'Ripple20' Bugs Impact Hundreds of Millions of Connected Devices
upstart writes in with an IRC submission:
'Ripple20' Bugs Impact Hundreds of Millions of Connected Devices:
A series of 19 different vulnerabilities, four of them critical, are affecting hundreds of millions of internet of things (IoT) and industrial-control devices.
The issue is based in the supply chain and code reuse, with the bugs affecting a TCP/IP software library developed by Treck that many manufacturers use. Researchers at JSOF uncovered the faulty part of Treck's code, which is built to handle the ubiquitous TCP-IP protocol that connects devices to networks and the internet, in the devices of more than 10 different manufacturers-and it's likely present in dozens more.
Affected hardware includes everything from connected printers to medical infusion pumps and industrial-control gear, according to researchers at JSOF's research lab. Treck users include "one-person boutique shops to Fortune 500 multinational corporations, including HP, Schneider Electric, Intel, Rockwell Automation, Caterpillar, Baxter, as well as many other major international vendors suspected of being of vulnerable in medical, transportation, industrial control, enterprise, energy (oil/gas), telecom, retail and commerce, and other industries," according to the research.
"The wide-spread dissemination of the software library (and its internal vulnerabilities) was a natural consequence of the supply chain 'ripple-effect,'" researchers said in a posting on Tuesday. "A single vulnerable component, though it may be relatively small in and of itself, can ripple outward to impact a wide range of industries, applications, companies and people."
The flaws, dubbed Ripple20, include four remote code-execution vulnerabilities. If properly exploited, data could be stolen off of a printer, a medical device's behavior could be tampered with, or industrial control devices could be made to malfunction.
"An attacker could hide malicious code within embedded devices for years. One of the vulnerabilities could enable entry from outside into the network boundaries; and this is only a small taste of the potential risks," according to JSOF.
Read more of this story at SoylentNews.