Millions of IoT Devices Exposed to Attacks Due to Cloud Platform Vulnerability

guest · Aug 17, 2021

Millions of IoT Devices Exposed to Attacks Due to Cloud Platform Vulnerability
August 17, 2021
https://www.securityweek.com/millions-iot-devices-exposed-attacks-due-cloud-platform-vulnerability

The flaw was found in a core component of the Kalay cloud platform for IoT devices offered by ThroughTek, a Taiwan-based company that provides IoT and M2M solutions for surveillance, security, smart home, cloud storage, and consumer electronics systems.

Mandiant researchers discovered in late 2020 that the platform, which is used by millions of IoT devices from many vendors, is affected by a critical vulnerability that can be exploited to remotely hack affected systems. Since many of the impacted devices are video surveillance products — this includes IP cameras, baby monitors and digital video recorders — exploiting the vulnerability could allow an attacker to intercept live audio and video data.
Click to expand...

The vulnerability is tracked as CVE-2021-28372 and it has been assigned a CVSS score of 9.6. In order to exploit it, an attacker needs to somehow obtain the Kalay unique identifier (UID) of the targeted user. An attacker could obtain this UID using social engineering, or through other methods.

“For example, a victim user viewing their camera feed through a mobile application using the Kalay SDK would be routed to the attacker, who could obtain the device credentials,” Franke said.
Click to expand...

Once they have the victim’s credentials, the hacker can not only access audio and video data, but also abuse RPC (remote procedure call) functionality, which is typically implemented for firmware updates, device control, and telemetry.

“Vulnerabilities in the device-implemented RPC interface can lead to fully remote and complete device compromise,” Mandiant warned.
Click to expand...

FireEye: Mandiant Discloses Critical Vulnerability Affecting Millions of IoT Devices

Today, Mandiant disclosed a critical risk vulnerability in coordination with the Cybersecurity and Infrastructure Security Agency (“CISA”) that affects millions of IoT devices that use the ThroughTek “Kalay” network.

The Kalay protocol is implemented as a Software Development Kit (“SDK”) which is built into client software (e.g. a mobile or desktop application) and networked IoT devices, such as smart cameras. Due to how the Kalay protocol is integrated by original equipment manufacturers (“OEMs”) and resellers before devices reach consumers, Mandiant is unable to determine a complete list of products and companies affected by the discovered vulnerability.
Click to expand...

ThroughTek - Security Advisory:
Please Update the SDK Version to Minimize the Risk of Sensitive Information Being Accessed by Unauthorized Third-Party

Log in or Sign up

Millions of IoT Devices Exposed to Attacks Due to Cloud Platform Vulnerability

guest Guest

Log in or Sign up

Millions of IoT Devices Exposed to Attacks Due to Cloud Platform Vulnerability

guest Guest

Useful Searches