{"uuid": "844d48be-d7e8-4336-b73c-48dd5fccff91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "seen", "source": "https://t.me/hacking_Attack/20612", "content": "Black Hat Ethical Hacking\nBug in Millions of Flawed IoT Devices Lets Attackers Eavesdrop\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Bug in Millions of Flawed IoT Devices Lets Attackers EavesdropPost Views: 84 \nReading Time: 3 Minutes\nA remote attacker could exploit a critical vulnerability to eavesdrop on live audio & video or take control. The bug is in ThroughTek\u2019s Kalay network, used in 83m devices.\nSecurity researchers have discovered a critical flaw that affects tens of millions of internet-of-things (IoT) devices \u2013 one that exposes live video and audio streams to eavesdropping threat actors and which could enable attackers to take over control of devices, including security webcams and connected baby monitors.\n\nThe flaw, tracked as CVE-2021-28372\u00a0and FEYE-2021-0020\u00a0and assigned a critical CVSS3.1 base score of 9.6, was found in devices connected via ThroughTek\u2019s Kalay IoT cloud platform.\n\nThe alarm was sounded on Tuesday by Mandiant, in coordination with the Cybersecurity and Infrastructure Security Agency (CISA) and ThroughTek. Mandiant\u2019s Red Team discovered the vulnerability in late 2020.\n\n\u201cCVE-2021-28372 poses a huge risk to an end user\u2019s security and privacy and should be mitigated appropriately,\u201d according to Mandiant\u2019s post. \u201cUnprotected devices, such as IoT cameras, can be compromised remotely with access to a UID and further attacks are possible depending on the functionality exposed by a device.\u201d\n\nThe world has already been inundated with tales of what can happen when these kind of devices are misconfigured or riddled with vulnerabilities, and this just adds to the growing pile of scary headlines. For example, in February, a vulnerability affecting multiple baby monitors was found to expose hundreds of thousands of live devices, potentially allowing someone to drop in and view a camera\u2019s video stream.\n\nAs Mandiant explained, the flaw would enable adversaries \u201cto remotely compromise victim IoT devices, resulting in the ability to listen to live audio, watch real time video data, and compromise device credentials for further attacks based on exposed device functionality. These further attacks could include actions that would allow an adversary to remotely control affected devices.\u201d\n\nIn a Tuesday post, researchers Jake Valletta, Erik Barzdukas and Dillon Franke \u2013 who discovered the bug \u2013 explained that it\u2019s impossible to compile a comprehensive list of companies and products affected, given how the Kalay protocol is integrated by manufacturers and resellers before devices reach consumers. Though they couldn\u2019t come up with a definitive list of affected companies and products that implement the Kalay platform, they strongly advised users of IoT devices \u201cto keep device software and applications up to date and use complex, unique passwords for any accounts associated with these devices.\u201d\nSee Also: Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets Mandiant also recommends that device owners avoid connecting to affected devices from untrusted networks, such as public Wi-Fi: a recommendation that\u2019s already part of wireless best practices, as the National Security Agency (NSA) recently advised\u00a0in a public service announcement (PDF). Kalay: A Newly Unappealing HandshakeAccording to ThroughTek, \u201cKalay\u201d is an indigenous Dawu\u00a0word that means \u201chandshake,\u201d \u201csymbolizing the universal link in an interconnected world.\u201d\n\nThroughTek implements that handshake \u2013 the Kalay protocol \u2013 as a software development kit (SDK). The Kalay SDK provides a plug-and-play network to easily connect smart devices with corresponding mobile apps.\n\nThe researchers provided an illustration that g[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:28.171888Z"}