Ripple20 - Dangerous vulnerability discovered in countless devices

Researchers from the Israeli security company JSOF have discovered 19 security holes in the low-level TCP/IP software library of the company Treck, which can be exploited to either steal or manipulate data with little effort. Complete control over a device is also possible. The vulnerabilities have a CVSSv3 score of up to 10, which corresponds to a remote code execution vulnerability. This means that arbitrary code can be executed on a device remotely, i.e. via the internet, without any activity on the part of the user/operator being required.

Corresponding CVEs are:

The vulnerabilities were fixed in version 6.0.1.67 of the software library, which was released on 3 March 2020. Unfortunately, it is usually not possible for end users to update this software library themselves. A manual update on the part of the manufacturer is required here.

Which devices are affected by Ripple20?

This is a good question, to which there is unfortunately not yet a sufficient answer. Basically, every product with this software library is affected. It can be a simple printer, a smart home component such as a remote-controlled socket or even certain industrial machines. In addition, some aircraft and satellites are also affected. The question should rather be, which devices are not affected by Ripple20?

Since the manufacturer Treck has signed a non-disclosure agreement (NDA) with its customers, it is not in a position to publish a list of customers. However, Treck has contacted all customers, informed them about the vulnerabilities and provided the updated version of the software library.

The researchers at JSOF have themselves tried to find out which manufacturers are affected and which of them have already taken countermeasures. The following list is as of 18 June 2020 and does not claim to be complete or correct. Please contact the manufacturer of your IP-enabled devices if you suspect that they may be affected by the vulnerabilities.

How can the risk of being attacked by Ripple20 be minimised?

As a first step, one should get a complete overview of one's network and all connected devices. With a complete inventory, it can then be determined whether there are any affected devices in the network. Then it should be checked whether updates are available for the devices.

The general best-practice approaches naturally also include the standard procedure:

1. Allow devices access to the internet only when absolutely necessary.
2. Segment networks and use firewalls between networks.
3. If possible, only allow remote maintenance access to the devices via secured and encrypted VPN connections.

For the inventory and analysis of your network and the devices in it, there is a solution from the company Greenbone, which actively or passively searches for security vulnerabilities and summarises results in easy-to-understand reports. In addition, the solution can automatically search for devices in the network and generate an ISO27001-compliant inventory list.

For monitoring, we offer solutions from Nozomi Networks, which uses AI-based systems to learn how devices within a network speak to each other, so that after the learning phase, anomalies can be specifically detected and reported.

If you are interested in a consultation or a test of the presented solutions, please feel free to contact us via phone, email or our contact form.