Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Risks in IoT Supply Chain

Summary: Palo Alto Networks research found 89% of IT decision-makers globally reported the number of IoT devices on their networks increased over the past year, with 35% reporting a significant increase, and IDC estimates 41.6 billion connected IoT devices by 2025. Unit 42 describes multi-layer supply chain weaknesses across hardware, firmware, operation and vulnerability layers, citing the July 2020 discovery of counterfeit Cisco Catalyst 2960-X switches, a March 2020 OpenWrt flaw that let attackers impersonate downloads from downloads.openwrt.org, and the June 2020 Ripple20 set of 19 zero-day vulnerabilities in a Treck TCP/IP library affecting printers, infusion pumps and industrial control devices.

Why it matters: Ripple20 shows the core problem: 19 zero-days in one third-party library, and no reliable way to know how many devices across how many vendors carry it. A 2019 NICTER report cited here found close to 48% of dark web threats detected were IoT related, and without an inventory of connected devices, patching, monitoring or disconnecting the vulnerable ones is guesswork.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related