Risks in IoT Supply Chain
Unit 42 analyzes multilayer IoT supply chain risks across hardware, firmware, and software, citing counterfeit Cisco switches and OpenWrt attacks.
Unit 42 examines weaknesses in the IoT supply chain ecosystem across hardware, firmware, operation, and vulnerability layers, noting that 89% of IT decision-makers reported IoT device growth and IDC forecast 41.6 billion connected IoT devices by 2025. Examples include counterfeit Cisco Catalyst 2960-X switches with possible backdoor access (F-Secure, July 2020), a March 2020 OpenWrt flaw enabling malicious update impersonation, and threat actor interest in TeamViewer remote support software. The report stresses that untracked third-party components and missing device inventories make it hard to assess vulnerability impact across vendors.
- 89% of IT decision-makers reported IoT device growth; IDC forecast 41.6 billion connected devices by 2025.
- Counterfeit Cisco Catalyst 2960-X switches ran undetected and potentially provided backdoor access.
- A 2020 OpenWrt vulnerability let attackers impersonate downloads.openwrt.org and push malicious updates.
- Unlisted third-party components and absent IoT inventories hinder vulnerability impact assessment.
- Supply chain attacks can involve hardware implants, compromised software, or vulnerable bundled components.
- ATT&CK
- T1195 Supply Chain CompromiseT1195.001 Compromise Hardware Supply ChainT1195.002 Compromise Software Supply Chain
- Vendors
- CiscoTeamViewer
- Products
- OpenWrtCatalyst 2960-X
From the original article
9 min read at unit42.paloaltonetworks.com
The COVID-19 pandemic has accelerated the adoption of IoT devices. As businesses slowly reopen during the pandemic, contactless IoT devices such as point of sale (POS) terminals and body temperature cameras have been widely adopted to keep business operations safe.
By Asher Davila, Anna Chung · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.