Millions of smart devices could still have major security flaws

(Image credit: Pixabay)

The latest study from Forescout Research Labs has found that an alarming number of smart devices could easily be targeted by malware. The enterprise security firm found 33 new zero-day vulnerabilities, present in millions of smart devices produced by more than 150 manufacturers.

Forescout has dubbed these 33 security bugs “AMNESIA:33,” finding them in four widely used open source TCP/IP stacks that are found in the foundational connectivity components of millions of IoT devices.

“While it is difficult to assess the full impact of AMNESIA:33, we estimate more than 150 vendors and millions of devices worldwide are vulnerable,” a Forescout whitepaper reads. “Since these open source stacks are widely used in embedded components, they exist in devices used in most modern enterprises. Affected devices range from network switches to smart printers, environmental sensors to security cameras, self-checkout kiosks to RFID asset trackers, and badge/fob readers to uninterruptible power supplies, to name just a few.”

Here's our list of the best antivirus services right now
Check out our list of the best endpoint protection services available
We've built a list of the best malware removal software around

Smart cyberattacks

Four of the vulnerabilities that make up AMNESIA:33 are classified as critical, allowing for remote code execution attacks. In addition, the other security bugs cause memory corruption and can be exploited to cause denial of service, information leaks, and DNS poisoning.

As more businesses have embraced IoT or smart devices, the security standards of TCP/IP stacks have become significantly more important. Forescout points out that the AMNESIA:33 bugs could be used to launch attacks against healthcare organizations, retailers, utility suppliers, and manufacturers.

The AMNESIA:33 research is part of Forescout’s Project Memoria, an initiative that aims to provide the cybersecurity community with the largest study on the security of TCP/IP stacks, identifying common vulnerabilities and exploring ways they can be mitigated. Currently, the best ways for businesses to limit potential threats is by conducting risk assessments, using internal DNS servers, and installing security patches as soon as they become available.

Here's our rundown of the best ransomware protection money can buy

Barclay has been writing about technology for a decade, starting out as a freelancer with ITProPortal covering everything from London’s start-up scene to comparisons of the best cloud storage services. After that, he spent some time as the managing editor of an online outlet focusing on cloud computing, furthering his interest in virtualization, Big Data, and the Internet of Things.