Forest Global Training Partners

Cyber Risks · Krebs on Security

Time to Harden Your Hardware?

Summary: A self-propagating worm dubbed "The Moon" bypassed the username and password prompt on Linksys E1000, E1200 and E2400 routers and infected close to 1,000 of them, according to Ars Technica, with Linksys saying only devices with Remote Management Access enabled are affected. The same week brought IOActive research showing Belkin WeMo home automation devices leak the firmware signing key and password on the installed firmware and fail to validate SSL certificates, plus a Synology NAS flaw with a public exploit since December that let intruders turn one user's storage array into a Bitcoin mining rig.

Key Takeaway: Belkin was first notified of the WeMo flaws in October 2013 and, per Carnegie Mellon's Software Engineering Institute, had offered no solution or workaround by the time the advisories ran. The devices a security leader's staff plugs in at home are the same class of hardware now drawing active scanning and exploitation.

Read the original at Krebs on Security ↗

Topics
Malware
Related