TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

IoT Vulnerability Assessment of the Irish IP Address Space

2020-11-17 · Read original ↗

ATT&CK techniques detected

14 predictions
T1046Network Service Discovery
97%
"ip address dataset was retrieved from ip2location. 3 ip2location uses network routing information to perform geolocation and claims to have over 99. 5 % accuracy for country level detection. 4 the scans conducted in june and july used a dataset containing 13, 633, 850 and 13, 686…"
T1190Exploit Public-Facing Application
94%
"popular services an assessment of the most popular service listening on each port was conducted. this produced the results in table 5. service versions ending with ‘ d ’ indicate that it is a daemon i. e. a unix terms referring to “ a process that runs in the background and perfo…"
T1190Exploit Public-Facing Application
92%
"services. 29 versions 3. 5. 0 - 4. 6. 4, 4. 5. 10 and 4. 4. 14 are vulnerable to rce attacks whereby an attacker can “ upload a shared library to a writable share, and then cause the server to load and execute it, ” 30 that is, cve - 2017 - 7494 ( eternal red ). the services of p…"
T1210Exploitation of Remote Services
92%
"an attacker can execute arbitrary code remotely with root privileges. 26 this vulnerability has been exploited multiple times, most recently in 2018. a botnet dubbed bcmpupnp _ hunter exploited up to 100, 000 routers that had tcp port 5431 upnp exposed and broadcom upnp enabled. …"
T1046Network Service Discovery
90%
"fingerprints on exposed machines were identified with high confidence. this is due to the large number of uncertain matches caused by only scanning 3 ports per host, which was necessary due to time constraints. table 4. most exposed operating systems on frequently attacked ports …"
T1021.001Remote Desktop Protocol
89%
"primarily used for secure web browser communication. 7 hence, these ports are often open as they are associated with “ the internet. ” 8 fifty percent of ports in the top ten are related to http and https as port 8080 and 8081 are alternative http ports and port 8443 is an altern…"
T1190Exploit Public-Facing Application
81%
"##81 http _ alt, 25 smtp, and applications that listen on port 8000. - 12. 76 % of exposed ports are vulnerable to being attacked by malware or ransomware. - malware poses a much larger threat than ransomware, with 10. 71 % of hosts exposing ports that are commonly attacked by mi…"
T1595.002Vulnerability Scanning
73%
"fingerprints on exposed machines were identified with high confidence. this is due to the large number of uncertain matches caused by only scanning 3 ports per host, which was necessary due to time constraints. table 4. most exposed operating systems on frequently attacked ports …"
T1584.005Botnet
68%
", gafgyt, nyadrop, hajime, and kaiji. figure 1 gives a breakdown of the threat posed by each malware family. malware threats hosts are most vulnerable to mirai, with 232, 672 exposing ports attacked by the malware, more than any other family. mirai and its variants have remained …"
T1190Exploit Public-Facing Application
54%
"are two cves associated with this version ; cve - 2018 - 15919 and cve - 2017 - 15906. 24 iot vulnerabilities associated with telnet linux telnetd is listening on 40. 08 % hosts with port 23 telnet exposed. these are susceptible to four cves [ 109 ] ; cve - 1999 - 0740, cve - 200…"
T1563.002RDP Hijacking
52%
"primarily used for secure web browser communication. 7 hence, these ports are often open as they are associated with “ the internet. ” 8 fifty percent of ports in the top ten are related to http and https as port 8080 and 8081 are alternative http ports and port 8443 is an altern…"
T1190Exploit Public-Facing Application
49%
"2019 - 0708 ) and four dejablue ( cve - 2019 - 1181, cve - 20191182, cve - 2019 - 1222, cve - 2019 - 1226 ). after connecting to a target using rdp, an attacker can send specially crafted requests to a victim in order to perform an rce ( remote code execution ) attack. 13 accordi…"
T1046Network Service Discovery
45%
"22 ssh. what are the top ten exposed iot ports? opened / exposed ports are problematic as the services listening on the ports are often vulnerable to exploit. the more ports that are open, the larger the attack surface for an attacker to exploit. in total, 2, 171, 934 iot ports w…"
T1190Exploit Public-Facing Application
32%
", as seen in table 2. table 2. port exposure by iot device what critical industrial control iot devices are vulnerable to known attacks? vulnerabilities in iot systems on industrial control systems ( ics ) and supervisory control and data acquisition ( scada ) devices have the po…"

Summary

Vulnerability assessment of IoT devices in Ireland detailing the biggest threats, most at-risk and highly exposed devices.