The U.S. Cybersecurity and Infrastructure Security Agency has found that millions of smart gadgets are at risk of hacking. The hackers take advantage of flaws that exist in the software that is being widely used by people in their smart devices. These technical flaws in the apps are the main source of hackers to penetrate and exploit the home and business computer networks.
Though, there is no proof of any attacks that are being done using these technical flaws. But the cybersecurity agency would report this problem in an advisory owing to the presence of faults in data-communications software central to the smart devices using the internet.
According to a report published on Tuesday, Forescout Technologies, the cybersecurity agency, said that potentially impacted devices from an anticipated 150 manufacturers include office routers, networked thermometers, smart printers and plugs, healthcare appliances, and industrial control devices. Of all these devices, the consumer devices, including cameras and remote-controlled temperature sensors, are the most affected ones.
In the worst scenario, control software that offers important services to society like power, water, and programmed building management could be severely damaged, said Awais Rashid (a Computer Scientist, Bristol University in Britain). He is the one who evaluated Forescout’s research.
In the advisory, CISA advised defensive measures to cut down the risk of hacking. To be specific, it emphasized the inaccessibility of industrial control software through the internet. Additionally, these systems should be kept out of the reach of corporate networks.
The research underlines the threats that cybersecurity specialists often discover in internet-connected devices made without much focus on digital security. Awais Rashid also said that this issue arises due to carelessness and poor programming by programmers.
The main challenge when it comes to resolving these issues is the huge amount of negative impact on millions of devices. This happens because they are present in ostensible open-source software and available for use and modification without any need for coding. In this scenario, the problem involves basic internet software that takes care of communications via IP/TCP.
Fixing the flaws in affected devices is more problematic because open-source software is not owned by anyone, said Elisa Costante, the Vice President of Research Department at Forescout. She also added that such code is usually owned by volunteers. And, it’s no shocking fact that some of the vulnerable IP/TCP is two decades old while some of them are no longer supported.
It is up to the manufacturer of the device whether to patch the flaws or not, and some of them may not even bother due to expenses and time involved, she added. Some suppliers embed a compromised code in a device component- most of the people don’t know that it’s present in their device.
If unresolved, the flaws could leave corporate and home networks open to cyber attacks. This is why Forescout has already notified as many vendors as possible about the cyber vulnerabilities, which it named AMNESIA:33. However, it was impossible to find out all impacted devices, Elisa said. The agency has also sent an alert to the computer security agencies in the U.S., Japan, and German.
The agency found out the risks in what is considered to be the most extensive research ever on the TCP/IP security. This year-long study is famous as Project Memoria.
