Wednesday, November 6, 2024
HomeCyber Security News‘Amnesia:33’ TCP/IP Flaws Affect Millions of IoT Devices

‘Amnesia:33’ TCP/IP Flaws Affect Millions of IoT Devices

Published on

Malware protection

Forescout Research Labs has launched Project Memoria, an initiative that aims at providing the community with the most important study on the security of TCP/IP stacks. AMNESIA:33 is the first research published under Project Memoria.

AMNESIA:33

AMNESIA:33” is a set of 33 vulnerabilities that impact four open-source TCP/IP protocol stacks that are used by major IoT, OT, and IT machine vendors.

It affects multiple open source TCP/IP stacks that are not owned by a single company. This implies that a single vulnerability is likely to spread easily and silently across multiple codebases, development teams, companies, and products, which presents significant challenges to patch management.

- Advertisement - SIEM as a Service

Researchers estimated quite 150 vendors and millions of devices are susceptible to AMNESIA:33

The security flaw in TCP/IP stack

The TCP/IP stacks affected by AMNESIA:33 are often found in operating systems for embedded devices, systems-on-a-chip, networking equipment, OT devices, and a myriad of enterprise and consumer IoT devices.

A security flaw in a TCP/IP stack can be extremely dangerous because the code in these components may be used to process every incoming network packet that reaches a device.

Many of the vulnerabilities reported within AMNESIA:33 arise from bad software development practices, such as an absence of basic input validation. Mostly corruption in memory can cause a denial of service, information leaks, or remote code execution.

AMNESIA:33 – Forescout

Three of the most severe issues reside in uIP (CVE-2020-24336), picoTCP (CVE-2020-24338), and Nut/Net (CVE-2020-25111), all of which are remote code execution (RCE) flaws and have a CVSS score of 9.8 out of a maximum of 10.

  • CVE-2020-24336 – The code for parsing DNS records in DNS response packets sent over NAT64 does not validate the length field of the response records, allowing attackers to corrupt memory.
  • CVE-2020-24338 – The function that parses domain names lacks bounds checks, allowing attackers to corrupt memory with crafted DNS packets.
  • CVE-2020-25111 – A heap buffer overflow occurring during the processing of the name field of a DNS response resource record, allowing an attacker to corrupt adjacent memory by writing an arbitrary number of bytes to an allocated buffer.

Exploitability

Exploitability is influenced heavily by the following factors:

Stack configuration–  TCP/IP stacks are highly configurable, allows enabling and disabling various sub stacks, specifying buffer sizes, selecting different kinds of memory allocators, regulating interaction with network drivers, and handling debugging functionality.

During the research, some bounds checks were implemented as part of assertion predicates, which are often turned off in production, so the exploitability of some issues depends on the assertion configuration.

Networking Hardware & Driver–  TCP/IP stacks often can be configured to offload packet validation and filtering, and certain network controllers do so autonomously regardless of stack configuration.

Depending on the nature of a vulnerability, this can influence whether a malicious packet ever gets to reach the code it seeks to exploit.

Target Platform- The exploitability of an issue is highly dependent on the target’s hardware architecture and configuration. For example, CVE2018-16524 affects the FreeRTOS+TCP stack by allowing an attacker to provide an MSS value of 0 and cause a division-by-zero, which can lead to a DoS.

Mitigation Actions

  • Disable or block IPv6 traffic whenever it is not needed in the network
  • Configure devices to rely on internal DNS servers as much as possible and closely monitor external DNS traffic
  • Monitor all network traffic for malformed packets

These are the possible mitigating actions that asset owners and security operators can take to protect their networks from the TCP/IP vulnerabilities in AMNESIA:33.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Researchers Detailed Credential Abuse Cycle

The United States Department of Justice has unsealed an indictment against Anonymous Sudan, a...

Rise Of Ransomware-As-A-Service Leads To Decline Of Custom Tools

Ransomware-as-a-Service (RaaS) platforms have revolutionized the ransomware market.Unlike traditional standalone ransomware sales, RaaS...

North Korean Hackers Employing New Tactic To Acruire Remote Jobs

North Korean threat actors behind the Contagious Interview and WageMole campaigns have refined their...

CRON#TRAP Campaign Attacks Windows Machine With Weaponized Linux Virtual Machine

Weaponized Linux virtual machines are used for offensive cybersecurity purposes, such as "penetration testing"...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Researchers Detailed Credential Abuse Cycle

The United States Department of Justice has unsealed an indictment against Anonymous Sudan, a...

Rise Of Ransomware-As-A-Service Leads To Decline Of Custom Tools

Ransomware-as-a-Service (RaaS) platforms have revolutionized the ransomware market.Unlike traditional standalone ransomware sales, RaaS...

North Korean Hackers Employing New Tactic To Acruire Remote Jobs

North Korean threat actors behind the Contagious Interview and WageMole campaigns have refined their...