India's largest platform for AI & Analytics leaders & professionals

Sign in

India's largest platform for AI & Analytics leaders & professionals

3AI Digital Library

IoT devices at risk from Amnesia:33

3AI December 17, 2020

 

A new series of vulnerabilities dubbed Amnesia:33 puts millions of IoT devices at risk of being compromised.

Security researchers from Forescout disclosed the 33 vulnerabilities today. The flaws are found in four open-source TCP/IP libraries used in the firmware of products from over 150 vendors.

According to the researchers’ estimates, millions of consumer and enterprise IoT devices are at risk from Amnesia:33 vulnerabilities.

The affected libraries are uIP, FNET, picoTCP, and Nut/Net. Manufacturers have used these libraries for decades to add TCP/IP support to their products.

Here are the number of vulnerabilities discovered in each library:

  • uIP – 13
  • picoTCP – 10
  • FNET – 5
  • Nut/Nut – 5

uIP, the most vulnerable library, was also found to be used in the highest number of vendors.

Forescout also analysed the following libraries but did not find any vulnerabilities: lwIP, CycloneTCP, and uC/TCP-IP. 

Due to the prevalence of these libraries, just about every type of connected hardware is impacted by Amnesia:33—from SoCs to smart plugs, from IP cameras to servers.

Unlike the previously disclosed Ripple20 vulnerabilities, Amnesia:33 primarily affects the DNS, TCP, and IPv4/IPv6 sub-stacks.

Ripple20 and Amnesia:33 vulnerabilities both predominately consist of Out-of-Bounds Read, followed by Integer Overflow.

IoT devices (46%) represent the highest number of affected device types, according to Forescout’s research. This is followed by OT/BAS and OT/ICS at 19 percent, and then IT at 16 percent.

    3AI Trending Articles

  • Creating the Bridge of Translation between AI Technologists and Business

    Featured Article: Author:  Abhishek Tandon, Director, Customer Success for Fosfor, LTIMindtree Like we saw in the previous article “Crossing the AI Adoption Chasm“, there is a big gap in the objective of the technologists driving the AI project and the business user seeking value from it. This gap is causing major adoption issues as both […]

  • What if AI scans legislation and allocates funds to agencies?

    New Treasury Department software points the way. But research suggests that it’s impossible to show that an artificial ‘superintelligence’ can be contained . If, like me, you’re worried about how members of Congress are supposed to vote on a stimulus bill so lengthy and complex that nobody can possibly know all the details, fear not — the […]

  • Blockchain and IoT gives end-to-end visibility to Stakeholders in a Supply Chain

    While IoT sensors help track the movement and quality of products, blockchain’s distributed ledger gives multiple entities joint control over shared information . Covid concentrated attention on supply chains like never before as the pandemic caused massive disruptions. Companies started looking deeper into the roots of their supplies, going further back than their immediate vendors. […]

  • Commerce Ministry notifies Rs 945 crore seed fund for startups

    DPIIT said that preference would be given to startups offering solutions in sectors including social impact, waste management, water management, financial inclusion, education, agriculture, food processing, biotechnology, healthcare, energy, mobility, defence, space, railways, oil and gas, textiles, etc.   The government has approved the Rs 945-crore Startup India Seed Fund Scheme (SISFS) for the period […]