Back to Blog

A Legion of Bugs Puts Hundreds of Millions of IoT Devices at Risk

June 19, 2020

By: mirabiliscorp

SECURITY EXPERTS HAVE warned for years that the drive to connect every device imaginable to the internet would offer a bonanza for hackers. Now researchers have found that one chunk of software designed to enable those internet connections is itself riddled with hackable vulnerabilities. As a result, security flaws have ended up in hundreds of millions of gadgets across the globe, from medical devices to printers to power grid and railway equipment.

Israeli security firm JSOF revealed on Tuesday a collection of vulnerabilities it’s calling Ripple20, a total of 19 hackable bugs it has identified in code sold by a little known Ohio-based software company called Treck, a provider of software used in internet-of-things devices. JSOF’s researchers found one bug-ridden part of Treck’s code, built to handle the ubiquitous TCP-IP protocol that connects devices to networks and the internet, in the devices of more than 10 manufacturers, from HP and Intel to Rockwell Automation, Caterpillar, and Schneider Electric. And JSOF believes it’s likely in dozens of others. The result, the researchers say, is the better part of a billion hackable devices in the wild that have likely been vulnerable for years, and will need to be patched to protect them from a broad array of attacks.

Several of those Ripple20 attacks, named for the way the bugs “rippled” out from a single company and the year 2020, would allow any hacker who can connect to a target device—over the internet or a local network—to paralyze it or force it to run any malicious code they choose. The affected devices range from power supply systems in data centers to the programmable logic controllers used in power grids and manufacturing to medical infusion pumps.

JSOF says it discovered the Treck vulnerability while doing a security analysis of a single device last fall, and found that its TCP-IP stack contained hackable vulnerabilities. The firm soon realized that the code wasn’t written by the device’s manufacturer, but rather came from Treck—and that meant the bugs weren’t in a single device, but everywhere, underscoring how widely IoT flaws can propagate. “Not that many people have heard of this company, but they are a leading provider of TCP-IP stacks, so they’re at the beginning of a really complex supply chain,” says JSOF CEO Shlomi Oberman. “The vulnerabilities in the stack got amplified by the ripple effect of the supply chain, so that they exist in pretty much any type of connected device I can think of.”

Of the 19 bugs JSOF has revealed, a handful are particularly serious, allowing hackers to run their own commands on a target device—what’s known as remote code execution—or for sensitive information to leak. “An attacker can take complete control of any of the affected devices,” says Oberman. “It just depends on the device and your imagination.”

An advisory from the Cybersecurity and Infrastructure Security Agency published Tuesday rates six of the 19 bugs between 7 and 10 on the CVSS score, where 10 represents the most severe vulnerability. Two of the bugs scored a 10 out of 10. In its advisory, CISA “recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities,” such as protecting vulnerable devices with firewalls and removing any connections to the public internet.

Source: Wired

Contact us

Safety is essential to your decision making. We are sure that our team can clarify any doubts. After all, we understand security.

Follow us


Contact Us
First Name*
Last Name*
Mobile Number*
Tell us what do you need* ?
Products: Hold CTRL+Click to add more than 1.* ?
I agree to the Privacy Policy and Terms of Service.