"A Quarter Of IoT Devices Is Leak '

Connecting IoT devices in the home is like playing Russian roulette. Nearly one in four 'connected' devices for home use is not secured. Or there are errors in the firmware or the Web portal to gain access to the device is not secure enough. That's the conclusion of researchers from the French Eurecom and the Ruhr University in Bochum, Germany. They examined the firmware on routers, modems, VoIP phones, network cameras and other IoT devices that can be managed via the internet.

Attempts were made to undermine security by customizing the firmware by malicious software updates, but also to attack the web portal of the aircraft. The portals were exposed to frequent attacks such as XSS (cross-site scripting), CSRF (cross-site request forgery), SQL injection and RCE (remote code / command execution).

In total, were investigated in 1925 firmware images from 54 different manufacturers. More than 9200 vulnerabilities were found in 185 firmware images. Although only 8 percent of the firmware php code contained in the management of the portal, was found in 143 firmware images whopping 5000

XSS Vulnerabilities.

The study seems to confirm what even last week at Black Hat Europe emerged. A survey conducted by Information Week and Dark Reading which showed that IT professionals believe that in two years the security of IoT will be a top priority. Now the priority is still mainly in the security of applications and end users.

Helpful Malware Infected And Secure Routers

Researchers have developed a kind of "helpful" discovered malware that infects Internet routers and IoT devices, and then secure the devices and to remove any existing malware. The malware by security firm Symantec Wifatch called and last year was already discovered by another researcher, who gave the name ifwatch gave.

The malware spreads probably via Telnet and uses weak passwords. Once active, the routers and other devices part of a peer-to-peer network to exchange threat information. Furthermore Wifatch disable the Telnet daemon, so that other attackers can not gain access. The malware also leave a message for the owner behind to change the password, disable Telnet and update the firmware. Wifatch also has a module to remove malware infections on the unit.

Despite the actions that Symantec designates Wifatch executes the program so as malware, partly because it contains a number of general backdoors that the creator can access. The backdoors do require a digital signature, so others can not use.Symantec may be tens of thousands of devices with malware infected, most of them in China and Brazil. Owners of an infected router to remove Wifatch can easily do this by resetting the device.

Windows Version For The Internet Of Things Will Bitlocker

A special version of Windows for the Internet of Things (IoT) is intended will have several security measures that are also present in the normal versions. Windows 10 IoT Core is a Windows version without the familiar "Windows shell experience." Developers can develop an app for the operating system immediately to the interface of the device.

Windows 10 IoT Core works currently only on the Raspberry Pi and the second MinnowBoard Max, two mini-computers.The operating system is still in development and Microsoft will soon roll out a new test version. This version will also add multiple security to the system, namely Secure Boot and Bitlocker. Microsoft's Bitlocker encryption software that allows both the complete system and individual files can be encrypted.

Secure Boot is a security standard developed by the computer industry. Once the computer is booted, the firmware verifies the digital signature of each element of the boot software, including firmware, drivers and operating system. If all the signatures are correct will restart the computer and displays the firmware control to the operating system. The test version of Windows 10 IoT Core is via the Windows Insider Program download.