Severe ThroughTek SDK Vulnerability Exposes Millions of IoT Devices to Spy Threats

A serious security flaw has been identified in multiple versions of the ThroughTek Kalay P2P Software Development Kit (SDK), potentially allowing remote attackers to gain control of vulnerable devices and execute harmful code. Labeled as CVE-2021-28372 (with a CVSS score of 9.6) and uncovered by FireEye Mandiant in late 2020, this issue involves improper access controls in ThroughTek’s point-to-point (P2P) products. If exploited, attackers could listen in on live audio, view real-time video streams, and compromise device credentials, leading to further attacks stemming from exposed functionalities. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), “successful exploitation of this vulnerability could enable remote code execution and unauthorized access to sensitive information, including audio/video feeds from cameras.” There are estimated to be 83 million active devices vulnerable to this flaw.

Severe Vulnerability in ThroughTek SDK Exposes Millions of IoT Devices to Potential Attacks

On August 18, 2021, a significant security flaw was identified within multiple versions of the ThroughTek Kalay P2P Software Development Kit (SDK). This vulnerability, designated as CVE-2021-28372 with a CVSS score of 9.6, poses a serious risk by potentially enabling remote attackers to gain control over affected devices, potentially leading to remote code execution.

This weakness, discovered by FireEye Mandiant in late 2020, relates specifically to improper access control within ThroughTek’s point-to-point (P2P) products. Experts warn that successful exploitation of this vulnerability could allow attackers to listen in on live audio feeds, view real-time video streams, and compromise device credentials, setting the stage for additional, more severe attacks leveraging the exposed functionalities of these devices. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has highlighted that this could result in unauthorized access to sensitive information, significantly raising the stakes for businesses utilizing these devices.

Currently, it is estimated that around 83 million active devices are operational on the Kalay platform. This large number underscores a widespread potential impact, which may affect a broad array of sectors employing IoT technology, from home security systems to medical devices. The vulnerability’s nature means that both individual consumers and organizations are at risk.

In terms of adversary tactics as defined by the MITRE ATT&CK framework, initial access methods likely exploited the vulnerability. Attackers could gain persistence by establishing a foothold through compromised devices. Furthermore, the attack could facilitate privilege escalation, allowing the intruder broader control over the device once access is gained.

Organizations using ThroughTek products should take immediate action to address this vulnerability by updating their systems and implementing stringent security measures to fortify their defenses. As the threat landscape evolves, it is crucial for business owners to remain vigilant and informed about such vulnerabilities that threaten the integration and operation of Internet of Things (IoT) solutions in their operations.

The implications of such vulnerabilities extend beyond individual devices; they affect the overall security posture of the organizations employing them. As IoT continues to proliferate, the cybersecurity community must remain proactive in identifying and addressing these critical vulnerabilities to minimize the risk of exploitation and safeguard sensitive data.

Source link

Related Posts

Kaseya Releases Security Patches for Two New 0-Day Vulnerabilities in Unitrends Servers

Kaseya, a U.S. technology company, has issued security patches to address two zero-day vulnerabilities in its Unitrends enterprise backup and continuity solution, which could lead to privilege escalation and authenticated remote code execution. These flaws are part of a trio reported by researchers at the Dutch Institute for Vulnerability Disclosure (DIVD) on July 3, 2021. The vulnerabilities have been resolved in server software version 10.5.5-2, released on August 12. However, an undisclosed client-side vulnerability in Kaseya Unitrends remains unpatched. To mitigate associated risks, the company has provided firewall rules for traffic filtering and recommends not exposing servers to the internet.

New Microsoft Exchange ‘ProxyToken’ Vulnerability Allows Attackers to Alter Mailbox Configurations

Details have surfaced regarding a recently patched security flaw in Microsoft Exchange Server that could be exploited by unauthenticated attackers to change server settings, potentially exposing Personally Identifiable Information (PII). The vulnerability, identified as CVE-2021-33766 (CVSS score: 7.3) and referred to as “ProxyToken,” was found by Le Xuan Tuyen, a researcher at the Information Security Center of Vietnam Posts and Telecommunications Group (VNPT-ISC), and reported through the Zero-Day Initiative (ZDI) program in March 2021. According to the ZDI, “With this vulnerability, an unauthenticated attacker can perform configuration actions on mailboxes belonging to arbitrary users.” For instance, the attacker could redirect all emails sent to a targeted account to a mailbox they control. Microsoft addressed this issue in its Patch Tuesday updates for July 2021.

Vulnerability in Linphone SIP Stack Could Allow Attackers to Remotely Crash Client Devices

On September 1, 2021, cybersecurity researchers revealed a zero-click vulnerability in the Linphone Session Initiation Protocol (SIP) stack. This flaw can be exploited remotely to crash the SIP client without any action needed from the victim, leading to a denial-of-service (DoS) condition. Identified as CVE-2021-33056 (with a CVSS score of 7.5), it arises from a NULL pointer dereference in the “belle-sip” component, a C-language library that supports SIP transport, transactions, and dialog layers. All versions prior to 4.5.20 are affected. The vulnerability was discovered and reported by the cybersecurity company Claroty. Linphone is an open-source, cross-platform SIP client that facilitates voice and video calls, end-to-end encrypted messaging, and audio conferences. SIP is the signaling protocol used to initiate, maintain, and terminate real-time multimedia communication sessions.

WhatsApp Image Filter Vulnerability May Have Exposed User Data to Remote Attacks

A recently patched high-severity security flaw in WhatsApp’s image filter feature posed a serious risk of allowing malicious images to extract sensitive information from the app’s memory. Identified as CVE-2020-1910 (CVSS score: 7.8), this vulnerability involved out-of-bounds read/write errors that could be exploited by applying specific filters to a crafted image before sending it to an unsuspecting recipient, enabling attackers to access critical data. According to WhatsApp’s advisory from February 2021, “A missing bounds check in WhatsApp for Android prior to version 2.21.1.13 and WhatsApp Business prior to the same version could have led to this vulnerability.” The issue was reported to the Facebook-owned platform by cybersecurity firm Check Point Research on November 10, 2020.