The IoT supply chain risk: Why everyone should pay attention to Ripple20 vulnerabilities
By Michael DeCesare, chief executive officer and president, Forescout. We see IoT and connected devices all around us – there are billions of them, and they are hard to miss. I speak all the time about the cybersecurity challenges these devices pose, and advocate for organisations to protect themselves. But sometimes the threat lies under the surface. The reality is that when you buy an IoT device, you are buying a lot of embedded components and you do not really know where those components come from. For a variety of reasons, most IoT devices do not run standard Windows operating systems. Instead, they use organically developed and various third-party sourced code libraries for essential functions such as network communication. These code libraries pose just as much of a risk as the devices themselves, if not more so because a user or company likely has no idea what lies under the hood. Forescout Research Labs has been working closely on the disclosure of vulnerabilities of this type that could potentially impact tens of millions of IoT and OT devices. Working closely in partnership with JSOF, who first discovered the Ripple20 vulnerabilities, our researchers have leveraged the 12 million devices in our Device Cloud data lake to together identify nearly 100 vendors that are potentially affected. The Ripple20 vulnerabilities are in a software library and TCP/IP networking stack made by Treck. You probably haven’t heard of Treck, but the company has been around for 20+ years and its TCP/IP stack is used in many common devices, including industrial control systems, medical devices, VoIP phones, printers, etc. In total, JSOF estimates these vulnerabilities could affect tens of millions of IoT and OT devices. Given the widespread nature of the findings, JSOF has been working closely with the Cybersecurity and Infrastructure Security Agency (CISA), Department of Homeland Security (DHS), national CERTS (Computer Emergency Response Teams), as well as Treck to ensure a proper disclosure […]