Following up on many of our recent security concerns, a digitally ancient vulnerability in the firmware and hardware of a variety of Internet of Things-accessible devices have left hundreds of millions of potential access points into home and business networks. The kicker? Somehow, this particular vulnerability has yet to lead to a major attack despite being an open loophole for nearly a decade.
Making old vulnerabilities new again
The exploit in question lies in the realm of DNS rebinding, an exploit widely publicised back in 2008 by IoT-oriented security firm Armis. Known as DNS rebinding, the exploit allows an attacker to bypass a network’s firewall in such a way that they are then able to leverage a user’s web browser into accessing other devices on a connected network.
Previously considered a widely known and more or less patched issue, a new wave of IoT devices have suddenly re-opened networks to the same vulnerability. It’s an especially worrying flaw that makes a network’s exterior firewall essentially useless; Considering how many networks rely on an exterior shield to keep their interior networks secure, it’s exactly the sort of vulnerability that can cripple a business of almost any size.
Yet somehow this particular exploit has yet to rest at the center of any attacks. Cybersecurity experts are already pushing for manufacturers and network administrators to audit their networks accordingly, as the main source of weakness in a DNS attack lies in any network running unencrypted web servers. As the IoT security market creeps towards a projected high of six billion dollars by 2023, issues on such a wide complement of devices might be what to blame.
At the developmental level, default passwords and insecure web applications still lead to the proliferation of data loss and cybercrime in ways we’ve seen dozens of times before. It’s already been a harrowing year for the cybersecurity field after several high-profile data leaks by several major companies.
The early detection dilemma
Detection isn’t always easy, especially in an industry where inventing new ways to circumvent security measures puts stress and strain on even the best adaptive scanning security measures, but some of the same companies concerned about becoming targets weren’t certain how many attacks happened to their competitors in a yearly timeframe and a worrying ten percent did not care enough to keep track of exploits at all.
While auditing existing networks for unsecured devices and keeping web servers passworded appropriately are important first steps, keeping up with changing threats in the realm of IoT security takes more than getting lucky with new security platforms. Allowing a decade-old exploit to proliferate to the tune of a half a billion unsecured devices opening up an equal number of vulnerabilities into countless networks, one has to wonder just how security-minded device companies truly are when our data has never been more at risk.
