SentinelOne Research Identifies IoT Vulnerabilities Enabling Remote Takeover and Network Intrusion

Barak Sternberg to Present Research Findings at DefCon after Working with Smart Device Provider HDL Automation on Vulnerability Patches

MOUNTAIN VIEW, Calif.–(BUSINESS WIRE)–#DefCon—SentinelOne, the autonomous cybersecurity platform company, today announced that Barak Sternberg, SentinelLabs security researcher, has identified four unique vulnerabilities in HDL Automation smart devices. The vulnerabilities exposed thousands of HDL devices to remote control by adversaries, leading to possible network intrusion, secret exfiltration, and even ransomware attacks. SentinelOne alerted HDL to the issues via the responsible disclosure process, and the vulnerabilities have been patched. Sternberg will present the findings at DefCon on Saturday, August 8 at 9AM PST, and the complete research will be available on the SentinelLabs blog.

IoT devices are ubiquitous in the home and the workplace, connecting lights, air conditioning, and even heat-sensors to home or corporate networks. IoT devices are also potential security weak points that attackers target to exploit internal network configurations, change arbitrary controllers, and cause software or hardware damage. With enterprises adding more and more connected devices to their networks, vulnerabilities like those outlined in SentinelLabs’ research are concerning as every connection to the enterprise network is a potential vulnerability.

“IoT can pose a significant threat to enterprise security because, while anything you connect to your network is a potential point of ingress, not everyone considers that IoT devices contain unintended vendor-created backdoors” said Sternberg. “Many organizations don’t design smart thermostats or refrigerators with security in mind. However, even mundane devices such as this can be open to attackers, making it critical to understand exactly how many devices you have connected to your network and to harden every endpoint.”

SentinelLabs identified two vulnerabilities that enabled account takeover; a flaw in the “forgot your password” function and a takeover of the debug email account. Two additional vulnerabilities relating to endpoint APIs were also identified. Due to these flaws, SentinelLabs researchers were able to compromise remote servers used as proxies for configuring smart devices and worked with HDL Automation on patch solutions. If attackers were simply interested in causing chaos, they could do physical damage by raising the temperature in a server room, disabling security cameras, or disabling sensors designed to detect leaks or voltage surges. The four new-found IoT vulnerabilities highlight the sensitivity and cost of IoT cyberattacks in impacting our digital way of life.

Further details on SentinelOne’s research will be released on the SentinelLabs blog at the time of the DefCon presentation. Sternberg will present his findings at DefCon IoT Village, on Saturday, August 8th at 9 AM PST.

To learn more about how SentinelOne secures IoT devices and protects corporate networks from IoT-related intrusions, visit www.sentinelone.com. The SentinelOne Singularity Platform includes broad IoT capabilities through SentinelOne Ranger, which identifies every connected device on the network and prevents them from being exploited.

About SentinelOne

SentinelOne is the only cybersecurity solution encompassing AI-powered prevention, detection, response and hunting across endpoints, containers, cloud workloads, and IoT devices in a single autonomous platform. With SentinelOne, organizations gain full transparency into everything happening across the network at machine speed – to defeat every attack, at every stage of the threat lifecycle. To learn more visit www.sentinelone.com or follow us at @SentinelOne, on LinkedIn or Facebook.