Thursday, March 28, 2024

Critical Flaw in P2P Software Let Hackers to Hijack 2 Million IoT Devices Remotely & Spy Their Owners

A serious security flaw uncovered in iLnkP2P, a peer-to-peer (P2P) communications software component lets hackers hijack and gain access to nearly 2 million IoT Devices and control them remotely.

Peer-to-peer communication technology helps users to connect to their devices at the moment they come online which allows attackers to exploit the IoT devices such as security camera and control it remotely.

A peer-to-peer software component iLnkP2P developed by Shenzhen Yunni Technology, a Chinese based company and this component deployed in millions of Internet of Things (IoT) devices.

iLnkP2P bundled in security cameras and Webcams, baby monitors, smart doorbells, and digital video recorders and the security flaw allows attackers to eavesdrop, password theft, and possibly remote compromise.

Paul Marrapese, a researcher who discovered the flaw said that the vulnerability affected the 2 million IoT devices around the world those distributed by HiChip, TENVIS, SV3C, VStarcam, Wanscam, NEO Coolcam, Sricam, Eye Sight, and HVCAM.

According to the Researcher, Affected devices use a component called iLnkP2P. Unfortunately, iLnkP2P is used by hundreds of other brands as well, making identification of vulnerable devices difficult.

Learn : Mastering the Security of the Internet of Things Course

Discovering the Vulnerable IoT Devices

There are specific serial number known as a UID that looks like (FFFF-123456-ABCDE )can be used to identify this vulnerable device.

The researcher said that each ID begins with a unique alphabetic prefix that identifies which manufacturer produced the device, in this case, many of the companies that white-label the iLnkP2P software.

IOT Devices

Following Prefix contain devices are vulnerable that while labeled in millions of IoT devices but it’s not limited.

AIDAJTAVABSIPCAM
CPTCAMCTWDFTDFZDYNE
EEEEELSAESNESSEST
FFFFGCMNGGGGGKWHDT
HHHHHRXJHVCHWAAHZD
HZDAHZDBHZDCHZDNHZDX
HZDYHZDZIIIIIPCISRP
JWEVKSCMCIMCIHDMDI
MDIHDMEGMEYEMGAMGW
MICMICHDMMMMMSEMSEHD
MSIMSIHDMTEMTEHDMUI
MUIHDNIPNIPHDNPCNTP
OBJOPCSOPMSPARPARC
PCSPHPPIOPIPCAMPIX
PNPPSDPTPQHSVROSS
SIDSIPSXHTIOTSD
UIDVIOVSTDVSTFWBT
WBTHDWNSWNSCWXHWXO
XDBLXTSTZESZLDZSKJ
ZZZZ

HiChip — a Chinese IoT vendor alone manufactured devices for nearly half of the vulnerable devices that uses the prefixes FFFF, GGGG, HHHH, IIII, MMMM, ZZZZ.

Marrapese said to Kerbs, “a proof-of-concept script he built identified more than two million vulnerable devices around the globe (see map above). He found that 39 percent of the vulnerable IoT things were in China; another 19 percent are located in Europe; seven percent of them are in use in the United States.”

He also developed a proof-of-concept that allows stealing the passwords from devices by abusing their built-in “heartbeat” feature.

A Heartbeat future that built-in with the iLnkP2P sends to “yes I’m here” to their preconfigured P2P servers regularly and waiting for the response and further instructions.

He attempts to notify China’s CERT, iLnk and a half dozen major vendors whose products make up the bulk of the affected devices, none of them have responded to his reports

These are two CVE that we need to point out here ,

  • CVE-2019-11219 refers to an enumeration vulnerability in iLnkP2P that allows attackers to rapidly discover devices that are online.
  • CVE-2019-11220 refers to an authentication vulnerability in iLnkP2P that allows attackers to intercept connections to devices and perform man-in-the-middle attacks and control the device remotely.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Also Read:

Hackers Offered IoT Botnet as Service “TheMoon” : Botnet-as-a-Service

Beware – Dangerous IoT Attacks Leads Some One to Hack and Control Your Car

Chalubo Botnet Compromise Your Server or IoT Device & Use it for DDOS Attack

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles