Network zero-days leave millions of IoT devices open to abuse

Security researchers analysing a network stack used in hundreds of millions of devices found that it contained serious vulnerabilities that could be exploited by attackers for remote code execution and data exfiltration.

The software library is made by Treck, which specalises in transmission control protocol/internet protocol (TCP/IP) networking stacks for embedded devices.

JSOF, which started analysing Treck's software in September last year, found a total of 19 vulnerabilities.

Of these, four are marked as critical, having ratings over 9 under the Common Vulnerabilities Scoring System version 3 and can be considered as zero-days, JSOF said.

Two critical vulnerabilities that can be triggered by sending multiple malformed internet protocol version 4 and 6 packets to devices can be exploited for remote code execution, and carry the maximum 10 out of 10 severity score under CVSSv3.

Another remote code excution vulnerability rates 9 out of 10 on CVSSv3 but JSOF said that in its opinion, it is the most serious of all as domain name system (DNS) lookups can leave the network in which the device is located, allowing attackers to take over equipment through resolver cache poisoning.

Such a vulnerability can bypass security measures and will likely be difficult for firewalls and similar products to detect, JSOF said.

The software library is found in a large number of applications, ranging from industrial controllers to medical devices, printers, transportation systems, aviation, network equipment, government and national security, enterprise devices and more.

If the vulnerable devices face the internet, attackers could use the vulnerabilities to take them over, or compromise them to lie hidden in networks for years.

Bypassing network address translation (NAT) is also possible from the outside world, JSOF noted.

Apart from applying patches to vulnerable devices, JSOF recommends administrators try to filter out anomalous TCP/IP traffic to mitigate against exploitation.

Products that can't be updated should not be accessible from the internet unless it's absolutely necessary, and network exposure for these should be kept to a minimum, JSOF suggested.

Treck has acknowledged the vulnerabilities, issued patches for them and also notified its customers.

JSOF said working with Treck was "initally challenging" as the company appears to have never been the target of independent security research.

Treck also took the information disclosed by JSOF to litigation lawyers, the security vendor said.

After asking vendors that use the TCP/IP stack such as Digi, HP, Intel and Quadros for help, JSOF was able to make contact with Treck and work with the company to address the many vulnerabilities in its software.