Too Much Information Is a Risk in IoT Universe

Computer systems can come with various security issues, but not all of them can be exploited to offer direct access to the device; some are just the stepping stone to an attack. When web applications in a smart device can be compelled to spill details about the system, a hacker could profit with an offensive plan.

Hackers typically take advantage of information disclosure vulnerabilities in the reconnaissance stage of an attack. They send requests to the target to learn more about the software it relies on and the environment it works in. At core, these faults are a matter of leaking the info that allow an attacker to look for known and exploitable security bugs.

What may seem like harmless details to some can, in the hands of a hacker, be used to build a plan to breach the target’s defenses or burrow deep into the network. Learning the type and version of the web server or the web framework of the app is enough to start searching for weaknesses. Such information can sometimes be obtained by simply sending a request to the device. In more serious cases, the responses the attackers receive can give them access to account credentials and secret keys, or even source code left unprotected, which may include authentication details.

Run-of-the-mill cybercriminals do not waste time manually analyzing for flaws every device they can reach over the internet. They automate this job and look online for gadgets that respond to particular requests. One recent example is the Reaper botnet that ruled over multiple types of IoT gadgets. It identified devices running firmware vulnerable to remote code execution, then served the exploits to take control of them.

Even if the information is not critical, hackers count on every bit of detail to obtain what they want. As the saying goes, “loose lips sink ships.” Unfortunately, there is nothing you can do directly to eliminate the problem from systems that share too much information or fail to protect data that is not essential for them to function properly. This is a task for the developers of the product.

However, this does not mean you have no option to keep safe the devices susceptible to information disclosure vulnerability attacks until a firmware update eliminates the possibility of attack. The Vulnerability Detection feature in Bitdefender BOX delivers feedback about the gadgets on the network that come with known security issues. Another solution is Bitdefender Home Scanner, which is built specifically for this purpose; it silently identifies the connected products in your home and returns details about their security state.