26 IoT Flaws Enable Denial-of-Service Attacks, Privilege Escalation

Newly discovered vulnerabilities in Internet of Things (IoT) components could expose a range of connected devices to denial-of-service (DoS) attacks and privilege escalation, a researcher with NCC Group reports.

The report details 26 vulnerabilities in the Zephyr Real Time Operating Systems (RTOS), which is specifically designed for IoT applications, and MCUboot, an open source, hardware-independent bootloader seen as a "companion project" to Zephyr, said NCC Group technical director Jeremy Boone in a blog post on the research, which was conducted in January and February of 2020. 

Both of these components exist in a range of IoT sensors and devices including baby monitors, LEDs, smart wearables, and IoT wireless gateways. Zephyr RTOS is supported by several major vendors including Intel, NXP, Nordic Semiconductor, and Texas Instruments; it also supports a wide range of chipset architectures and development kits. 

NCC Group discovered 25 vulnerabilities affecting the Zephyr RTOS and one affecting MCUboot. Researchers found both locally and remotely exploitable memory corruption flaws, multiple paths that could let a compromised user application to escalate privilege to kernel mode, and multiple weaknesses in the design of certain exploit mitigation systems that exist in the kernel.

As of the research publication date, 15 of these 26 problems have been addressed.

"The remaining unpatched findings pose a low overall risk as they represent denial of service vulnerabilities, or opportunities to further harden the kernel by improving existing exploit mitigation systems," the report states. Zephyr has indicated to NCC Group that these lower-risk issues are outside the 90-day embargo policy and they will address them in a future release. 

Read more details and download the full findings here.

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register.