Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

IoT Security

Half a Billion Enterprise Devices Exposed by DNS Rebinding

Nearly half a billion devices used by enterprises are exposed to cyberattacks by DNS rebinding, according to a study conducted by IoT security firm Armis.

Nearly half a billion devices used by enterprises are exposed to cyberattacks by DNS rebinding, according to a study conducted by IoT security firm Armis.

DNS rebinding, an attack method that has been known for more than a decade, allows a remote hacker to bypass the targeted entity’s network firewall and abuse their web browser to directly communicate with devices on the local network and exploit any vulnerabilities they may have. Getting the target to access a malicious page or view a malicious advertisement is often enough to conduct an attack that can lead to theft of sensitive information and taking control of vulnerable devices.

Google Project Zero researcher Tavis Ormandy revealed a few months ago that DNS rebinding could be used to exploit critical flaws in BitTorrent’s uTorrent application and the Transmission BitTorrent client.

More recently, researcher Brannon Dorsey showed how malicious actors could exploit vulnerabilities in Google Home and Chromecast devices, Roku TVs, Sonos Wi-Fi speakers, routers, and smart thermostats via DNS rebinding.

Armis, the firm that discovered the Bluetooth flaws dubbed BlueBorne, conducted its own research on the impact of DNS rebinding on enterprises.

The company estimates that there are 496 million enterprise devices worldwide that are exposed due to DNS rebinding. This includes 165 million printers, 160 million IP cameras, 124 million IP phones, 28 million smart TVs, 14 million switches and routers, and 5 million media players.

Number of devices vulnerable to DNS rebinding attacks

“Because of the widespread use of the types of devices listed above within enterprises, Armis can say that nearly all enterprises are susceptible to DNS rebinding attacks,” Armis said.

As an example of vulnerabilities that can be exploited as a result of DNS rebinding, the company highlighted the flaws patched this month by Cisco in its IP phones. Armis also pointed to the critical security holes discovered recently in Axis and Foscam cameras.

Advertisement. Scroll to continue reading.

As for printers, researchers noted, “Unfortunately, printers are one of the least managed, most poorly configured devices in the enterprise. Aside from adjusting basic network configurations, enterprises typically deploy printers with default settings, making them an ideal target for a DNS rebinding attack.”

In an attack scenario described by Armis, the attacker simply needs to trick the targeted user into visiting a specially crafted website which hosts JavaScript code that will be executed in the victim’s browser. The JavaScript code instructs the browser to scan local IP addresses in search of vulnerable devices.

Once vulnerable systems are identified, the attacker can use DNS rebinding to send arbitrary commands (e.g. log into the web server) directly to the IP address of the compromised IoT device. The attacker can also establish an outbound connection to the C&C server and chances are that none of these communications will be detected or blocked by security products.

Since DNS rebinding is possible due to how DNS and web browsers work, Armis believes the best way for enterprises to protect their networks against attacks is to monitor all devices for signs of a breach, perform a risk analysis of IoT devices to determine which systems are vulnerable, and ensure that the devices are secure, including by applying software patches and disabling unnecessary services.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...