Forest Global Training Partners

Cyber Risks · Krebs on Security

IoT Device Maker Vows Product Recall, Legal Action Against Western Accusers

Summary: Chinese electronics maker XiongMai Technologies said it would recall millions of devices, mainly network cameras, after researchers at Flashpoint found its hardcoded root/xc3511 default password in white-labeled DVR and IP camera boards used in the Mirai botnet attack on Dyn. The company said it disabled default Telnet in a firmware fix dated September 2015 in its statement to reporters, though its own social media post cited April 2015, and it threatened legal action against outlets it accused of false statements.

What you should know: Dyn traced the attack traffic to tens of millions of discrete IP addresses in the Mirai botnet, and the password at the center of it was hardcoded into firmware that users could not disable from the administration panel - so any device built on those boards shipped vulnerable regardless of what the owner did.

Read the original at Krebs on Security ↗

Topics
Malware
Related