Dark Side of Your Living Room

Popular connected home entertainment devices pose a real cyber security threat due to vulnerabilities in their software, and lack of elementary security measures such as strong default administrator passwords and encryption of Internet connections

– Compiled by Preeti Gaur

Experts from Kaspersky Lab have examined two NAS models from different vendors, one Smart TV, a satellite receiver, and a connected printer. Surprisingly, they discovered 14 vulnerabilities in the network attached storages, one vulnerability in the Smart TV and several potentially hidden remote control functions in the router.

Here’s what they found:

Remote code execution and weak passwords: The most severe vulnerabilities were found in the network-attached storages. Several of them would allow an attacker to remotely execute system commands with the highest administrative privileges. The tested devices also had weak default passwords, lots of configuration files had the wrong permissions and they also contained passwords in plain text. A device even shared the entire configuration file with encrypted passwords to everyone on the network.

Man-in-the-Middle via Smart TV: No encryption is used in communication between the TV and the TV vendor’s servers. That potentially opens the way for Man-in-the-Middle attacks that could result in the user transferring money to fraudsters while trying to buy content via the TV. Normally the widgets and thumbnails are downloaded from the TV vendor’s servers and due to lack of encrypted connection, the information could be modified by a third party. The Smart TV is able to execute Java code, which, in combination with the ability to intercept the exchange of traffic between the TV and Internet, could result in exploit-driven malicious attacks.

Hidden spying functions of a router: The DSL router used to provide wireless Internet access for all other home devices contained several dangerous features hidden from its owner. Some of these hidden functions could potentially provide the ISP (Internet Service Provider) remote access to any device in a private network. What’s more important is that, sections of the router web interface called Web Cameras, Telephony Expert Configure, Access Control, ‘WAN-Sensing’ and Update are invisible and not adjustable for the owner of the device. They could only be accessed via exploitation of a rather generic vulnerability making it possible to travel between sections of the interface (that are basically web pages, each with its own alphanumeric address) by brute forcing the numbers at the end of the address.

The remote access function makes it fast and easy for the ISP to solve possible technical problems on the device, but the convenience could turn into a risk if the controls fell into the wrong hands.

Individuals and also companies need to understand the security risks attached with connected devices. We also need to keep in mind that our information is not secure just because we have a strong password, and that there are a lot of things that we cannot control.

Source: Kaspersky Lab