Open Source Flaw ‘Devil’s Ivy’ Puts Millions of IoT Devices at Risk | Software

Millions of IoT devices are vulnerable to cybersecurity attacks due to a vulnerability initially discovered in remote security cameras,
Senrio reported this week.

The firm found the flaw in a security camera developed by Axis Communications, one of the world’s biggest manufacturers of the devices.

The Model 3004 security camera is used for security at the Los Angeles International Airport and other places, according to Senrio.

The problem turned out to be a stack buffer overflow vulnerability, which the firm dubbed “Devil’s Ivy.”

Axis notified the security firm that 249 different models of the camera were affected by the vulnerability. It found only three models that were unaffected.

Buried Deep

The problem lies deep in the communication layer of
gSOAP, an open source third-party toolkit that is used by all kinds of device makers for IoT technology, according to Senrio.

gSOAP manager Genivia reported that the toolkit has been downloaded more than 1 million times, according to Senrio. Most of the downloads likely involved developers. Major companies including IBM, Microsoft, Adobe and Xerox are customers of the firm.

Genivia
issued a new patch for gSOAP within 24 hours of being alerted to the vulnerability, and said it notified customers of the problem, according to CEO Robert van Engelen.

The obscure flaw was caused by an intended integer underflow, followed by a second unintended integer underflow that triggered the bug, he told LinuxInsider.

“The trigger happens when at least 2 GB of XML data is uploaded to a Web server,” van Engelen explained. “This bug was not discovered by proprietary static analysis tools or by our source code users who looked at the source code since 2002.

Certain ONVIF devices act as Web servers, making them vulnerable when configured to accept more than 2 GB of XML data, he noted.

Wide-Ranging Problem

Many large manufacturers are using the same source, the ONVIF forum, for their networking protocol libraries, noted Ryan Spanier, director of research at
Kudelski Security.

Because it is a shared library, the vulnerability exists in a large number of devices, he told LinuxInsider.

“Companies regularly integrate hardware and software into their devices that they did not write themselves,” Spanier said. “In some ways, this is similar to the Mirai botnet, but in that case they targeted an insecure backdoor present in a chip used by multiple camera manufacturers.”

The Mirai botnet, which struck last year, was one of the biggest incidents ever recorded, targeting the KrebsOnSecurity blog with a massive DDoS attack that measured 620 gigabytes per second.

An incident like Devil’s Ivy was inevitable, observed Bryan Singer, director of industrial cybersecurity services at
IOActive.

“In the veritable push to technology, it is all too common that the drive towards first-to-market functionality will badly outpace solid, secure design,” he told LinuxInsider. “Unfortunately, this head-smack moment is all too common.”

Vendors need to audit components appropriately for security purposes, Dustin Childs, communications manager for Trend Micro’s zero day initiative, told LinuxInsider, as “misunderstood or poorly implemented open source software allows attackers a path to bypass security mechanisms.”

David Jones is a freelance writer based in Essex County, New Jersey. He has written for Reuters, Bloomberg, Crain’s New York Business and The New York Times.

The post Open Source Flaw ‘Devil’s Ivy’ Puts Millions of IoT Devices at Risk | Software appeared first on Nigerian News 24/7 | ElotiTV.com.


by Eloti TV via Nigerian News 24/7 | ElotiTV.com

Comments

Post a Comment

Popular posts from this blog

INEC to issue permanent voter cards in 10 states

Latest blog entries - Eloti tV INEC to issue permanent voter cards in 10 states The National Independent Electoral Commission says it will commence the issuance of the permanent voter cards in 10 states of the federation. The Resident Electoral Commissioner in Benue, Alhaji Baba Yusuf, told journalists on Tuesday that the issuance of the cards would be between May 23 to May 25 while the continuous voters’ registration would hold between May 28 and June 1. He said the commencement of the two exercises were a prelude to the 2015 general elections. Yusuf explained those eligible to register in the CVR included those who were not up to 18 years as at 2011 and those who were unable to register during the last exercise. “Those who had problems with the direct data capture machines and were not captured during the 2011 registration exercise as well as those who could not register in 2011 for one reason or the other can also register this year,” he said. The REC advised vot...
Read more

October 1: You are free to live in any part of Nigeria, FG reassures Nigerians

By CALEB AYANSINA ABUJA – FEDERAL Government, Friday, reassured every Nigerian not to panic but to live freely in any part of the country without fear of molestation. The assurance was coming on the heel of growing tension in the country, barely 24 hour to the expiration of the October 1 deadline quit notice issued by the coalition of Arewa youth groups. The Vice President, Prof. Yemi Osinbajo also challenged religious bodies and other relevant stakeholders in the project Nigeria to leverage on their influence to jettison every divisive groups and their actions in the country. Osinbajo, who was speaking at the public lecture to mark the 57th independence anniversary of Nigeria organised by the Nigerian Supreme Council for Islamic Affairs (NSCIA) in Abuja, reiterated the government resolve to achieve just and equitable society. Represented by the Minister of Mine and Steel, Kayode Fayemi, the VP explained that in a society like Nigeria, there is bound to be differences, therefore...
Read more

Donna Karan Apologizes (Again) After Defending Harvey Weinstein

Image
Designer Donna Karan says she didn’t know the extent of the accusations against Harvey Weinstein before she spoke out to defend the disgraced movie mogul. “I heard a whisper, but there were whispers all over,” Karan, 69, said of the sexual misconduct allegations during an interview with ABC News which aired Monday on Good Morning America . “It wasn’t until a day and a half after the I truly heard about it.” She added: “That’s my honest truth. I didn’t know.” The fashion industry vet sparked outrage earlier this month after calling Weinstein a “wonderful” person in a  Daily Mail  interview and suggesting women may be “asking for it” by dressing provocatively. She backtracked days later, issuing an apology and declaring that her statements did “not represent my actual views.” She apologized again in the recent interview, declaring, “I made a huge, huge mistake.” She admitted, “what I said is so wrong and not who I am.” “I was exhausted. I had just come from a 1...
Read more