SentinelOne, an autonomous cybersecurity platform company, has announced that SentinelLabs security researcher Barak Sternberg has identified four unique vulnerabilities in smart HDL Automation devices
The vulnerabilities exposed thousands of HDL devices to adversary remote control, leading to possible network intrusion, secret exfiltration and even attacks on ransomware.
SentinelOne notified HDL of the issues through the responsible disclosure process and patched the vulnerabilities.
IoT devices are omnipresent at home and in the workplace, connecting lights, air conditioning and even heat-sensors to home or business networks.
IoT devices are also potential security weak spots targeting attackers to exploit internal network configurations, change arbitrary controllers and cause damage to software or hardware. With companies adding more and more connected devices to their networks, vulnerabilities such as those outlined in SentinelLabs’ research are a potential vulnerability.
“IoT can pose a significant threat to enterprise security because, while anything you connect to your network is a potential point of ingress, not everyone considers that IoT devices contain unintended vendor-created backdoors,” said Sternberg. “Many organisations don’t design smart thermostats or refrigerators with security in mind. However, even mundane devices such as this can be open to attackers, making it critical to understand exactly how many devices you have connected to your network and to harden every endpoint.”
SentinelLabs has identified two vulnerabilities that enabled account takeover; a flaw in the “forgot your password” function, and debug email account takeover.
It also identified two additional vulnerabilities related to endpoint APIs. Because of these shortcomings, SentinelLabs researchers were able to compromise remote servers that were used as proxies to configure smart devices and worked on patch solutions with HDL Automation.
Suppose attackers were simply interested in causing chaos. In that case, by raising the temperature in a server room, disabling security cameras or disabling sensors designed to detect leaks or voltage surges, they could cause physical damage. The four newly found IoT vulnerabilities highlight IoT cyberattacks’ sensitivity and cost in impacting the digital way of life.
