Forescout Research Labs has discovered a set
of 33 new memory-corrupting vulnerabilities
affecting millions of enterprise IoT, OT and IT devices.
Lurking in four open-source TCP/IP stacks
used by over 150 vendors,
AMNESIA:33 can present an immediate risk
to organizations worldwide.
Four of the vulnerabilities are critical,
with possible exploits including Remote Code Execution,
Denial of Service and Data Exfiltration.
And with the rapid shift to Work-From-Home in 2020,
the risk surface for all enterprises has broadened
through unmanaged devices on their employees’ home networks,
which are highly vulnerable to AMNESIA:33 exploits.
In this scenario,
a threat actor has selected your manufacturing
company’s production line as a target.
The hacker infiltrates an employee’s home network
via an unmanaged wireless router,
allowing them to compromise a VPN-connected laptop.
They then move laterally across your network through a
Windows exploit to gain control of an engineering workstation
with access to your plant’s Industrial Control System.
The attacker tampers with a protocol gateway,
corrupting the link between the control network
and serial-enabled equipment – causing production to halt.
In another scenario,
a threat actor aims to sabotage your retail chain.
The hacker exploits an AMNESIA:33 vulnerability in a
smart temperature monitor as the entry point
to the store’s local network.
They then send malicious packets, which take
the receipt printers for several POS systems offline,
causing massive in-store delays.
If the hacker wants to cause greater damage,
they continue their attack by targeting the network switch,
disabling communications between the local store’s network
and its corporate services.
Forescout Technologies strongly advises
taking swift action to protect your enterprise.
Assess your risk and exposure
Rely on internal DNS servers
Disable or block IPv6 traffic
Segment devices to mitigate risk
Patch vulnerable devices when possible
Monitor for malformed packets
To learn more about AMNESIA:33, visit our website.