{"id":40430,"date":"2021-04-13T15:25:51","date_gmt":"2021-04-13T15:25:51","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/32191\/Millions-Of-Devices-Are-At-Risk-From-The-NAME-WRECK-DNS-Bugs.html"},"modified":"2021-04-13T15:25:51","modified_gmt":"2021-04-13T15:25:51","slug":"millions-of-devices-are-at-risk-from-the-namewreck-dns-bugs","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/millions-of-devices-are-at-risk-from-the-namewreck-dns-bugs\/","title":{"rendered":"Millions Of Devices Are At Risk From The NAME:WRECK DNS Bugs"},"content":{"rendered":"
<\/div>\n

More than 100 million connected internet of things<\/a> (IoT) devices, as many as 36,000 of them physically located in the UK, are thought to be at risk from nine newly disclosed DNS vulnerabilities, discovered by Forescout Research Labs<\/a> and JSOF<\/a>, and collectively dubbed NAME:WRECK.<\/p>\n

The NAME:WRECK bugs affect four well-used TCP\/IP stacks<\/a>, FreeBSD, IPnet, Nucleus NET and NetX, which are present in well-known IT software and IoT\/OT firmware.<\/p>\n

FreeBSD, for example, runs on high-performance servers on millions of networks and is used on other well-known open source projects such as firewalls and some commercial network appliances. Nucleus NET has over three billion known installations in medical devices, avionics systems and building automation. NetX, meanwhile, runs in medical devices, systems-on-a-chip and several types of printer, as well as energy and power equipment in industrial control systems (ICS).<\/p>\n

As a result of this, the vulnerabilities impact organisations in multiple sectors, from government to healthcare, manufacturing and retail, and if successfully exploited by malicious actors in a denial of service<\/a> (DoS) or remote code execution<\/a> (RCE) attack, could be used to disrupt or take control of victim networks.<\/p>\n

\u201cNAME:WRECK is a significant and widespread set of vulnerabilities with the potential for large-scale disruption,\u201d said Daniel dos Santos, research manager at Forescout Research Labs. \u201cComplete protection against NAME:WRECK requires patching devices running the vulnerable versions of the IP stacks and so we encourage all organisations to make sure they have the most up-to-date patches for any devices running across these affected IP stacks.<\/p>\n

\u201cUnless urgent action is taken to adequately protect networks and the devices connected to them, it could be just a matter of time until these vulnerabilities are exploited, potentially resulting in major government data hacks, manufacturer disruption or hotel guest safety and security.\u201d<\/p>\n

Although FreeBSD, Nucleus NET and NetX have all been patched recently, as with many other vulnerabilities affecting deployed IoT devices, NAME:WRECK will inevitably be hard to patch in some instances because nowadays, IoT technology is often deeply embedded in organisational systems, can be hard to manage, and often essentially impossible to patch.<\/p>\n

In the light of this, Forescout and JSOF are recommending a series of mitigations:<\/p>\n