Skip to main content

Devils Ivy

Devils Ivy is a buffer overflow vulnerability which could open millions of Internet of Things (IoT) devices to a Remote Code Execution (RCE) attack.
Threat ID:
CC-1542
Category:
Exploit
Threat Severity:
Low
Threat Vector:
Published:
27 July 2017 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Devils Ivy is a buffer overflow vulnerability which could open millions of Internet of Things (IoT) devices to a Remote Code Execution (RCE) attack.

Threat details

This could allow the attacker to instigate a factory reset and become the devices administrator. As an administrator, an attacker can install malware onto the device which can be used to join the device to a botnet or to intercept the video feed. Affected devices can range from surveillance cameras to networking equipment.

A full technical breakdown is publically available, making it easy for an attacker to exploit the vulnerability. Many IoT device vendors are slow to patch vulnerabilities, therefore many devices could be left open to exploit for a long period of time. IoT devices often lack automatic update capabilities, meaning patches will have to be manually applied to the device to ensure it is secure.

Compromise of a security camera is a risk to any organisation and it's advised any internet facing security cameras are patched as soon as possible. It also advised that other IoT devices are patched as they could also be susceptible to the Devils Ivy vulnerability.

Remediation advice

Ensure:

Remediation steps

Type Step
  • All available patches are applied to all deployed devices.
  • Devices are located behind protections such as a firewall to ensure attacks can't be launched remotely.
  • Network monitoring solutions are able to baseline normal network operations and alert where abnormalities such as that which would have been generated as part of this attack are seen.

Last edited: 17 February 2020 11:29 am