Belkin has rolled out an update that patches the five vulnerabilities listed by FEMA’s Computer Emergency Readiness Team for their WeMo line. This security hole affects up to 500,000 WeMo devices, and as CERT states, the vulnerability could result in anything from a fire to the waste of electricity.
These holes were recently discovered and announced by IOActive, Inc. The security company made several attempts to contact Belkin about the issues, but Belkin was unresponsive. So IOActive turned to CERT who also issued a statement. However, per a report by TechCrunch, Belkin was in fact in contact with the security research firm prior to their public statement.
Specifically, Mike Davis, IOActive’s principal research scientist, identified that through several different means, hackers could remotely access Internet-connected WeMo products, upload custom firmware, remotely monitor devices and access local networks.The update Belkin recently issued patches these holes.
This speaks to a larger issue. As the Internet of things takes off, hackers and malicious coders have an increasing number of targets. It’s not inconsivable that in the near future, KitchenAid will have to issue a security patch for a toaster or blender.
As of February 18, Belkin had already issued fixes for each of the noted potential vulnerabilities via in-app notifications and updates. Users with the most recent firmware release (version 3949) are not at risk for malicious firmware attacks or remote control or monitoring of WeMo devices from unauthorized devices. Belkin urges such users to download the latest app from the App Store (version 1.4.1) or Google Play Store (version 1.2.1) and then upgrade the firmware version through the app.
Specific fixes Belkin has issued include:
1) An update to the WeMo API server on November 5, 2013 that prevents an XML injection attack from gaining access to other WeMo devices.
2) An update to the WeMo firmware, published on January 24, 2014, that adds SSL encryption and validation to the WeMo firmware distribution feed, eliminates storage of the signing key on the device, and password protects the serial port interface to prevent a malicious firmware attack
3) An update to the WeMo app for both iOS (published on January 24, 2014) and Android (published on February 10, 2014) that contains the most recent firmware update
