesia:33

3AI December 17, 2020

 

A new series of vulnerabilities dubbed Amnesia:33 puts millions of IoT devices at risk of being compromised.

Security researchers from Forescout disclosed the 33 vulnerabilities today. The flaws are found in four open-source TCP/IP libraries used in the firmware of products from over 150 vendors.

According to the researchers’ estimates, millions of consumer and enterprise IoT devices are at risk from Amnesia:33 vulnerabilities.

The affected libraries are uIP, FNET, picoTCP, and Nut/Net. Manufacturers have used these libraries for decades to add TCP/IP support to their products.

Here are the number of vulnerabilities discovered in each library:

  • uIP – 13
  • picoTCP – 10
  • FNET – 5
  • Nut/Nut – 5

uIP, the most vulnerable library, was also found to be used in the highest number of vendors.

Forescout also analysed the following libraries but did not find any vulnerabilities: lwIP, CycloneTCP, and uC/TCP-IP. 

Due to the prevalence of these libraries, just about every type of connected hardware is impacted by Amnesia:33—from SoCs to smart plugs, from IP cameras to servers.

Unlike the previously disclosed Ripple20 vulnerabilities, Amnesia:33 primarily affects the DNS, TCP, and IPv4/IPv6 sub-stacks.

Ripple20 and Amnesia:33 vulnerabilities both predominately consist of Out-of-Bounds Read, followed by Integer Overflow.

IoT devices (46%) represent the highest number of affected device types, according to Forescout’s research. This is followed by OT/BAS and OT/ICS at 19 percent, and then IT at 16 percent.

    3AI Trending Articles

  • Saudi Arabia to get Google Cloud services: Saudi Aramco

    Saudi Arabia, under its Vision 2030 reform plans, has encouraged foreign investment particularly in the technology sector and courted Silicon Valley players. Saudi Aramco Development Co, a subsidiary of Aramco, has teamed up with Google Cloud to offer cloud services to customers in Saudi Arabia, Aramco said on Monday. Saudi Arabia, under its Vision 2030 […]

  • PoS Terminals Open Consumers to Fraud

    Point-of-sale terminal vendors Verifone and Ingenico have issued mitigations after researchers found the devices use default passwords. Point-of-sale terminal vendors Verifone and Ingenico have issued mitigations after researchers found the devices use default passwords. Researchers are detailing widespread security issues in point-of-sale (PoS) terminals – specifically, three terminal device families manufactured by vendors Verifone and […]

  • Daimler India opens new GCC

    Daimler India Commercial Vehicles (DICV) has opened a new Global Capability Centre in Chennai with 165 seats to meet growing demand for Indian-based shared services. Spread over 20,000 sq.ft., the facility is designed to house the company’s ‘shared services’ business stream. Shared services refers to the various services DICV exports to other Daimler entities around […]

  • Changing face of Algorithms

    In the age of Big Data, algorithms give companies a competitive advantage. Today’s most important technology companies all have algorithmic intelligence built into the core of their product: Google Search, Facebook News Feed, Amazon’s and Netflix’s recommendation engines. “Data is inherently dumb,” Peter Sondergaard, senior vice president at Gartner and global head of Research, said […]