Critical security vulnerabilities in Realtek chips affect more than 65 hardware manufacturers

• Hundreds of thousands of devices affected, yet manufacturers hardly ever question their supply chains

• Security specialist IoT Inspector offers free checks to affected manufacturers and companies

Bad Homburg, August 16, 2021 – The list of hardware manufacturers affected by the recent Realtek vulnerabilities is rather long: AsusTEK, Belkin, D-Link, Edimax, Hama, Logitec, Netgear and many more equip their Wi-Fi devices with vulnerable software development kits (SDKs) from Realtek. A vulnerability within the Realtek RTL819xD module allows hackers to gain complete access to the device, installed operating systems and other network devices. "Our security reseachers have discovered and analyzed this vulnerability, which affects hundreds of thousands of devices. We notified Realtek, and they immediately responded and provided an appropriate patch. Manufacturers using vulnerable Wi-Fi modules are strongly encouraged to check their devices and provide security patches to their users," said Florian Lukavsky, managing director of IoT Inspector. The security platform probes the firmware of IoT devices such as routers, IP cameras or printers. The company has already published a number of coordinated security advisories with affected manufacturers in the past, thwarting potential hacking attacks. For this particular case, IoT Inspector is making its platform available to potentially affected manufacturers and users for a free check. Only by analyzing each firmware can it be determined whether vulnerable components are still being used.

Uncontrolled supply chains that serve hundreds of thousands of devices

The chips supplied by Realtek are used by almost all well-known manufacturers and can be found in VoIP and wireless routers, repeaters, IP cameras, and smart lighting controls. A detailed list of affected devices is included in IoT Inspector's advisory, but the list may potentially be much longer. For an exploit to succeed, an attacker usually needs to be on the same Wi-Fi network. However, faulty ISP configurations also expose numerous vulnerable devices directly to the Internet. A successful attack would provide full control of the Wi-Fi module, as well as root access to the embedded device's operating system. In total, a dozen vulnerabilities were found in the chipset. "There is currently far too little security awareness for devices in these categories - neither among users, nor among manufacturers, who blindly rely on components from other manufacturers in their supply chain without testing them. As a result, these components or products become an unpredictable risk," warns Florian Lukavsky of IoT Inspector. Manufacturers are therefore urged to implement guidelines for IoT supply chain security.

Regular patches and updates are essential

This is also the conclusion of Forrester's latest study, "The State of IoT Security - 2021". Following corporate website hacks, attacks on IoT devices such as routers, IP cameras and many more rank second in terms of attacks. Complex patch policies on enterprise networks and hard-to-access device environments block timely protection. Moreover, the lack of a physical user interface in the form of a screen makes the need hardly noticeable - unlike a PC, where systems can report necessary patches and updates. According to Forrester, only 38 percent of enterprise security decision makers worldwide have sufficient policies and tools in place to properly manage IoT devices. "We find new security vulnerabilities every day, most of which are directly mandated by manufacturers. The IT security mindset needs to include all devices connected to networks, regular audits and patches. Sometimes, a patch is itself the source of a new vulnerability. Few affected companies respond as quickly and thoroughly as Realtek. However, manufacturers are now also required to patch vulnerable Realtek components in their devices, while users are urged to check their devices and update them if necessary," concludes Florian Lukavsky of IoT Inspector.