Story image

Opinion: Router security leaving major cyber exposure gap

02 Nov 2018

Article by Tenable A/NZ country manager Bede Hackney

The security of networked devices is often an afterthought as organisations and consumers embrace IoT devices.

A testament to the importance of securing some of these less obvious, but highly risky, attack surfaces has been demonstrated over the past year with hackers exploiting a security flaw in 200,000 MikroTik routers, allowing them to mine cryptocurrency, as well as the VPNFilter malware campaign that targeted MikroTik routers, allowing cybercriminals to run code remotely.

Tenable Research recently revealed that it discovered several vulnerabilities in RouterOS, a proprietary operating system (OS) used in MikroTik routers, that holds the potential to expose hundreds of thousands of devices.

At the most critical level of these vulnerabilities, attackers can potentially gain full system access allowing them to modify and eavesdrop on network traffic.

This is particularly concerning when looking beyond the individual attacks to the broader impact.

Exploiting this router vulnerability could give attackers the power to access a victim’s entire internal network.

When users step up and secure their personal networks, they’re more likely to pay attention to the security of laptops and mobile devices, those considered to directly hold personal and valuable data, than looking to routers.

Hardware is frequently tossed to one side upon installation and left to fester without security updates, leaving them exposed to outside threats and easy to manipulate.

The reality of modern computing is that every single piece of technology — from software to hardware — can broaden the cyber exposure gap.

Routers are easily exploited by hackers because they’re often left insecure by a lack of basic cyber hygiene.

Unfortunately, home and corporate routers alike are rarely patched, meaning the door is left wide open for cybercriminals.

On an individual level, the consequences could be tragic, such as lost or exposed personal data.

When it comes to the corporate world, the consequences could be business-critical, such as compromised customer data.

CISOs and business leaders need visibility into their entire attack surface - including overlooked devices like routers and IoT devices.

Attacks targeting Cisco Webex extension explode in popularity - WatchGuard
WatchGuard's Internet Security Report for Q4 2018 also finds growing use of a new sextortion phishing malware customised to individual victims.
SAS partners with NVIDIA on deep learning and computer vision
“By partnering with NVIDIA, we combine our strengths to augment human intelligence and realise the true potential of AI.” 
Why businesses must embrace automation to ensure success
“For many younger workers, the traditional view of a steady job at one company, perhaps for life, simply doesn’t reflect reality."
TYAN unveils new inference-optimised GPU platforms with NVIDIA T4 accelerators
“TYAN servers with NVIDIA T4 GPUs are designed to excel at all accelerated workloads, including machine learning, deep learning, and virtual desktops.”
Worldwide spending on security to reach $103.1bil in 2019 - IDC
Managed security services will be the largest technology category in 2019.
Microsoft appoints new commercial and partner business director
Bowden already has almost a decade of Microsoft relationship management experience under her belt, having joined the business in 2010.
How Cognata and NVIDIA enable autonomous vehicle simulation
“Cognata and NVIDIA are creating a robust solution that will efficiently and safely accelerate autonomous vehicles’ market entry."
Kinetica launches a new active analytics platform
"With the platform now powered by NVIDIA DGX-2, customers can build smart analytical applications that combine historical data analytics and ML-powered analytics."