published research Archives

published research

SOHOwned: 300K Home Routers Hacked

March 4, 2014 Paul Roberts

A string of reports in recent weeks has focused a spotlight on rising attacks against an often-overlooked piece of equipment that can be found in almost every home and business: the wireless router. Just this week, the security firm Team Cymru published a report (PDF) describing what it claims is a widespread compromise of small office and home office (SOHO) wireless routers that was linked to cyber criminal campaigns targeting online banking customers. Cymru claims to have identified over 300,000 SOHO devices (mostly in Asia and Europe) that were compromised. According to the report, the compromises first came to light in January, after Team Cymru analysts noticed a pattern of SOHO routers with overwritten DNS settings in central Europe. The affected devices are from a range of manufacturers, including well-known brands like D-Link, Micronet, Tenda and TP-Link. The devices were vulnerable to a number of attacks, including authentication bypass and cross-site […]

Update – Virtual Vandalism: Firm Warns Of Connected Home Security Holes

February 18, 2014 Paul Roberts

[This story was updated to include response from Belkin describing its response to the vulnerabilities identified by IOActive, including firmware updates. – PFR Feb 19, 2014] A researcher with the respected security firm IOActive says that he has found a number of serious security holes in home automation products from the firm Belkin that could allow remote attackers to use Belkin’s WeMo devices to virtually vandalize connected homes or as a stepping stone to other computers connected on a home network. In a statement released on Tuesday, IOActive researcher Mike Davis said that his research into Belkin’s WeMo technology found the “devices expose users to several potentially costly threats, from home fires with possible tragic consequences down to the simple waste of electricity.” IOActive provided information on Davis’s research to the US Computer Emergency Readiness Team (CERT), which issued an advisory on the WeMo issues on Tuesday. Belkin did not […]

Veterans Targeted In Attack Using IE 10 Zero Day

February 13, 2014 Paul Roberts

Visitors to the web site of the Veterans of Foreign Wars (VFW) are being targeted in an attack that exploits a previously unknown hole in Microsoft’s Internet Explorer 10 web browser, according to warnings Thursday by security firms. Some visitors to the web site of the Veterans of Foreign Wars (VFW), vfw[dot]org, were the victim of a ‘watering hole’ attack that takes advantage of a previously unknown ‘use-after-free’ vulnerability in Microsoft’s Internet Explorer 10 web browser. The VFW site was hacked and then altered to redirect users, silently, to a malicious website programmed to exploit vulnerable versions of IE 10 on systems running 32 bit versions of the Windows operating system. The VFW did not immediately respond to e-mail and phone requests for comment. According to a write-up by the security firm FireEye, the vulnerability allows the attacker to “modify one byte of memory at an arbitrary address” stored […]

Experts: Despite Warnings, Slow Progress Securing Industrial Systems

January 16, 2014 Paul Roberts

Despite increased media attention to the security of industrial control systems and critical infrastructure, progress in securing those devices has been slow, experts say. Despite progress in some areas, critical infrastructure – including energy and transportation networks- remains vulnerable to attacks leveled at known security holes for months or years because of a lack of vendor response or customers who lack the incentive or know-how to patch vulnerable systems. That according to some of the world’s top experts in cyber security and industrial systems, who are gathering this week at an industry conference in Miami. The S4 Conference, sponsored by the firm DigitalBond, is one of the premiere conferences for cyber security as it pertains to industrial control systems and often coincides with disclosures from industrial system vendors about serious security holes in their products. The security of industrial control systems has been a top concern of IT security experts and government […]

Mobile Devices Taking Part In Enterprise DDoS Attacks?

January 14, 2014 Paul Roberts

Mobile phones have long been on the radar for enterprises concerned about data loss and the spread of malicious code. But a report from the firm Prolexic suggests that they may also be taking part in massive denial of service (DoS) attacks against enterprise networks. The firm Prolexic said that data it collected in the final quarter of 2013 suggests that mobile devices are playing a growing role in distributed DoS (or DDoS) attacks against the firm’s enterprise customers. “Malicious actors now carry a powerful attack tool in the palm of their hands, which requires minimal skill to use,” said Stuart Scholly, president of Prolexic, in a statement. [Read more Security Ledger coverage of Denial of Services Attacks.] Infecting unwitting victims with a malicious program is a common method used by botnet operators whose platforms are behind many large-scaled DDoS attacks. But Scholly said that mobile devices and mobile DDoS […]