{"id":35708,"date":"2020-06-24T21:43:00","date_gmt":"2020-06-24T21:43:00","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/ripple20-tcp-ip-flaws-can-be-patched-but-still-threaten-iot-devices\/"},"modified":"2020-06-24T21:43:00","modified_gmt":"2020-06-24T21:43:00","slug":"ripple20-tcp-ip-flaws-can-be-patched-but-still-threaten-iot-devices","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ripple20-tcp-ip-flaws-can-be-patched-but-still-threaten-iot-devices\/","title":{"rendered":"Ripple20 TCP\/IP flaws can be patched but still threaten IoT devices"},"content":{"rendered":"
<\/div>\n

A set of serious network security vulnerabilities collectively known as Ripple20 roiled the IoT landscape when they came to light last week, and the problems they pose for IoT-equipped businesses could be both dangerous and difficult to solve.<\/p>\n

Ripple20 was originally discovered by Israel-based security company JSOF in September 2019. It affects a lightweight, proprietary TCP\/IP library created by a small company in Ohio called Treck, which has issued a patch for the vulnerabilities. Several of those vulnerabilities would allow for remote-code execution, allowing for data theft, malicious takeovers and more, said the security vendor.<\/p>\n

That, however, isn\u2019t the end of the problem. The TCP\/IP library that contains the vulnerabilities has been used in a huge range of connected devices, from medical devices to industrial control systems to printers, and actually delivering and applying the patch is a vast undertaking. JSOF said that \u201chundreds of millions\u201d of devices could be affected. Many devices don\u2019t have the capacity to receive remote patches, and Terry Dunlap, co-founder of security vendor ReFirm Labs, said that there are numerous hurdles to getting patches onto older equipment in particular.<\/p>\n

\u201cHow many of these devices are sitting in some closet covered with five years of dust that hasn\u2019t been touched by human hands?\u201d he said. \u201cWhen you\u2019re dealing with threats to the TCP\/IP stack, you\u2019re talking about the fundamental networking core of these devices.\u201d<\/p>\n

Even discovering whether or not a company\u2019s networks are affected by the flaws can be a challenge, according to Brian Kime, a senior analyst at Forrester Research.<\/p>\n

\u201cNetwork vulnerability scanners have challenges in detecting flaws in those libraries,\u201d he said. \u201c[The flaws aren\u2019t] really advertised, sitting there, waiting for a connection to be made from outside.\u201d<\/p>\n