Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
12/4/2018
11:10 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Trend Micro Research Uncovers Major Flaws in Leading IoT Protocols 12/4/18 7:00 am CST

Hundreds of thousands of unsecured machine-to-machine deployments put global organizations at risk

DALLAS--(BUSINESS WIRE)--Trend Micro Incorporated (TYO: 4704TSE: 4704), a global leader in cybersecurity solutions, today warned organizations to revisit their operational technology (OT) security after finding major design flaws and vulnerable implementations related to two popular machine-to-machine (M2M) protocols, Message Queuing Telemetry Transport (MQTT) and Constrained Application Protocol (CoAP). Trend Micro’s new report, co-branded with Politecnico di Milano, The Fragility of Industrial IoT’s Data Backbone, highlights the growing threat of industrial espionage, denial-of-service and targeted attacks by abusing these protocols.

Over just a four-month period, Trend Micro researchers identified more than 200 million MQTT messages and more than 19 million CoAP messages being leaked by exposed brokers and servers. Using simple keyword searches, malicious attackers could locate this leaked production data, identifying lucrative information on assets, personnel and technology that can be abused for targeted attacks.

“The issues we’ve uncovered in two of the most pervasive messaging protocols used by IoT devices today should be cause for organizations to take a serious, holistic look at the security of their OT environments,” said Greg Young, vice president of cybersecurity for Trend Micro. “These protocols weren’t designed with security in mind, but are found in an increasingly wide range of mission critical environments and use cases. This represents a major cybersecurity risk. Hackers with even modest resources could exploit these design flaws and vulnerabilities to conduct reconnaissance, lateral movement, covert data theft and denial-of-service attacks.”

The research shows how attackers could remotely control IoT endpoints or deny service by leveraging security issues in the design, implementation and deployment of devices using these protocols. Furthermore, by abusing specific functionality in the protocols, hackers could maintain persistent access to a target to move laterally across a network.

A few vulnerabilities were also identified through this research, which were disclosed through Trend Micro’s Zero Day Initiative (ZDI)CVE-2017-7653CVE-2018-11615, and CVE-2018-17614. An example of the impact these vulnerabilities could have, CVE-2018-17614 is an out-of-bounds write that could allow an attacker to execute arbitrary code on vulnerable devices that implement an MQTT client. While no new CoAP vulnerabilities were found, the report reinforces that CoAP is User Datagram Protocol-based and follows a request-response scheme, making it a good fit for amplification attacks.

To mitigate the risks highlighted in the research, Trend Micro encourages organizations to:

  • Implement proper policies to remove unnecessary M2M services
  • Run periodic checks using internet-wide scanning services to ensure sensitive data is not leaking through public IoT services
  • Implement a vulnerability management workflow or other means to secure the supply chain
  • Stay up to date with industry standards as this technology is evolving rapidly

To read the complete report, please visit: https://www.trendmicro.com/vinfo/us/security/news/internet-of-things/mqtt-and-coap-security-and-privacy-issues-in-iot-and-iiot-communication-protocols.

About Trend Micro

Trend Micro Incorporated, a global leader in cybersecurity solutions, helps to make the world safe for exchanging digital information. Our innovative solutions for consumers, businesses, and governments provide layered security for data centers, cloud workloads, networks, and endpoints. All our products work together to seamlessly share threat intelligence and provide a connected threat defense with centralized visibility and investigation, enabling better, faster protection. With more than 6,000 employees in 50 countries and the world’s most advanced global threat research and intelligence, Trend Micro enables organizations to secure their connected world. For more information, visit www.trendmicro.com.

 

 

Contact:

Erin Johnson
817-522-7911
[email protected]

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12820
PUBLISHED: 2019-07-19
A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and personal information it communicates with the server, use unencrypted HTTP. As an example, while logging in through the app to a Jisiwei account, th...
CVE-2019-12821
PUBLISHED: 2019-07-19
A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. The QR-code follows an easily predictable pattern that depends only on the specific device ID of the robot vacuum cleaner. By generating a QR-code containin...
CVE-2019-12453
PUBLISHED: 2019-07-19
In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation.
CVE-2019-12945
PUBLISHED: 2019-07-19
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2018-17792
PUBLISHED: 2019-07-19
MDaemon Webmail (formerly WorldClient) has CSRF.