Bugs in Samsung IoT Hub Leave Smart Home Open To Attack
Researchers found 20 flaws in Samsung’s SmartThings Hub controller – opening up supported third-party smart home devices to attack.
Researchers found 20 vulnerabilities in Samsung’s SmartThings Hub, allowing attackers to control smart locks, remotely monitor the home via connected cameras and perform other alarming functions.
Cisco Talos researchers, who published a technical breakdown of the vulnerabilities on Thursday, said each of the flaws are located in Samsung’s centralized controller, a component that connects to an array of IoT devices around the house – from light bulbs, thermostats, and cameras. SmartThings Hub is one of several DIY home networking devices designed to allow homeowners to remotely manage and monitor digital devices.
“Given that these devices often gather sensitive information, the discovered vulnerabilities could be leveraged to give an attacker the ability to obtain access to this information, monitor and control devices within the home, or otherwise perform unauthorized activities,” researchers said in a report.
SmartThings Hub uses a Linux-based firmware and allows for communications with various IoT devices using various wireless standards Zigbee, Z-Wave and Bluetooth. SmartThings supports a broad spectrum of third-party products- from Philips Hue smart lightbulbs, to Ring video doorbells, as well dozens more smart home products sold under the brands GE, Bose and Lutron.
The breadth of potentially impacted products means an attacker could hack an array of connected home devices allowing adversaries to disable smart locks, turn off motion detectors, shut down smart plugs, control thermostats or even cause physical damage to appliances.
A Samsung spokesperson told Threatpost patches have been deployed that fix the bugs. “We are aware of the security vulnerabilities for SmartThings Hub V2 and released a patch for automatic update to address the issue. All active SmartThings Hub V2 devices in the market are updated to date,” Samsung said.
Separate to Cisco Talos, Samsung released a firmware advisory for Hub V2 devices on July 9.
Several vendors whose third-party products are supported by SmartThings including Philips Hue, Bose, Lutron and Ring didn’t respond to requests for comment from Threatpost.
Multiple Attack Chain Scenarios
Successful exploitation of vulnerabilities is not trivial. All require an attacker to chain a number of existing vulnerabilities together, according to the report.
“When considering the severity of vulnerabilities, it is essential to keep in mind that they might be used as part of a chain, as this would significantly elevate their severity,” researchers said.
There are three different attack chains that could be exploited by hackers to penetrate home devices, researchers said. The first is a remote code execution (RCE) vulnerability – the most dangerous of the three because it can be exploited without prior authentication and can be performed remotely.
This RCE chain attack impacts the “video core” HTTP server of the hub, and allows attackers to inject HTTP requests into this process from a network. The vulnerability (CVE-2018-3911) exists within the communications (via Port 39500) present between the hub and the remote servers it communicates with. The vulnerability is essentially an exploitable HTTP header injection bug that enables attackers to send specially crafted HTTP requests to impacted devices.
Researcher note, these injected requests are only semi-controlled – so to take full advantage of the attack, a bad actor would also need to exploit bugs (vulnerabilities CVE-2018-3907 to CVE-2018-3909) within the REST request parser of the “video core” process, which modifies the path of an HTTP request.
Finally, an attacker could close out the attack chain by leveraging a bug (CVE-2018-3902) that exists in the camera “replace” feature of video-core’s HTTP server. They would send an HTTP request leading to a buffer overflow attack on the stack.
Attacks Two, Three
The other two attack chains require the attacker to gain prior authentication, researchers said. One of these attacks enables remote code execution via a vulnerability (CVE-2018-3879) enabling authorized attackers to execute SQL queries against a database inside the device.
When used alone, this flaw only allows attackers to alter the database – but an array of other memory corruption vulnerabilities (CVE-2018-3880, CVE-2018-3906, CVE-2018-3912 to CVE-2018-3917, and CVE-2018-3919) that exist in SmartThings Hub allow for executing arbitrary code in the network after exploiting the first bug, researchers said.
The vulnerability CVE-2018-3879 can also be leveraged in the final chain attack, which allows for remote information leakage. This vulnerability can be used to create an empty file anywhere inside the device.
Attackers can then leverage denial of service bug CVE-2018-3926, which exists within the ZigBee firmware update process present within the “hubCore” binary used by the SmartThings Hub. Once the empty file is created this bug will cause the “hubcore” process to crash, triggering an information leak bug (CVE-2018-3927) that can be captured from the network.
“By chaining these 3 vulnerabilities in order, an attacker can obtain a memory dump of the `hubCore` process, which contains most of the core logic, and consequent sensitive information, of the Hub,” researchers said.
While Samsung’s updates have been pushed out automatically, researchers recommended that users verify the updated version has actually been applied to devices to ensure that they are no longer vulnerable.
“While devices such as the SmartThings Hub are typically deployed to provide additional convenience and automation to users, special consideration must be made to ensure that they are configured securely, and updated when new firmware updates are made available by the manufacturer,” they said.
- Sailpoint IIQ Consultant
- Up to £75,000
SailPoint IIQ consultant- London We are looking for a strong SailPoint IIQ consultant to work for this global enterprise, in this position you will be the lead consultant in regard to the IAM and PAM tools Duties include Responsible for designing, developing, testing, implementing, and integrating IAM (SailPoint) systems and solutions. Assessing requirements for Identity and Access Management solutions to meet stakeholders needs. Provide support for production IAM infrastructure systems and processes. Ensures the maintenance, patching, operating, and monitoring of IAM systems. Ensures senior management and staff are informed of any changes and updates in a timely manner. Experience with Maintaining and supporting SailPoint IIQ Assessing requirements for Privilege Access Management solutions to meet stakeholders needs We are looking for someone with the following experience SailPoint IIQ experience Expertise working with SailPoint Identity IQ platform - Access Lifecycle Management, Certifications, Role Management Expertise in onboarding applications with various connectors like Active Directory, JDBC, SCIM 2.0, Azure Active Directory Expertise in developing APIs (SCIM, REST) leveraging Java based developmentExperience of Privileged Access Management concepts and use cases Unfortunatly we are unable to provide sponsorship for this opportunity, therefore applications will need to be able to work in the UK
- SailPoint Consultant- Netherland-
- upto €700 per day
We are looking for a highly skilled SailPoint IIQ Consultant to work on a major deployment project. The ideal candidate will have experience with all aspects of SailPoint IIQ, including development, configuration, and administration. They will also be able to work independently and as part of a team to deliver high-quality results. · Responsibilities · Develop and configure Sailpoint IIQ solutions · Integrate SailPoint IIQ with other systems · Support SailPoint IIQ deployments · Provide technical support to users If you are a highly skilled SailPoint IIQ consultant who is looking for their next project, we encourage you to apply. look forward to hearing from you!
- Lead CyberArk deployment Consultant
- Upto £80,000 plus benefits
CyberArk Consultant is needed to be responsible for leading the deployment of CyberArk solutions for this expanding IT services business, You will work with customer both pre and post sales, getting involved in CyberArk Solution Design, helping to create CyberArk Strategic Roadmaps, on-boarding accounts, product and process integration into the CyberArk Solution and Proviso of Installation and technical Documentation. We are looking for this individual to have experience in: Installation of CyberArk PAS for V11.X and V12.X (Vault, DR Vault, Central Policy Manager and Password Vault Web Access) Upgrade of CyberArk from V9 and V10 (Vault, DR Vault, Central Policy Manager and Password Vault Web Access) Installation and Upgrade of Privilege Session Manager and Privilege Session Manager Proxy As some of your client will be government site, all individual will need to be put through SC clearance, therefore you must be eligible to receive this and happy to be put through(With a British Citizen or to have lived in the UK for the past 5 years) We are unable to provide work visa sponsorship for this opportunity
- Senior Business Analyst - Outside IR35 Contract, SC Clearance Required, London
- £400 per day outside IR35
Senior Business Analyst - Outside IR35 Contract, SC Clearance Required, Based in London Project- to engage with colleagues and stakeholders to investigate and model business functions, processes, information flows and data structures, using a range of business analysis techniques. • You will translate the solution to the business problem into detailed requirements by creating user stories and well-defined acceptance criteria. • Elicit end-to-end business requirements for a live cross-government service • Working across the Government departments to bring together varied business and operational outcomes to form a holistic overall set of service requirements Current SC clearance is required. As is the ability to travel to London.