Firedome Disclose Vulnerabilities in Yale IP Cameras, Could Be Much Larger, as Many Manufacturers Share Base Firmware
Firedome's research team was able to find an unknown vulnerability 0-Day Post-auth RCE in Yale WIPC-301W IP camera
NEW YORK, June 3, 2020 /PRNewswire/ -- Firedome, a leading provider of cybersecurity & privacy protection service for IoT manufacturers, announced today that its research team identified a 0-day vulnerability (CVE-2020-1076) in the Yale WIPC-301W IP camera. The vulnerability was identified in January 2020 and Firedome's research team has since worked with Yale's R&D team to explain the details, after which Yale addressed the matter assertively and expeditiously, issuing an effective firmware patch to all impacted Yale Smart Living IP camera devices.
The camera was susceptible to a Remote Code Execution vulnerability in its local web server, which enables a hacker to gain full control over the device (e.g. breaching user's privacy and sensitive personal information by viewing video feed, stealing files, disabling & bricking devices, installing ransomware, gaining remote command shell with root (highest) permissions, etc).
"To estimate the scale of this vulnerability," said Shaked Ilan, VP Security & Product at Firedome, "Firedome's research team performed further research, scanning the internet for other vulnerable devices. Various other companies were found to share the same base firmware used by Yale, and are therefore very likely to also be impacted by the vulnerability."
Firedome Lab's research confirms that the overall situation is quite concerning, with 45K vulnerable devices[1] worldwide using the vulnerable FW versions (2.x.2.29 to 2.x.2.43_p1). Furthermore, since the scan only covered devices with direct internet access (which excludes devices behind NAT), the actual number of vulnerable devices is estimated to be much higher.
"Using the exploited vulnerability," said Shaked, "Firedome was able to install the Firedome Endpoint Protection agent on the vulnerable device, patching the vulnerability using advanced cyber threat detection, response, and prevention mechanisms, effectively making it immune to the vulnerability, and to more unknown vulnerabilities that might exist in the system."
The remote patching feature is just one of many detection and protection capabilities of the Firedome platform that can proactively address vulnerabilities such as the above example.
Firedome offers a unique, real-time, endpoint cybersecurity solution tailor-made for IoT devices, that is designed to enable IoT device manufacturers to proactively prevent, detect, and respond to vulnerabilities in connected devices in real-time autonomously, without intervention.
The company's AI-powered, software-only platform enables broad detection capabilities, is interoperable across most IoT operating systems, and scalable to millions of devices. Firedome provides a multi-layered holistic security platform, with a lightweight agent backed by machine learning and a dedicated 24/7 security operations center to detect, prevent and respond to attacks on IoT devices, decrease operational costs, and reduce emergency firmware upgrades.
YALE Testimonial
Firedome LABS research team identified a vulnerability in the Yale WIPC-301W IP camera IoT device that is currently being phased out of the market.
The minor issue has been resolved and measures have been put in place to prevent a similar accordance.
We can confirm that our customers data was not compromised and that the system is secure.
Many companies like Firedome, are actively testing for vulnerabilities in smart residential products across the industry. The team at Firedome acted with speed and professionalism to notify us of the issue which was rectified by our team.
We take security and data protection very seriously and are continuously striving to improve our processes and procedures.
About Firedome
Firedome works with leading manufacturers to differentiate them with proactive, real-time cybersecurity on their device base. We offer an AI-based, software-only solution for autonomous threat resolution to establish device makers as security leaders in their space, while opening new revenue streams by addressing end user privacy and security concerns that inhibit adoption.
Firedome has offices in New York and Tel Aviv and has thus far secured $14.5M in funding. The company employs multinational cyber, embedded, research and analysis experts. For more information please visit www.firedome.io.
1 The search was done using Shodan - a search engine that can be used to search IoT devices, among others
Media Contact:
Sharon Mirsky
[email protected]
SOURCE Firedome
Share this article