NDLI: A quantitative analysis of the insecurity of embedded network devices: results of a wide-area scan

Please wait, while we are loading the content...

Detecting spammers on social networks

Cujo: efficient detection and prevention of drive-by-download attacks

Towards practical anonymous password authentication

Security analysis of a fingerprint-protected USB drive

Network intrusion detection: dead or alive?

Barriers to science in security

Friends of an enemy: identifying local members of peer-to-peer botnets using mutual contacts

Spam mitigation using spatio-temporal reputations from blacklist history

T-DRE: a hardware trusted computing base for direct recording electronic vote machines

Porscha: policy oriented secure content handling in Android

Familiarity breeds contempt: the honeymoon effect and the role of legacy code in zero-day vulnerabilities

Back to Berferd

Comprehensive shellcode detection using runtime heuristics

A multi-user steganographic file system on untrusted shared storage

Paranoid Android: versatile protection for smartphones

Always up-to-date: scalable offline patching of VM images in a compute cloud

Toward worm detection in online social networks

Fast and practical instruction-set randomization for commodity systems

Securing interactive sessions using mobile device through visual channel and visual inspection

A quantitative analysis of the insecurity of embedded network devices: results of a wide-area scan

The case for in-the-lab botnet experimentation: creating and taking down a 3000-node botnet

Breaking e-banking CAPTCHAs

Hardware assistance for trustworthy systems through 3-D integration

Kells: a protection framework for portable data

Quantifying information leaks in software

Cross-layer comprehensive intrusion harm analysis for production workload server systems

Heap Taichi: exploiting memory allocation granularity in heap-spraying attacks

Exploiting smart-phone USB connectivity for fun and profit

A framework for testing hardware-software security architectures

Who is tweeting on Twitter: human, bot, or cyborg?

G-Free: defeating return-oriented programming through gadget-less binaries

Exploring usability effects of increasing security in click-based graphical passwords

Multi-vendor penetration testing in the advanced metering infrastructure

Conficker and beyond: a large-scale empirical study

FIRM: capability-based inline mediation of Flash behaviors

SCA-resistant embedded processors: the next generation

Keeping data secret under full compromise using porter devices

Analyzing and improving Linux kernel memory protection: a model checking approach

Forenscope: a framework for live forensics

SCOBA: source code based attestation on custom software

Defending DSSS-based broadcast communication against insider jammers via delayed seed-disclosure

Two methodologies for physical penetration testing using social engineering

A quantitative analysis of the insecurity of embedded network devices: results of a wide-area scan

Content Provider	ACM Digital Library
Author	Stolfo, Salvatore J. Cui, Ang
Abstract	We present a quantitative lower bound on the number of vulnerable embedded device on a global scale. Over the past year, we have systematically scanned large portions of the internet to monitor the presence of trivially vulnerable embedded devices. At the time of writing, we have identified over 540,000 publicly accessible embedded devices configured with factory default root passwords. This constitutes over 13% of all discovered embedded devices. These devices range from enterprise equipment such as firewalls and routers to consumer appliances such as VoIP adapters, cable and IPTV boxes to office equipment such as network printers and video conferencing units. Vulnerable devices were detected in 144 countries, across 17,427 unique private enterprise, ISP, government, educational, satellite provider as well as residential network environments. Preliminary results from our longitudinal study tracking over 102,000 vulnerable devices revealed that over 96% of such accessible devices remain vulnerable after a 4-month period. We believe the data presented in this paper provides a conservative lower bound on the actual population of vulnerable devices in the wild. By combining the observed vulnerability distributions and its potential root causes, we propose a set of mitigation strategies and hypothesize about its quantitative impact on reducing the global vulnerable embedded device population. Employing our strategy, we have partnered with Team Cymru to engage key organizations capable of significantly reducing the number of trivially vulnerable embedded devices currently on the internet. As an ongoing longitudinal study, we plan to gather data continuously over the next year in order to quantify the effectiveness of community's cumulative effort to mitigate this pervasive threat.
Starting Page	97
Ending Page	106
Page Count	10
File Format	PDF
ISBN	9781450301336
DOI	10.1145/1920261.1920276
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2010-12-06
Publisher Place	New York
Access Restriction	Subscribed
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in