India's largest platform for AI & Analytics leaders, professionals & aspirants

Sign in

India's largest platform for AI & Analytics leaders, professionals & aspirants

3AI Digital Library

IoT devices at risk from Amnesia:33

3AI December 17, 2020

 

A new series of vulnerabilities dubbed Amnesia:33 puts millions of IoT devices at risk of being compromised.

Security researchers from Forescout disclosed the 33 vulnerabilities today. The flaws are found in four open-source TCP/IP libraries used in the firmware of products from over 150 vendors.

According to the researchers’ estimates, millions of consumer and enterprise IoT devices are at risk from Amnesia:33 vulnerabilities.

The affected libraries are uIP, FNET, picoTCP, and Nut/Net. Manufacturers have used these libraries for decades to add TCP/IP support to their products.

Here are the number of vulnerabilities discovered in each library:

  • uIP – 13
  • picoTCP – 10
  • FNET – 5
  • Nut/Nut – 5

uIP, the most vulnerable library, was also found to be used in the highest number of vendors.

Forescout also analysed the following libraries but did not find any vulnerabilities: lwIP, CycloneTCP, and uC/TCP-IP. 

Due to the prevalence of these libraries, just about every type of connected hardware is impacted by Amnesia:33—from SoCs to smart plugs, from IP cameras to servers.

Unlike the previously disclosed Ripple20 vulnerabilities, Amnesia:33 primarily affects the DNS, TCP, and IPv4/IPv6 sub-stacks.

Ripple20 and Amnesia:33 vulnerabilities both predominately consist of Out-of-Bounds Read, followed by Integer Overflow.

IoT devices (46%) represent the highest number of affected device types, according to Forescout’s research. This is followed by OT/BAS and OT/ICS at 19 percent, and then IT at 16 percent.

    3AI Trending Articles

  • Salesforce embraces the public cloud with Hyperforce

    Salesforce is letting CIOs choose where they run its software, easing compliance with data protection and data sovereignty laws. Salesforce.com President and COO Bret Taylor believes the SaaS vendor has made “probably the most significant technological shift” since its CRM platform first launched 21 years ago. But Taylor wasn’t talking about the company’s agreement to acquire […]

  • Winuall raises Rs 14.7 crore to digitize coaching institutes

    The startup will use the fresh capital to enhance product capabilities and hire across technology, product, AI, and business development teams Winuall, an online education platform that helps coaching institutes go digital, has raised Rs14.7 crore from Prime Venture Partners, Beenext, Ramakant Sharma, founder of LivSpace and other angel investors. Winuall aims to democratize technology […]

  • AI and Ethics – Modern AI Algorithms

    Featured Article: Author: Sameer Ranjan, CTO & Director – Data Science, Catenate Ethics has always been subjective and quite often changed based on the philosophy of nations or their leaders. It is often related to principles of morality and the set of beliefs that a group of people follows. In the 21st century, the narrative […]

  • Indian independent software vendors are choosing Oracle Cloud to run Critical Business Applications

    A large number of Indian independent software vendors (ISVs) are choosing to run their business critical applications on Oracle Cloud Infrastructure (OCI) to improve application performance A large number of Indian independent software vendors (ISVs) including GOFRUGAL, Medexpert, Ameyo and Information Dynamics, among others are choosing to run their business critical applications on Oracle Cloud Infrastructure (OCI) […]