Over a year has now passed since we were first alerted to a flaw in the OpenSSL cryptography library, widely used in the implementation of Transport Layer Security (TLS) protocol. The bug CVE-2014-0160, was quickly dubbed “Heartbleed” (http://heartbleed.com/) after a missing bounds check in the TLS heartbeat extension. Despite the passing of time and the high profile nature of the flaw, IoT crawler Shodan has recently discovered the vulnerability still exists on over 200,000 internet connected devices.
Shodan (http://www.shodanhq.com/) launched in 2009, is a search tool that seeks out internet-of-things (IoT) and other internet connected devices collecting the information returned by these devices to build up a picture of what services are being offered. The data can then displayed in a variety ways including by geo-region breakdown. This is great tool for IT and security teams and unfortunately also for the bad guys.
Many people will deem 200,000 vulnerable devices on the internet as unacceptable, and in many ways it is. At the same time I think it is important for us all to understand why this happens and why there is currently no easy fix. I believe we will see vulnerabilities like Heartbleed in the wild for many years to come. Whereas I do believe there is a certain level of ignorance to the threat, I also believe there are many other factors.
There are users who aware their devices are vulnerable, not realizing their device uses the buggy version of OpenSSL, or even uses SSL for communication. There will be others that haven’t heard of Heartbleed and many not understanding the tech details, the fix, or the ramifications. Sometimes putting two and two together is little more difficult that we’d like to think. Hey, we are asking users to understand and fix their devices, when at present they still haven’t changed the device’s default admin password – even worst, they’ve not realized their device is even connected to the internet.
Ignorance and even arrogance with regards to the lack of patching has been observed. Not patching a device when possible, believing it is unlikely to be exploited is simply not acceptable. We need to move away from setup and configure once, then leave alone. Users need to research, revisit and understand the devices on the network and especially those connected to the internet.
Search engines like Shodan mean that susceptible devices are less likely to go under the radar – it also highlights the appetite the business and personal sector have for security. Once the configuring and setup of these devices required a certain skill level. That’s all changed now, especially with WPS and other technologies, many devices are completely ‘plug and play’. The complexities of such systems are hidden from the user – even if patches are available for said devices, I very much doubt many users would know how to install them.
There are also many manufacturers that focus on the delivering of ‘cheap’ affordable technology, OEM and unbranded to an untrained eye in many cases. These cheaper offerings normally come at a price – limited aftercare. Put simply you’ll be lucky to ever see manufactures release new firmware and software updates after purchasing and that’s if the vendor still exists.
The mobile phone industry has used a similar business model for years, after a while updates stop, if they even started – meaning customers will need to go out and purchase the a new handset/hardware to have the latest and most secure software. What we are left with is millions of vulnerable internet connected devices. Most devices, especially legacy devices, the ones most likely to be at risk have no OTA (over the air) update capabilities, many do not even include a manual update feature – many are not even capable of running the newer firmware and software.
There’s a lot of bad news, but it doesn’t mean a certain level of protection cannot be offered – something the Shodan results are unable to factor in. Internet connected devices need continuous monitoring to detect common attacks, the use of automated vulnerability scanning solutions, the use of tools like Shodan. There are many possible ways to mitigate risk, like the separating of networks. Heartbleed has been a big wake up call, the number of probable vulnerable devices, the extra media attention along with the slick branding propelled this security risk from the geeks and IT and security professionals all the way to the boardroom. It’s important not to be fooled in to thinking this is only an IoT issue, a proportion of the devices highlighted belong to the more traditional internet infrastructure hardware group. That said, the mass adoption of IoT will only make future vulnerabilities more difficult to correct.
I don’t see these current findings as a ‘we haven’t patched Heartbleed’ issue, it’s another example of what happens without regulation and standardization, without user education and best practices, coupled with the ‘security as an afterthought’ mentality.
