Forest Global Training Partners

Cyber Risks · Krebs on Security

Naming & Shaming Web Polluters: Xiongmai

Summary: Austrian security firm SEC Consult published research on Tuesday detailing multiple unfixed security holes in hardware made by Chinese manufacturer Xiongmai, after giving the company seven months' notice beginning in March 2018. SEC Consult found Xiongmai's XMEye peer-to-peer cloud ships with a blank admin password, an undocumented 'default' account with password 'tluafed', no signed-firmware protection, and MAC address ranges borrowed from Cisco, Koenig & Bauer and Metrohm, and it estimates roughly 9 million Xiongmai P2P devices are online based on scanning two percent of available UID ranges.

Bottom line: Xiongmai components powered a majority of the devices in the 2016 Mirai botnet, and Flashpoint's Zach Wikholm says the 9 million estimate is low given the company holds 25 percent of the world's DVR market - with its gear white-labeled and sold by more than 100 vendors whose products rarely name Xiongmai on the label.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related