"A Quarter Of IoT Devices Is Leak '

Connecting IoT devices in the home is like playing Russian roulette. Nearly one in four 'connected' devices for home use is not secured. Or there are errors in the firmware or the Web portal to gain access to the device is not secure enough. That's the conclusion of researchers from the French Eurecom and the Ruhr University in Bochum, Germany. They examined the firmware on routers, modems, VoIP phones, network cameras and other IoT devices that can be managed via the internet.

Attempts were made to undermine security by customizing the firmware by malicious software updates, but also to attack the web portal of the aircraft. The portals were exposed to frequent attacks such as XSS (cross-site scripting), CSRF (cross-site request forgery), SQL injection and RCE (remote code / command execution).

In total, were investigated in 1925 firmware images from 54 different manufacturers. More than 9200 vulnerabilities were found in 185 firmware images. Although only 8 percent of the firmware php code contained in the management of the portal, was found in 143 firmware images whopping 5000

XSS Vulnerabilities.

The study seems to confirm what even last week at Black Hat Europe emerged. A survey conducted by Information Week and Dark Reading which showed that IT professionals believe that in two years the security of IoT will be a top priority. Now the priority is still mainly in the security of applications and end users.

Tips For A Safe Wifi Router: Change Tthe Default IP Range

Owners of a wifi router that will protect your device must do more than just changing the default password, even customizing the default IP range, choosing a long wifi password of more than 20 characters and disabling Telnet is recommended.

The advice comes from James Garcia of security firm Webroot. He collected a total of 12 tips to tighten the security of Wi-Fi routers. So it is recommended to install the latest firmware for the router, WPS not use and disable remote management, as well as administrative access via the wireless network. Administrators should only via a UTP cable can log in.

The next step that advises Garcia is adjusting the standard IP range of the router. Almost every router has an IP address that begins with 192.168.1.1. By applying this to be CSRF (Cross-Site Request Forgery) attacks are prevented.Furthermore, the security expert recommends limiting the MAC addresses that have access to the router and not to broadcast the name of the Wi-Fi network. Finally, users advised to services such as Telnet, PING, UPnP, SSH and HNAP turn off or turn down.

After the adjustments have been made, users must remember to log out, but that applies to all websites, tools or consoles where users have completed their work. "I would definitely recommend taking these steps, but if you can not all do, the more, the better," said Garcia. According to him, the principle of prevention is better than cure should apply standard for IT security.