{"id":21534,"date":"2014-02-19T11:54:38","date_gmt":"2014-02-19T11:54:38","guid":{"rendered":"https:\/\/automatedhome.com\/?p=21534"},"modified":"2017-03-02T18:05:06","modified_gmt":"2017-03-02T18:05:06","slug":"ioactive-reports-multiple-vulnerabilities-in-belkin-wemo-home-automation-modules","status":"publish","type":"post","link":"https:\/\/automatedhome.com\/security\/ioactive-reports-multiple-vulnerabilities-in-belkin-wemo-home-automation-modules.html","title":{"rendered":"IOActive Reports Multiple Vulnerabilities in Belkin WeMo Home Automation Modules [Updated]"},"content":{"rendered":"<p>IOActive are reporting\u00a0multiple vulnerabilities in\u00a0Belkin&#8217;s WeMo range of Home Automation devices. \u00a0So far Belkin have been silent on the matter but\u00a0CERT has now publishing its own\u00a0<a href=\"http:\/\/www.kb.cert.org\/vuls\/\" target=\"_blank\">advisory<\/a>\u00a0listing the security flaws.<\/p>\n<p>Is this an over-reaction to a one in a million chance of someone being able to hack your lights? \u00a0Or is it just the thin end of the wedge and time for Home Automation and Internet of Things companies to sit up and get real about security? \u00a0Check out the video of last nights TWiT Security Now podcast for both sides of the argument then let us know what you think in the comments below&#8230;<\/p>\n<blockquote><p><strong>Seattle, USA \u2014 February 18, 2014<\/strong>\u00a0\u2013\u00a0<a href=\"http:\/\/www.ioactive.com\/\" target=\"_blank\">IOActive, Inc.<\/a>, the leading global provider of specialist information security services, announced today that it has uncovered multiple vulnerabilities in\u00a0Belkin\u00a0WeMo Home Automation devices that could affect over half a million\u00a0users.\u00a0Belkin\u2019s WeMo uses Wi-Fi and the mobile Internet to control home electronics anywhere in the world directly from the users\u2019 smartphone.<\/p>\n<p>Mike Davis, IOActive&#8217;s principal research scientist, uncovered multiple vulnerabilities in the WeMo product set that gives attackers the ability to:<\/p>\n<ul>\n<li>Remotely control WeMo Home Automation attached devices over the Internet<\/li>\n<li>Perform malicious firmware updates<\/li>\n<li>Remotely monitor the devices (in some cases)<\/li>\n<li>Access an internal home network<\/li>\n<\/ul>\n<p>Davis said, &#8220;As we connect our homes to the Internet, it is increasingly important for Internet-of-Things device vendors to ensure that reasonable security methodologies are adopted early in product development cycles. This mitigates their customer\u2019s exposure and reduces risk. \u00a0Another concern is that the WeMo devices use motion sensors, which can be used by an attacker to remotely monitor occupancy within the home.&#8221;<\/p>\n<p><strong>The Impact<\/strong><\/p>\n<p>The vulnerabilities found within the\u00a0Belkin\u00a0WeMo devices expose users to several potentially costly threats, from home fires\u00a0with possible tragic consequences down to the simple waste of electricity. The reason for this is that, after attackers compromise the WeMo devices, they can be used to remotely turn attached devices on and off at any time. Given the number of WeMo devices in use, it is highly likely that many of the attached appliances and devices will be unattended, thus increasing the threat posed by these vulnerabilities.<\/p>\n<p>Additionally, once an attacker has established a connection to a WeMo device within a victims network; the device can be used as a foothold to attack other devices such as laptops, mobile phones, and attached network file storage.<\/p>\n<p><strong>The Vulnerabilities<\/strong><\/p>\n<p>The\u00a0Belkin\u00a0WeMo firmware images that are used to update the devices are signed with public key encryption to protect against unauthorised modifications. However, the signing key and password are leaked on the firmware that is already installed on the devices. This allows attackers to use the same signing key and password to sign their own malicious firmware and bypass security checks during the firmware update process.<\/p>\n<p>Additionally,\u00a0Belkin\u00a0WeMo devices do not validate Secure Socket Layer (SSL) certificates preventing them from validating communications withBelkin\u2019s cloud service including the firmware update RSS feed. This allows attackers to use any SSL certificate to impersonate\u00a0Belkin\u2019s cloud services and push malicious firmware updates and capture credentials at the same time. Due to the cloud integration, the firmware update is pushed to the victim\u2019s home regardless of which paired device receives the update notification or its physical location.<\/p>\n<p>The Internet communication infrastructure used to communicate\u00a0Belkin\u00a0WeMo devices is based on an abused protocol that was designed for use by Voice over Internet Protocol (VoIP) services to bypass firewall or NAT restrictions. It does this in a way that compromises all WeMo devices security by creating a virtual WeMo darknet where all WeMo devices can be connected to directly; and, with some limited guessing of a \u2018secret number\u2019, controlled even without the firmware update attack.<\/p>\n<p>The\u00a0Belkin\u00a0WeMo server application programming interface (API) was also found to be vulnerable to an XML inclusion vulnerability, which would allow attackers to compromise all WeMo devices.<\/p>\n<p><strong>Advisory<\/strong><\/p>\n<p>IOActive feels very strongly about responsible disclosure and as such worked closely with CERT on the vulnerabilities that were discovered. CERT, which will be publishing its own\u00a0<a href=\"http:\/\/www.kb.cert.org\/vuls\/\" target=\"_blank\">advisory<\/a>\u00a0today, made several attempts to contact\u00a0Belkin\u00a0about the issues, however,\u00a0Belkin\u00a0was unresponsive.<\/p>\n<p>Due to\u00a0Belkin\u00a0not producing any fixes for the issues discussed, IOActive felt it important to release an advisory and recommends unplugging all devices from the affected WeMo products.<\/p><\/blockquote>\n<p><iframe loading=\"lazy\"  id=\"_ytid_64610\"  width=\"480\" height=\"270\"  data-origwidth=\"480\" data-origheight=\"270\" src=\"https:\/\/www.youtube.com\/embed\/Ngw2wId_lLQ?enablejsapi=1&#038;autoplay=0&#038;cc_load_policy=0&#038;cc_lang_pref=&#038;iv_load_policy=1&#038;loop=0&#038;modestbranding=0&#038;rel=1&#038;fs=1&#038;playsinline=0&#038;autohide=2&#038;theme=dark&#038;color=red&#038;controls=1&#038;\" class=\"__youtube_prefs__  epyt-is-override  no-lazyload\" title=\"YouTube player\"  allow=\"fullscreen; accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen data-no-lazy=\"1\" data-skipgform_ajax_framebjll=\"\"><\/iframe><\/p>\n<p>[<strong>Update<\/strong>] Belkin have now advised\u00a0that &#8220;users with the most recent firmware release (version 3949) are not at risk for malicious firmware attacks or remote control or monitoring of WeMo devices from unauthorized devices&#8221;. \u00a0Update your firmware now.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/ottomate?ref_src=twsrc%5Etfw\">@ottomate<\/a> &quot;Users with the most recent firmware release (version 3949) are not at risk..&quot; <a href=\"http:\/\/t.co\/sHGuCALk6c\">http:\/\/t.co\/sHGuCALk6c<\/a><\/p>\n<p>&mdash; Andy Powell (@ScaredyCat) <a href=\"https:\/\/twitter.com\/ScaredyCat\/status\/436108967253905408?ref_src=twsrc%5Etfw\">February 19, 2014<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p><a href=\"http:\/\/www.belkin.com\/\" target=\"_blank\">belkin.com\u00a0<\/a>\u00a0 : \u00a0\u00a0<a href=\"http:\/\/www.amazon.co.uk\/s\/?_encoding=UTF8&amp;camp=1634&amp;creative=19450&amp;field-keywords=belkin%20wemo&amp;linkCode=ur2&amp;rh=i%3Aaps%2Ck%3Abelkin%20wemo&amp;tag=ah4-21&amp;url=search-alias%3Daps\" target=\"_blank\">WeMo Available from Amazon<\/a><\/p>\n<p><strong>Want More?<\/strong>\u00a0\u2013\u00a0<a href=\"http:\/\/twitter.com\/ottomate\">Follow us<\/a>\u00a0on Twitter,\u00a0<a href=\"http:\/\/www.facebook.com\/AutomatedHomeUK\" target=\"_blank\">Like us<\/a>\u00a0on Facebook, or subscribe to our\u00a0<a href=\"http:\/\/feeds2.feedburner.com\/automatedhome\">RSS feed<\/a>. You can even get these news stories\u00a0<a href=\"http:\/\/feedburner.google.com\/fb\/a\/mailverify?uri=AutomatedHome&amp;loc=en_US\">delivered via email<\/a>, straight to your inbox every day.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>IOActive are reporting\u00a0multiple vulnerabilities in\u00a0Belkin&#8217;s WeMo range of Home Automation devices. \u00a0So far Belkin have been silent on the matter but\u00a0CERT has now publishing its&#8230;<\/p>\n","protected":false},"author":3,"featured_media":21538,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"jetpack_post_was_ever_published":false,"apple_news_api_created_at":"2017-03-02T18:05:08Z","apple_news_api_id":"4d78c90a-cca6-46d6-9c05-7fc32468f74b","apple_news_api_modified_at":"2017-03-02T18:05:08Z","apple_news_api_revision":"AAAAAAAAAAD\/\/\/\/\/\/\/\/\/\/w==","apple_news_api_share_url":"https:\/\/apple.news\/ATXjJCsymRtacBX_DJGj3Sw","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":"","apple_news_is_paid":"","apple_news_is_preview":"","apple_news_is_sponsored":"","apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":[],"apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"activitypub_content_warning":"","activitypub_content_visibility":"","footnotes":""},"categories":[27],"tags":[3],"class_list":["post-21534","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-featured"],"apple_news_notices":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/automatedhome.com\/wp-content\/uploads\/2014\/02\/belkin-wemo-security-flaw.jpg?fit=337%2C307&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/automatedhome.com\/wp-json\/wp\/v2\/posts\/21534"}],"collection":[{"href":"https:\/\/automatedhome.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/automatedhome.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/automatedhome.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/automatedhome.com\/wp-json\/wp\/v2\/comments?post=21534"}],"version-history":[{"count":18,"href":"https:\/\/automatedhome.com\/wp-json\/wp\/v2\/posts\/21534\/revisions"}],"predecessor-version":[{"id":35226,"href":"https:\/\/automatedhome.com\/wp-json\/wp\/v2\/posts\/21534\/revisions\/35226"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/automatedhome.com\/wp-json\/wp\/v2\/media\/21538"}],"wp:attachment":[{"href":"https:\/\/automatedhome.com\/wp-json\/wp\/v2\/media?parent=21534"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/automatedhome.com\/wp-json\/wp\/v2\/categories?post=21534"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/automatedhome.com\/wp-json\/wp\/v2\/tags?post=21534"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}