Tag Archive for: plugs

Critical security flaw exposes Wemo Smart Plugs to hackers


Wemo Smart Plugs have a flaw


Researchers found a security flaw in an older version of the Wemo Mini Smart Plug that involved changing its name — and Belkin isn’t going to fix it.

The Wemo Mini Smart Plug is designed to offer convenient remote control over lights and basic appliances, such as fan lamps, through a mobile app. The application utilizes Wi-Fi for communication and seamlessly integrates with HomeKit and other smart home ecosystems.

Among other functions, the app lets people change the device name. The length is limited to 30 characters or less, but only the app enforces that rule.

However, through reverse engineering, the security experts at Sternum discovered a method to circumvent the character limit, thereby triggering a buffer overflow. They subsequently named this vulnerability “FriendlyName.”

A buffer overflow happens when there’s too much information put into a storage area (buffer) that it can’t handle. It’s like pouring more water into a cup than it can hold, causing it to overflow.

That can lead to unexpected results in computer systems because the extra information can overwrite or change nearby data. Hackers can use a buffer overflow to gain unauthorized access or cause malfunctions in a computer program.

Accessing the firmware

Accessing the firmware

The researchers from Sternum examined the smart plug’s firmware and used it to change the device’s name to one that was longer than the app’s rule of 30 characters. The resulting overflow allowed them to issue commands to the device and control it.

In the hands of a malicious hacker, that could lead to data theft or possibly controlling other devices plugged into the Wemo device.

The team contacted Belkin to inform the company of the security flaw. However, Belkin said it wouldn’t fix the vulnerability because the Wemo Smart Plug V2 is at the end of its life.

The current Wemo Smart Plug is version 4.

How to protect yourself from “Friendlyname”

Sternum says people who own one of these plugs shouldn’t connect them to the internet. They also shouldn’t be allowed to connect to sensitive devices on a…

Source…

Microsoft plugs 4 zero-day exploits for June Patch Tuesday – TechTarget

  1. Microsoft plugs 4 zero-day exploits for June Patch Tuesday  TechTarget
  2. Warning: Google Researcher Drops Windows 10 Zero-Day Security Bomb  Forbes
  3. Google Rings Alarm On Windows 10 Zero-Day Exploit After Microsoft Misses Patch Deadline  Hot Hardware
  4. Microsoft’s battle with SandboxEscaper zero days turns into grim Groundhog Day  Naked Security
  5. Microsoft’s June 2019 Patch Tuesday fixes many of SandboxEscaper’s zero-days  ZDNet
  6. View full coverage on read more

“zero day exploit” – read more

These two iClever Smart Plugs let you control devices with your phone for just $9 each – iMore

These two iClever Smart Plugs let you control devices with your phone for just $ 9 each  iMore

Amazon is offering this two-pack of iClever Smart Plugs for just $ 17.99 when you enter promo code SMART1799 during checkout. While the code only saves you …

“Don’t Plug Your Phone into a Charger You Don’t Own” – read more

MailChimp plugs a hole that could have leaked your email address

MailChimp plugs a hole that could have leaked your email address

MailChimp has been leaking subscribers’ email addresses. But it’s not the biggest leak ever, and certainly not the most practical to exploit at a large scale.

Graham Cluley