SoylentNews is people
SoylentNews
'Ripple20' Bugs Impact Hundreds of Millions of Connected Devices:
A series of 19 different vulnerabilities, four of them critical, are affecting hundreds of millions of internet of things (IoT) and industrial-control devices.
The issue is based in the supply chain and code reuse, with the bugs affecting a TCP/IP software library developed by Treck that many manufacturers use. Researchers at JSOF uncovered the faulty part of Treck's code, which is built to handle the ubiquitous TCP-IP protocol that connects devices to networks and the internet, in the devices of more than 10 different manufacturers—and it's likely present in dozens more.
Affected hardware includes everything from connected printers to medical infusion pumps and industrial-control gear, according to researchers at JSOF's research lab. Treck users include "one-person boutique shops to Fortune 500 multinational corporations, including HP, Schneider Electric, Intel, Rockwell Automation, Caterpillar, Baxter, as well as many other major international vendors suspected of being of vulnerable in medical, transportation, industrial control, enterprise, energy (oil/gas), telecom, retail and commerce, and other industries," according to the research.
"The wide-spread dissemination of the software library (and its internal vulnerabilities) was a natural consequence of the supply chain 'ripple-effect,'" researchers said in a posting on Tuesday. "A single vulnerable component, though it may be relatively small in and of itself, can ripple outward to impact a wide range of industries, applications, companies and people."
The flaws, dubbed Ripple20, include four remote code-execution vulnerabilities. If properly exploited, data could be stolen off of a printer, a medical device's behavior could be tampered with, or industrial control devices could be made to malfunction.
"An attacker could hide malicious code within embedded devices for years. One of the vulnerabilities could enable entry from outside into the network boundaries; and this is only a small taste of the potential risks," according to JSOF.
(Score: 0) by Anonymous Coward on Wednesday July 01 2020, @09:27PM (1 child)
What does one have to do with the other? Is having a WiFi connected fridge same as having a bank account now?
(Score: 3, Interesting) by Runaway1956 on Wednesday July 01 2020, @10:14PM
Kinda sorta in a roundabout way.
Someone will sell you a service, to keep your fridge stocked. The fridge will report to the vendor that your milk is almost empty and/or 2 days past expiration. That vendor will make sure the milk is replaced before you chug the chunky stuff down, and the chunks hang on your tonsils.
Oh - the cashless bit? Your vendor won't accept cash. He will need access to you credit/debit card information.