Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

10/21/2016
10:00 AM
Jai Vijayan
Jai Vijayan
Slideshows
Connect Directly
Twitter
LinkedIn
RSS
E-Mail

7 Imminent IoT Threats

Attacks against smart home products, medical devices, SCADA systems, and other newly network-enabled systems signal the beginning of a new wave of attacks against the IoT.
2 of 8

Home Network Routers

Of all the Internet connected devices in homes these days, the network router continues to be by far the most targeted in attacks. 'Most Internet routers - the keystone to your home network - are riddled with security issues, which makes them ... easy picking for hackers,' Avast Software said in a blog post earlier this year. 

The blog pointed to a study of 653 IT professionals and about 1,000 remote employees conducted by Tripwire, which showed 80% of the top-selling small office home office wireless routers had security vulnerabilities. Published exploits were freely available for thirty-four of the top 50 SOHO routers in the study.

More than 50% of all routers worldwide had default or basic username and password combinations, like 'admin' and 'password' while an additional 25% had the user address, birthday or name as password, Avast had noted. 'As a result, more than 75% of all routers are vulnerable to simple password attacks, which is basically an open invitation to malicious hackers.'

Not surprisingly, attackers have begun taking advantage of vulnerable home routers to create botnets for relaying spam and launching DDoS attacks. One of the largest-ever DDoS attacks to date - on the KrebsOnSecurity website recently - is in fact believed to have been enabled by thousands of compromised home routers and IP cameras.

Image Source: Jeerawat Somsopin via Shutterstock

Home Network Routers

Of all the Internet connected devices in homes these days, the network router continues to be by far the most targeted in attacks. "Most Internet routers the keystone to your home network are riddled with security issues, which makes them easy picking for hackers," Avast Software said in a blog post earlier this year.

The blog pointed to a study of 653 IT professionals and about 1,000 remote employees conducted by Tripwire, which showed 80% of the top-selling small office home office wireless routers had security vulnerabilities. Published exploits were freely available for thirty-four of the top 50 SOHO routers in the study.

More than 50% of all routers worldwide had default or basic username and password combinations, like "admin" and password while an additional 25% had the user address, birthday or name as password, Avast had noted. "As a result, more than 75% of all routers are vulnerable to simple password attacks, which is basically an open invitation to malicious hackers."

Not surprisingly, attackers have begun taking advantage of vulnerable home routers to create botnets for relaying spam and launching DDoS attacks. One of the largest-ever DDoS attacks to date on the KrebsOnSecurity website recently is in fact believed to have been enabled by thousands of compromised home routers and IP cameras.

Image Source: Jeerawat Somsopin via Shutterstock

2 of 8
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14230
PUBLISHED: 2019-07-21
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the set_count ajax nopriv handler due to there being no sanitization prior to use in a SQL query in saveQuestionVote. This allows an unauthenticated/unprivileged user ...
CVE-2019-14231
PUBLISHED: 2019-07-21
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the ob_get_results ajax nopriv handler due to there being no sanitization prior to use in a SQL query in getResultByPointsTrivia. This allows an unauthenticated/un...
CVE-2019-14207
PUBLISHED: 2019-07-21
An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash when calling the clone function due to an endless loop resulting from confusing relationships between a child and parent object (caused by an append error).
CVE-2019-14208
PUBLISHED: 2019-07-21
An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to a NULL pointer dereference and crash when getting a PDF object from a document, or parsing a certain portfolio that contains a null dictionary.
CVE-2019-14209
PUBLISHED: 2019-07-21
An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to Heap Corruption due to data desynchrony when adding AcroForm.