ONEKEY GmbH

ONEKEY is releasing new software to detect previously unknown vulnerabilities, including zero-day threats. The software performs an automated analysis of binary code and identifies all device components, matching them against international databases. It detects potential security problems such as outdated cryptography and hard-coded credentials, in addition to 0-day vulnerabilities. The platform provides information on where each vulnerability is located in the code, helping customers quickly isolate and fix the issue. The new version of ONEKEY software also provides a transparent listing of software components in SBOMs and detects private keys, which can easily be exploited as a potential backdoor. The threat level classification has been expanded to include “critical” and “informal”. ONEKEY is working intensively on automating their software to find known and unknown risks to better protect businesses that have a lot of network-connected technology in use. Further reading

A security vulnerability was discovered in ReFirm Labs' binwalk software. The issue is a path traversal vulnerability that affects versions 2.1.2b to 2.3.2. The vulnerability allows remote attackers to execute arbitrary code on systems where the software is installed. The target must open a malicious file using binwalk's extract mode for the exploit to be successful. No vendor advisory or fixed version has been released at the time of the advisory, but the vulnerability has been assigned CVE-2022-4510 and has a high CVSS score of 7.8. The path traversal was discovered by ONEKEY Research Lab. Further reading

The EU Commission's Cyber Resilience Act aims to increase the security level of connected devices by making manufacturers, importers, and distributors responsible for creating secure devices and maintaining that level of security throughout the product's life-cycle. The act is a response to the widespread low level of cybersecurity of connected devices and the increasing threat landscape, which caused global annual costs of more than EUR 5.5 trillion in 2021. The regulation mandates the implementation of mature cybersecurity processes, a reporting obligation for actively exploited vulnerabilities, a duty to monitor and mitigate vulnerabilities during the expected product lifecycle, and an obligation to publish security information and how to securely install and operate devices. In the future, manufacturers and distributors must inform ENISA, the European Union Agency for Cyber Security, within 24 hours when a security vulnerability is exploited. ONEKEY offers a Real-Time Monitoring service to help customers stay compliant with the Cyber Resilience Act by receiving immediate notifications of security vulnerabilities and incidents and offering automatic notification to ENISA. Local market surveillance authorities in each member state will be responsible for implementing and enforcing the directive. Further reading