Old Code Dies Hard: Finding New Vulnerabilities in Old Third-Party Software Components and the Importance of Having SBoM for IoT/OT Devices
No ratings
Presented at BlackHat Europe 2023 by
Device manufacturers often rely on "security by obscurity" for their own code - e.g., by encrypting firmware files - and on the "principle of many eyes" when choosing to integrate open source components - i.e., if there are no public CVEs, a component is considered safe. This talk shows that these principles can fail the manufacturers, but serve the attackers well. Our running example is the software components of a wireless gateway device that is used to bring networking to industrial control systems, remote healthcare locations, and other environments. We discuss our journey of finding over 20 vulnerabilities within these components, both internal and open source. This particular series of devices has been well-researched in the past. Yet, we will show that due to incomplete patches or lack of variant analysis, several "bullets" can still pass through the same "bullet hole". In fact, the vulnerabilities in the open-source components remained "under the radar" for nearly a decade. We will demonstrate how one of these vulnerabilities allows for full control of the device. We will also discuss how these open-source components were missed by some commercial SBoM tools that rely on firmware analysis. We found more than 80,000 of these devices exposed via the Internet and potentially affected by past and present vulnerabilities. To better understand the threat landscape, we deployed high-interaction honeypots and a real physical device on the public Internet. We will cover the analysis of the attempted port scans and exploitation trials. Finally, this research exemplifies some of the issues that device manufacturers should focus on when reviewing their own code, creating default configurations, integrating third-party software components, and patching reported vulnerabilities.