{"uuid": "9a18aa5e-daff-4afa-9b4d-42a7ae7b16ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28372", "type": "seen", "source": "https://t.me/hacking_Attack/20614", "content": "ntent/uploads/sites/103/2021/08/17113113/capturing-credentials-e1629214353657.png Attacker exploiting device personation vulnerability to capture credentials. Source: Mandiant.\nAfter that, a threat actor can remotely connect to the victimized device, access audio/visual data and execute remote procedure calls (RPC), Mandiant said. Due to vulnerabilities in the device-implemented RPC interface, this can then lead to \u201cfully remote and complete device compromise,\u201d researchers described. Their enumeration of what makes this possible: \u201cMandiant observed that the binaries on IoT devices processing Kalay data typically ran as the privileged user root and lacked common binary protections such as Address Space Layout Randomization (\u201cASLR\u201d), Platform Independent Execution (\u201cPIE\u201d), stack canaries, and NX bits.\u201d\n\nThe figure below shows a hypothetical attack using the captured Kalay credentials to stage yet another attack by abusing the vulnerabilities in the Kalay RPC interface: https://media.threatpost.com/wp-content/uploads/sites/103/2021/08/17114402/Screen-Shot-2021-08-17-at-11.43.08-AM-e1629215096109.png See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerMandiant isn\u2019t releasing public exploit code, but it did provide the video below, which demonstrates a proof of concept for CVE-2021-28372. How to Address the BugMandiant \u201cstrongly recommends\u201d that companies using the Kalay platform follow the following guidance from ThroughTek and Mandiant:\n\n* If the implemented SDK is below version 3.1.10, upgrade the library to version 3.3.1.0 or version 3.4.2.0 and enable the Authkey and Datagram Transport Layer Security (DTLS) features provided by the Kalay platform.\n* If the implemented SDK is version 3.1.10 and above, enable Authkey and DTLS.\n* Review security controls in place on APIs or other services that return Kalay unique identifiers (UIDs).\n* Hardening features such as ASLR, PIE, NX, and stack canaries should be enabled on all binaries processing Kalay data and RPC functions should be treated as untrusted and sanitized appropriately.\n* IoT device manufactures should apply stringent controls around web APIs used to obtain Kalay UIDs, usernames, and passwords to minimize an attacker\u2019s ability to harvest sensitive materials needed to access devices remotely. Failure to protect web APIs which return valid Kalay UIDs could allow an attacker to compromise a large number of devices.\n\nMandiant thanked ThroughTek and CISA for their cooperation and support with releasing the advisory and for their \u201ccommitment to securing IoT devices globally.\u201d\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Steam-logo-90x90.jpg Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/tmobile-header-90x90.webp Hacker claims to steal data of 100 million T-mobile customers2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/depositphotos_40325161-stock-photo-microsoft-building-90x90.jpg Microsoft Warns: Another Unpatched PrintNightmare Zero-Day5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/crypto-hack-90x90.jpg Crypto Hack Earned Crooks $600 Million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/msft-microsoft-logo-2-3-90x90.webp Actively Exploited Windows Zero-Day Gets a Patch1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/botnet-90x90.jpg Auth Bypass Bug Exploited, Affecting Millions of Routers1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/cisco-patch-90x90.png Critical Cisco Bug in VPN Routers Allows Remote Takeover1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/delete-telegram-message-e1628177080[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:28.218208Z"}