ONEKEY (formerly IoT Inspector)

With a turnover of over 10 billion euros and almost 20,000 employees, Switzerland’s technology and telecommunications company Swisscom is the industry leader in its country. Any defective rollout of routers, hotspots, repeaters and other device firmware would not only damage the company’s reputation, but also generate massive expenses. On average, each defective rollout is estimated to cost €350,000. Swisscom carries out several dozen such rollouts per year, and in the case of serious errors such as critical vulnerabilities, the company would have to repeat the entire process.

Using technology from ONEKEY, a company specializing in automated IoT security, Swisscom checks every piece of firmware and any updates for security breaches, risks, and gateways for potential hacker attacks. Swisscom currently has close to two million such devices in circulation among its customers. “We use the ONEKEY platform to check every piece of software for potential risks before it even reaches release candidate status, at which point they are immediately analyzed and fixed. This allows us to effectively secure new features and interfaces,” says Giulio Grazzi, Senior Security Consultant at Swisscom. Further reading

ONEKEY's researchers recently disclosed security issues in Realtek chips that affect a long list of manufacturers: AsusTEK, Belkin, D-Link, Edimax, Hama, Logitec, Netgear, and many more equip their Wi-Fi devices with software development kits (SDKs) from Realtek. A vulnerability within the Realtek RTL819xD module allows hackers to gain complete access to the device, installed operating systems and other network devices.

A successful attack would provide full control of the Wi-Fi module, as well as root access to the embedded device’s operating system. There is currently far too little security awareness for IoT devices – neither among users, nor among manufacturers, who blindly rely on components from other manufacturers in their supply chain without testing them. As a result, these components or products become an unpredictable risk for companies across all industries. Further reading

Hardware components from Broadcom can be found in numerous devices from leading vendors such as Cisco, DD-WRT or Linksys. ONEKEY recently reported that significant vulnerabilities lie deep in the software development kit (SDK). The ONEKEY Research Lab team exposed vulnerabilities that have been a common thread throughout products built on Broadcom for more than a decade, providing a welcome entryway for hackers.

In addition to the issue of the unmonitored supply chain — i.e., the use of hardware without prior risk verification — what stands out here is how serious the consequences of copy-paste engineering can be: Although Broadcom published a patch as early as 2011, leading manufacturers repeatedly built these vulnerabilities into products as they rely on a faulty version of the SDK.

ONEKEY is the leading European platform for analyzing device firmware, and regularly uncovers vulnerabilities at component or device manufacturers. Further reading