DoS vulns in 3 open-source MQTT message brokers could leave users literally locked out of their homes or offices
- Reference: 1623157511
- News link: https://www.theregister.co.uk/2021/06/08/mqtt_dos_vulnerabilities/
- Source link:
The message brokers, responsible for handling data sent to or from IoT devices like smart home hubs and door locks, all share a common protocol: Message Queuing Telemetry Transport (MQTT), first released in 1999 for monitoring oil pipelines and since repurposed for a variety of home and industrial automation tasks. Any disruption in MQTT messaging could potentially leave users locked out of their homes and offices.
"Message brokers are software applications that serve as a messaging hub for complex systems," said Jonathan Knudsen, Synopsys senior security strategist responsible for discovering the vulnerabilities, in the public disclosure. "They provide reliable communication channels between different components, serving as the nerve center of a complex system. As such, message brokers can also be a central point of failure."
[1]
All three message brokers affected by Knudsen's discovery can be fooled into bloating their memory usage until they are terminated by the host operating system by sending them a specially crafted MQTT message. Once terminated, any IoT device on the network which relies on the MQTT message broker will be rendered inoperable.
[2]
[3]
"If the message broker dies, system components won't be able to communicate," Knudsen continued. "CVE-2021-22116, CVE-2021-33175, and CVE-2021-33176 are denial of service vulnerabilities in three popular open source message brokers. They give attackers the opportunity to disable the message brokers, a denial-of-service attack that could have serious consequences."
[4]ADT techie admits he peeked into women's home security cams thousands of times to watch them undress, have sex
[5]Q&A: Crypto-guru Bruce Schneier on teaching tech to lawmakers, plus privacy failures – and a call to techies to act
[6]What to do about open source vulnerabilities? Move fast, says Linux Foundation expert
[7]Open-source bug bonanza: Vulnerabilities up almost 50 per cent thanks to people actually looking for them
[8]When software depends on a project thanklessly maintained by a random guy in Nebraska, is open source sustainable?
The precise details of the vulnerability differ from system to system. While all are triggered by a malicious MQTT message, the message has to be written specifically for the target message broker. Knudsen's research revealed three messages, each of which crashes a single message broker, but reported no luck in finding a single message capable of crashing all three – a small comfort to beleaguered system administrators.
Knudsen and CyRC privately disclosed the flaws to the project maintainers back in March, and all three have now been patched. RabbitMQ users are advised to upgrade to [9]version 3.8.16 or above ; EMQ X users to [10]version 4.2.8 or above ; and VerneMQ users to [11]version 1.12.0 or above . ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YL@UIw7dst1xy1btdKqyawAAABI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YL@UIw7dst1xy1btdKqyawAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YL@UIw7dst1xy1btdKqyawAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2021/01/23/in_brief_security/
[5] https://www.theregister.com/2019/03/15/qa_bruce_schneier/
[6] https://www.theregister.com/2021/05/26/open_source_vluns_talk_qcon/
[7] https://www.theregister.com/2020/03/13/open_source_bugs/
[8] https://www.theregister.com/2021/05/10/untangling_open_sources_sustainability_problem/
[9] https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.16
[10] https://docs.emqx.io/en/broker/
[11] https://github.com/vernemq/vernemq/releases/tag/1.12.0
[12] https://whitepapers.theregister.com/
You would be correct, and... We do... Crontab is such a useful beast...
Ah, but these are the brokers we're talking about. The devices themselves may be knocked out by a wage-slave in a Shenzen factory and vulnerable to everything, but the brokers are run on proper computers and written by people that care. They should be no worse than any other daemon, eg apache, ftpd.
Running Mosquitto here, with no regrets about that after this article.
Patch a key
When was the last time you had to patch a key?
I suppose keys can be vulnerable to DoS, multiple people tying to put their key into the same lock at the same time.
Re: Patch a key
A key broken inside the lock....
Re: Patch a key
Even better example of DoS Key. :)
Re: Patch a key
It can be done, but its very hard for someone to do it without leaving their house/basement...
Re: Patch a key
Or, given that a DoS is normally an attack (self-inflicted accidents not withstanding) - superglue in the lock.
Re: Patch a key
Which is easily fixed by pouring acetone (ie; nail varnish remover) into the lock as it dissolves superglue.
Re: Patch a key
A DoS is easily fixed by spinning up more capacity etc.
It only needs to be a temporary inconvenience, not a permanent one.
Also, if you've got a uPVC door you might want to be a little careful putting acetone anywhere near it (though nail varnish remover is sufficiently dilute it shouldn't be an issue)
Re: Patch a key
With most locks on uPVC doors, if you insert the key in one side then it stops a key being fully inserted from the other. Was told this morning of a relative having done than before suffering a medical issue and it required the Fire Service as it was a 3rd floor flat but had an open window.
So DOS beaten by backdooring (ish)
Smart stuff is all well and good, but if having internet problems or a power outage locks you out of your home you're doing something wrong imho. Backup systems. They matter.
Backup system?
A window and a half-brick?
Yep.
One place I used to work at found that out when the server supporting the smart card access system failed.
It was behind a security door controlled by the same system. Cue fire axe...
You would kind of hope that any device that relies on MQTT would implement a watchdog to restart it if it terminates unexpectedly.
Oh, wait, we're talking IoT...