Shifts in device usage have large security implications
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-3161 | Unauthenticated RCE/DoS in Cisco IP Phone Web Server CVE-2020-3161 is a critical (CVSS 9.8) input-validation flaw (CWE-20) in the web server of multiple Cisco IP Phone 7800 and 8800 series models, including the 7811, 7821, 7841, 7861, 8811, 8841, 8845, 8851, 8861, 8865, 8821 and 8821-EX. An unauthenticated remote attacker can trigger it simply by sending a crafted HTTP request to the web server of a targeted phone, with no credentials or user interaction required. A successful exploit allows the attacker to execute code with root privileges on the device or force a reload, causing a denial-of-service condition. Any organization running the listed Cisco IP phone models where the phone's web server is reachable over the network is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, carries a very high EPSS score of 83.9% (100th percentile), and a public denial-of-service proof of concept targeting the 11.7 firmware is available. Do: Apply updated firmware for all listed 7800/8800 series models per Cisco's instructions, as required by the CISA KEV catalog. Until phones are patched, restrict or disable the phone web server and limit HTTP access to trusted management networks, and inventory your environment for these models to confirm none are exposed to untrusted users. | 9.8 | 84% | KEV PoC |
| mass≈1,000,000+ deployed handsets across the affected 7800/8800 series models |
Full article477 words · extracted from helpnetsecurity.com · click to collapse
There have been rapid substantial changes in device usage trends, and the connected security implications, as businesses shifted their operations in March due to COVID-19, according to a report by ExtraHop.
The report also warns of the security complexity and risks posed by connected devices—both those used by employees at home, and those left idle but connected to the office network.
While there are many lenses through which to explore the ways in which COVID-19 is reshaping business operations, connected devices—including IoT devices—and the ways in which people and organizations interact with them tell a story all their own.
Steep decline in connected devices
There has been 65 percent decline in the number of laptops and a nearly 70 percent decline in the number of smartphones connecting directly to corporate networks in March 2020. That said, the fact that these devices are no longer connected to the corporate network doesn’t mean they’re not connected at all.
Employees are still accessing corporate resources, often relying on questionably secure local networks that lack the safeguards of the office network and thus are more exposed to malware.
Office phones and printers still plugged in, exposing risk
The number of connected IP phones declined by just 7.5 percent, indicating that many of these devices remain on and connected even when no one is using them.
Nearly 25 percent of those VoIP devices are Cisco IP phones, for which a critical vulnerability (CVE-2020-3161) was announced in April. Printers – at high risk for vulnerabilities and one of the most common targets of hackers – showed even smaller declines in connectivity, dropping by just 0.53 percent.
Spike in physical security cameras
Connections from security cameras increased by 47 percent in March, indicating that many organizations are taking additional precautions against physical intrusion or nefarious activity.
Unfortunately, these devices can also expose organizations to cyber risk. Like IP phones and printers, they often have vulnerabilities and have been observed phoning data home.
And don’t forget the treadmills
The connections to the network from treadmills declined 100% when office gyms were some of the first aspects of office life to close down. But the connectivity of treadmills underscores the extent to which every device is now a connected device. IT and security departments now have a much broader attack surface to secure — even the office gym.
“The almost overnight shift to remote work required a massive effort just to ensure the availability of applications and critical resources for employees outside the office,” said Sri Sundaralingam, VP, Cloud and Security Solutions at ExtraHop.
“For many organizations, the management of IoT and other connected devices may have been an afterthought, or at least something they didn’t anticipate having to handle long term. As availability and security issues surrounding remote access become more settled, this needs to be an area of focus.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2020/05/07/device-usage-security-implications/