PC Advisor

More documents

Recommendations

Info

News: Analysis Many routers, modems, and other devices ship without adequate security tests A large scale security test of firmware images for embedded devices found thousands of vulnerabilities. Lucian Constantin reports A n analysis of hundreds of publicly available firmware images for routers, DSL modems, VoIP phones, IP cameras and other embedded devices uncovered high-risk vulnerabilities in a significant number of them, pointing to poor security testing by manufacturers. The study was performed by researchers from the Eurecom research centre in France and Ruhr University in Bochum, Germany, who built an automated platform capable of unpacking firmware images, running them in an emulated environment and starting the embedded web servers that host their management interfaces. The researchers started out with a collection of 1,925 Linux-based firmware images for embedded devices from 54 manufacturers, but they only managed to start the web server on 246 of them. They believe that with additional work and tweaks to their platform that number could increase. The goal was to perform dynamic vulnerability analysis on the firmware packages’ web-based management interfaces using open-source penetration testing tools. This resulted in 225 high-impact vulnerabilities being found in 46 of the tested firmware images. A separate test involved extracting the web interface code and hosting it on a generic server, so it could be tested for flaws without emulating the actual firmware environment. This test had drawbacks, but was successful for 515 firmware packages and resulted in security flaws being found in 307 of them. The researchers also performed a static analysis with another open-source tool against PHP code extracted from device firmware images, resulting in another 9046 vulnerabilities being found in 145 firmware images. In total, using both static and dynamic analysis the researchers found important vulnerabilities like command execution, SQL injection and cross-site scripting in the web-based management interfaces of 185 unique firmware packages, affecting devices from a quarter of the 54 manufacturers. The researchers focused their efforts on developing a reliable method for automated testing of firmware packages without having access to the corresponding physical devices, rather than on the thoroughness of the vulnerability scanning itself. They didn't perform manual code reviews, use a large variety of scanning tools or test for advanced logic flaws. This means that the issues they found were really the low-hanging fruit – the flaws that should have been easy to find during any standard security testing. This begs the question: why weren’t they discovered and patched by the manufacturers themselves? It would appear that the affected vendors either didn’t subject their code to security testing at all, or if they did, the quality of the testing was very poor, said Andrei Costin, one of the researchers behind the study. Team’s findings Costin presented the team’s findings at the recent DefCamp security conference in Bucharest. It was actually the second test performed on firmware images on a larger scale. Last year, some of the same researchers developed methods to automatically find back doors and encryption issues in a large number of firmware packages. Some of the firmware versions in their latest data set were not the latest ones, so not all of the discovered issues were zero-day vulnerabilities – flaws that were previously unknown and are unpatched. However, their impact is still potentially large, because most users rarely update the firmware on their embedded devices. At DefCamp, attendees were also invited to try to hack four Internet of Things (IoT) devices as part of the onsite IoT Village. The contestants found two critical vulnerabilities in a smart video-enabled doorbell that could be exploited to gain full control over the device. The doorbell also had the option to control a smart door lock. A high-end D-Link router was also compromised through a vulnerability in the firmware version that the manufacturer shipped with the device. The flaw was actually known and has been patched in a newer firmware version, but the router doesn’t alert users to update the firmware. Finally, the participants also found a lower-impact vulnerability in a router from Mikrotik. The only device that survived unscathed was a Nest Cam. Details about the vulnerabilities have not yet been shared publicly because the IoT Village organisers, from Bitdefender, intend to report them to the affected vendors first, so they can be patched. J 18 www.pcadvisor.co.uk/news February 2016
Don’t miss a single copy of <strong>PC</strong> <strong>Advisor</strong> by subscribing digitally Subscribe from as little as £1.99
Page 1 and 2: GET FREE SOFTWARE IN OUR ONLINE DOW
Page 3 and 4: WELCOME Editor Jim Martin Group Man
Page 5 and 6: CONTENTS SECURITY CAMERAS 82 THE DA
Page 7 and 8: NEWS Keep up to date with PC Adviso
Page 9 and 10: DOMAINS | MAIL | HOSTING | eSHOPS |
Page 11 and 12: NEWSVIEWPOINT You can’t get Word
Page 13 and 14: Our revolutionary NEW Web Hosting p
Page 15 and 16: Specialists in business-class Inter
Page 17: News: Analysis things such as peopl
Page 21 and 22: NEWPRODUCTS CHRIS MARTIN BlackBerry
Page 23 and 24: News: New Products Pebble Time Roun
Page 25 and 26: REVIEWS around the screen means the
Page 27 and 28: Reviews From £679 inc VAT TABLET A
Page 29 and 30: Reviews for it on the Apple-designe
Page 31 and 32: Reviews Display and stylus The Surf
Page 33 and 34: Reviews £549 inc VAT TABLET/LAPTOP
Page 35 and 36: Reviews Geekbench 3 a rainbow effec
Page 37 and 38: Reviews £339 inc VAT Contact • g
Page 39 and 40: Reviews Geekbench 3 GFXBench Manhat
Page 43 and 44: Reviews Cameras The Xiaomi Mi 4C is
Page 45 and 46: Reviews this thin channel could eas
Page 49 and 50: Reviews than the Motorola Moto 360,
Page 51 and 52: Reviews the UI itself. The text, th
Page 53 and 54: Reviews £79 inc VAT POWERLINE ADAP
Page 55 and 56: Reviews £106 inc VAT SLEEP TRACKER
Page 57 and 58: Reviews than-intuitive interface. I
Page 59 and 60: Reviews We’ve typically thought o
Page 61 and 62: Reviews Outlook Groups, Office Plan
Page 63 and 64: Reviews The Office Mobile apps don
Page 65 and 66: Reviews interested in making sure e
Page 67 and 68: Reviews and choke points. It’s ea
Page 69 and 70:
Reviews right choices. Knowing you
Page 72 and 73:
GROUP TEST With prices falling, now
Page 74 and 75:
Group test: 4K Ultra HD TVs FINLUX
Page 76 and 77:
Group test: 4K Ultra HD TVs PHILIPS
Page 78 and 79:
Group test: 4K Ultra HD TVs SAMSUNG
Page 80 and 81:
Group test: 4K Ultra HD TVs How we
Page 82 and 83:
GROUP TEST 6 BEST HOME SECURITY CAM
Page 84 and 85:
Group test: Home security cameras F
Page 86 and 87:
Group test: Home security cameras L
Page 88 and 89:
Group test: Home security cameras M
Page 90 and 91:
Group test: Home security cameras N
Page 92 and 93:
Group test: Home security cameras T
Page 94 and 95:
Group test: Home security cameras S
Page 96 and 97:
FEATURE WHAT’S THE DIFFERENCE BET
Page 98 and 99:
FEATURE 10 Microsoft Office 2016 fe
Page 100 and 101:
Feature: 10 Microsoft Office 2016 f
Page 102 and 103:
FEATURE Get more out andr Marsh By
Page 104 and 105:
Feature: Android Marshmallow tips a
Page 106 and 107:
Page 108 and 109:
Page 110 and 111:
Page 112 and 113:
HOW TO Use an Android Wear device w
Page 114 and 115:
How to: Build your own Windows app
Page 116 and 117:
How to: Put together a PowerPoint p
Page 118 and 119:
Subscribe to PC Advisor SUBSCRIBE T
Page 120 and 121:
TOP5CHARTS TEST CENTRE PC Advisor
Page 122 and 123:
Top 5 charts Best budget laptops 1
Page 124 and 125:
Top 5 charts Best Chromebooks 1 2 3
Page 126 and 127:
Top 5 charts Best gaming PCs 1 2 3
Page 128 and 129:
Top 5 charts All-in-one PCs 1 2 3 4
Page 130 and 131:
Top 5 charts Best budget smartphone
Page 132 and 133:
Top 5 charts Best 7- & 8in tablets
Page 134 and 135:
Top 5 charts Best smartwatches 1 2
Page 136 and 137:
Top 5 charts Best budget printers 1
Page 138 and 139:
Top 5 charts Best NAS drives 1 2 3
Page 140 and 141:
Top 5 charts Best budget graphics c
Page 142 and 143:
Top 5 charts Best e-book readers 1
Page 144 and 145:
Top 5 charts Best budget headphones
Page 146 and 147:
OUTBOX BRAD CHACOS Windows under th
show all

PC Advisor

Create successful ePaper yourself

Delete template?

Save as template?