Exploit Of Critical Realtek Sdk Vulnerability Sparks Massive Cyber Attacks

The exploitation of the critical vulnerability in the Realtek Jungle SDK has resulted in a series of massive cyber attacks targeting smart devices. This vulnerability, known as CVE-2021-35394, enables remote code execution and unauthorized access, granting full control to malicious actors. Palo Alto Networks has observed a significant surge in exploitation attempts, with this vulnerability accounting for more than 40% of all reported incidents. The attacks have been concentrated between August and October and have impacted a wide range of devices, including routers, residential gateways, IP cameras, and Wi-Fi repeaters. Three distinct types of payloads have been employed in these attacks, involving the delivery of malware, execution of binary payloads, and triggering server reboots through command injection. The attacks have been traced back to over thirty international regions, with the United States being the primary source. Despite Realtek’s efforts to address the vulnerabilities, botnets continue to exploit them. To mitigate the risks posed by these attacks, it is recommended to implement robust security measures, regularly apply patches, and prioritize supply chain security.

Key Takeaways

• Realtek Jungle SDK vulnerability (CVE-2021-35394) has been exploited by hackers in millions of cyber attacks, targeting smart devices and granting unauthorized access and control.
• Palo Alto Networks detected a significant increase in exploitation attempts, with the vulnerability accounting for over 40% of all incidents, affecting 190 device models including routers, IP cameras, and Wi-Fi repeaters.
• The vulnerability has a severity rating of 9.8 and is caused by multiple memory corruption and command injection vulnerabilities in Realtek Jungle SDK versions v2.x up to v3.4.14B.
• The attacks delivered three types of payloads, including malware downloads, executable script injections, and command injections causing server reboots. Botnet malware families like Mirai, Gafgyt, and Mozi were responsible for the attacks.

Realtek Jungle SDK Vulnerability

The Realtek Jungle SDK vulnerability, identified as CVE-2021-35394 with a severity rating of 9.8, has been exploited by attackers in millions of cyber attacks aimed at compromising smart devices and gaining unauthorized access for complete control over affected devices. This vulnerability has had a significant impact on smart home devices, as it allows attackers to remotely execute code and exploit multiple memory corruption and command injection vulnerabilities. As a result, 134 million cyber attacks have been reported, with the vulnerability accounting for over 40% of all incidents. To protect against the Realtek Jungle SDK vulnerability, it is crucial to implement robust security measures. Regularly applying patches to devices and keeping them up-to-date with the latest upgrades is recommended. Additionally, the use of Next-Generation Firewalls and supply chain security measures can help mitigate the risk posed by this vulnerability.

Exploitation Attempts

Significant increase in attempts to take advantage of the identified security flaw have been detected by Palo Alto Networks. The Realtek Jungle SDK vulnerability, identified as CVE-2021-35394, has resulted in a surge of exploitation attempts, accounting for over 40% of all incidents. These attempts were concentrated from August to October and affected 190 device models, including routers, residential gateways, IP cameras, and Wi-Fi repeaters. The severity of the vulnerability, with a base score of 9.8, has raised concerns about its impact on IoT security and supply chain implications. The exploitation of this vulnerability has allowed attackers to compromise smart devices, granting them unauthorized access and complete control. This has led to a high volume of cyber attacks, with 134 million reported incidents, targeting vulnerable devices worldwide.

Vulnerability Profile

Identified as CVE-2021-35394, the vulnerability in Realtek Jungle SDK has exposed numerous devices to potential unauthorized access and complete control. This critical vulnerability affects Realtek Jungle SDK versions v2.x up to v3.4.14B, impacting a wide range of devices such as routers, residential gateways, IP cameras, and Wi-Fi repeaters. The severity rating of 9.8 highlights the significant risk posed by this vulnerability. The exploitation attempts concentrated from August to October, with Palo Alto Networks detecting a substantial increase in incidents, accounting for over 40% of all attacks. The supply chain implications of this vulnerability are evident, as threat actors actively exploit vulnerabilities in the search for weak links in the supply chain. To mitigate the risks associated with this vulnerability, robust security measures, including next-generation firewalls, regular patching, and device updates, are essential.

Payloads Delivered

Three different types of payloads have been delivered in the attacks targeting the Realtek Jungle SDK vulnerability, including executable script downloads, injectable commands, and command injections causing server reboots. These payloads have been used by threat actors to exploit the vulnerability and gain unauthorized access to vulnerable devices. The impact of the RedGoBot malware, which specifically targets devices vulnerable to CVE-2021-35394, has been significant. This powerful botnet malware is capable of conducting DDoS attacks on multiple protocols, utilizing flood methods such as HTTP, ICMP, TCP, UDP, VSE, and OpenVPN. It has exploited the Realtek Jungle SDK vulnerability to carry out these DDoS attacks. To mitigate the delivery of payloads in cyber attacks, it is recommended to implement robust security measures, regularly apply patches to devices, keep devices up-to-date with the latest upgrades, and emphasize supply chain security and vulnerability detection.

Attack Origins

The origins of the attacks targeting the Realtek Jungle SDK vulnerability spanned more than thirty international regions, with the United States accounting for the highest percentage of attacks followed by Vietnam, Russia, Netherlands, France, Luxembourg, and Germany. These attacks highlight the global impact of the Realtek SDK vulnerability and the widespread exploitation attempts that occurred. Realtek, the company responsible for the SDK, took action to address the critical vulnerabilities, including CVE-2021-35394, in August 2021. However, despite their efforts, malicious actors continued to target and exploit these vulnerabilities, with botnets still carrying out attacks as recently as December. The high volume of attacks underscores the importance of implementing robust security measures, such as regularly applying patches and updates, to mitigate the risks associated with supply chain vulnerabilities.

Frequently Asked Questions

How can the Realtek Jungle SDK vulnerability be exploited?

The Realtek Jungle SDK vulnerability (CVE-2021-35394) can be exploited through remote code execution. This allows hackers to gain unauthorized access and complete control over affected devices. The vulnerability has a severity rating of 9.8 and impacts various devices, including routers, residential gateways, IP cameras, and Wi-Fi repeaters. Mitigation strategies include applying patches, using robust security protections, and regularly updating devices. The exploitation of this vulnerability has resulted in millions of cyber attacks, with significant impacts on the affected devices.

What types of devices are affected by the CVE-2021-35394 vulnerability?

The potential consequences of the CVE-2021-35394 vulnerability include unauthorized access and complete control over affected devices. Users can detect if their devices are affected by the Realtek SDK vulnerability by regularly applying patches and keeping their devices up-to-date.

Which botnet malware families are responsible for the attacks?

The botnet malware families responsible for the attacks exploiting the Realtek SDK vulnerability are Mirai, Gafgyt, and Mozi. Cybersecurity awareness plays a crucial role in preventing botnet attacks and their impact on IoT devices and networks.

What actions did Realtek take to address the vulnerabilities?

Realtek’s response to the vulnerabilities included the release of patches, a vulnerability disclosure, and a security advisory. These actions were taken in August 2021, although botnets continued to exploit the vulnerabilities until December.

What are the recommended security measures to protect against the exploitation of this vulnerability?

To protect against the exploitation of the Realtek SDK vulnerability (CVE-2021-35394), it is recommended to implement robust security measures such as using Next-Generation Firewalls, regularly applying patches, keeping devices up-to-date, and prioritizing supply chain security and vulnerability detection as best practices for ensuring device security.