Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

10/21/2016
10:00 AM
Jai Vijayan
Jai Vijayan
Slideshows
Connect Directly
Twitter
LinkedIn
RSS
E-Mail

7 Imminent IoT Threats

Attacks against smart home products, medical devices, SCADA systems, and other newly network-enabled systems signal the beginning of a new wave of attacks against the IoT.
2 of 8

Home Network Routers

Of all the Internet connected devices in homes these days, the network router continues to be by far the most targeted in attacks. 'Most Internet routers - the keystone to your home network - are riddled with security issues, which makes them ... easy picking for hackers,' Avast Software said in a blog post earlier this year. 

The blog pointed to a study of 653 IT professionals and about 1,000 remote employees conducted by Tripwire, which showed 80% of the top-selling small office home office wireless routers had security vulnerabilities. Published exploits were freely available for thirty-four of the top 50 SOHO routers in the study.

More than 50% of all routers worldwide had default or basic username and password combinations, like 'admin' and 'password' while an additional 25% had the user address, birthday or name as password, Avast had noted. 'As a result, more than 75% of all routers are vulnerable to simple password attacks, which is basically an open invitation to malicious hackers.'

Not surprisingly, attackers have begun taking advantage of vulnerable home routers to create botnets for relaying spam and launching DDoS attacks. One of the largest-ever DDoS attacks to date - on the KrebsOnSecurity website recently - is in fact believed to have been enabled by thousands of compromised home routers and IP cameras.

Image Source: Jeerawat Somsopin via Shutterstock

Home Network Routers

Of all the Internet connected devices in homes these days, the network router continues to be by far the most targeted in attacks. "Most Internet routers the keystone to your home network are riddled with security issues, which makes them easy picking for hackers," Avast Software said in a blog post earlier this year.

The blog pointed to a study of 653 IT professionals and about 1,000 remote employees conducted by Tripwire, which showed 80% of the top-selling small office home office wireless routers had security vulnerabilities. Published exploits were freely available for thirty-four of the top 50 SOHO routers in the study.

More than 50% of all routers worldwide had default or basic username and password combinations, like "admin" and password while an additional 25% had the user address, birthday or name as password, Avast had noted. "As a result, more than 75% of all routers are vulnerable to simple password attacks, which is basically an open invitation to malicious hackers."

Not surprisingly, attackers have begun taking advantage of vulnerable home routers to create botnets for relaying spam and launching DDoS attacks. One of the largest-ever DDoS attacks to date on the KrebsOnSecurity website recently is in fact believed to have been enabled by thousands of compromised home routers and IP cameras.

Image Source: Jeerawat Somsopin via Shutterstock

2 of 8
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4652
PUBLISHED: 2019-11-12
IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to obtain sensitive information or perform unauthorized actions. IBM X-Force ID: 170963.
CVE-2011-3618
PUBLISHED: 2019-11-12
atop: symlink attack possible due to insecure tempfile handling
CVE-2012-1109
PUBLISHED: 2019-11-12
mwlib 0.13 through 0.13.4 has a denial of service vulnerability when parsing #iferror magic functions
CVE-2019-18848
PUBLISHED: 2019-11-12
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.
CVE-2011-5271
PUBLISHED: 2019-11-12
Pacemaker before 1.1.6 configure script creates temporary files insecurely