Mandiant Discloses Critical Vulnerability Affecting Millions of IoT Devices

This article has been indexed from Threat Research Blog

Today, Mandiant disclosed a critical risk vulnerability in
coordination with the Cybersecurity and Infrastructure Security Agency
(“CISA”) that affects millions of IoT devices that use the ThroughTek “Kalay”
network. This vulnerability, discovered by researchers on Mandiant’s
Red Team in late 2020, would enable adversaries to remotely compromise
victim IoT devices, resulting in the ability to listen to live audio,
watch real time video data, and compromise device credentials for
further attacks based on exposed device functionality. These further
attacks could include actions that would allow an adversary to
remotely control affected devices.

At the time of writing this blog post, ThroughTek advertises having
more than 83 million active devices and over 1.1 billion monthly
connections on their platform. ThroughTek’s clients include IoT camera
manufacturers, smart
baby monitors, and Digital Video Recorder (“DVR”) products.
Unlike the vulnerability published by researchers from Nozomi
Networks in May 2021 (also in coordination with CISA), this latest
vulnerability allows attackers to communicate with devices remotely.
As a result, further attacks could include actions that would allow an
adversary to remotely control affected devices and could potentially
lead to remote code execution.

The Kalay protocol is implemented as a Software Development Kit
(“SDK”) which is built into client software (e.g. a mobile or desktop
application) and networked IoT devices, such as smart cameras. Due to
how the Kalay protocol is integrated by original equipment
manufacturers (“OEMs”) and resellers before devices reach consumers,
Mandiant is unable to determine a complete list of products and
companies affected by the discovered vulnerability.

This vulnerability has been assigned a CVSS3.1 base score of 9.6 and
is tracked as CVE-2021-28372
and Mandiant Discloses Critical Vulnerability Affecting Millions of IoT Devices