Incident: Title: "Devil's Ivy IoT Vulnerability in gSOAP Library Impacting Thousands"

Published Date: 2017-07-18

Postmortem Analysis
Timeline 1. The software failure incident, known as Devil's Ivy, was reported on June 21, as Genivia released a patch and alerted customers on that date [61287].
System 1. gSOAP code widely used in physical security products [61287] 2. ONVIF protocol used by security cameras and other physical security devices [61287]
Responsible Organization 1. Genivia, the company behind the gSOAP code widely used in physical security products, was responsible for causing the software failure incident by having a vulnerability in their code that could be exploited across thousands of models of internet-connected devices [61287].
Impacted Organization 1. Internet-connected security camera makers, including Swedish security camera maker Axis Communications, were impacted by the software failure incident [61287]. 2. Companies using the gSOAP code in their IoT products, such as those in the ONVIF consortium, were potentially affected by the vulnerability [61287]. 3. Customers using devices that incorporated the vulnerable gSOAP code, such as security cameras, sensors, and access-card readers, were at risk of being impacted by the software failure incident [61287].
Software Causes 1. The software failure incident was caused by a vulnerability in a piece of code called gSOAP, widely used in physical security products, leading to a flaw known as "Devil's Ivy" [61287].
Non-software Causes 1. Lack of proper patching and updating procedures for IoT devices [61287] 2. Inadequate communication and transparency among companies using the gSOAP code [61287] 3. Unclear responsibility distribution between the code provider and the companies using the code [61287]
Impacts 1. The software failure incident known as "Devil's Ivy" exposed a vulnerability in the gSOAP code widely used in physical security products, potentially allowing attackers to fully disable or take over thousands of models of internet-connected devices from security cameras to sensors to access-card readers [61287]. 2. The vulnerability affected not only internet-of-things devices but also companies like IBM and Microsoft, highlighting the widespread impact of reusing code from a small company across tens of millions of gadgets [61287]. 3. The incident led to the discovery of a buffer overflow vulnerability in the firmware of a security camera from Axis Communications, which could allow hackers to run any code they chose on the camera, potentially disabling it, installing malware, or intercepting its video stream [61287]. 4. The attack worked not only for one camera model but for any of the 249 models offered by Axis Communications, indicating the broad reach of the vulnerability [61287]. 5. The software failure incident affected nearly 500 members of the ONVIF consortium, including companies like Bosch, Canon, Cisco, D-Link, Fortinet, Hitachi, Honeywell, Huawei, Mitsubishi, Netgear, Panasonic, Sharp, Siemens, Sony, and Toshiba, as they used the gSOAP code in their products [61287]. 6. The incident raised concerns about the patching process in the internet of things ecosystem, as not all devices have automatic updates or careful administrators maintaining them, potentially leaving a large number of devices vulnerable [61287].
Preventions 1. Regular security audits and code reviews of third-party code used in IoT devices could have potentially identified the vulnerability in the gSOAP code before it was exploited [61287]. 2. Implementing automatic software updates for IoT devices to ensure that patches for known vulnerabilities are promptly applied [61287]. 3. Improved communication and collaboration among companies using shared code libraries like gSOAP to ensure that security patches are disseminated effectively across all affected products [61287].
Fixes 1. Patching the vulnerability in the gSOAP code used in IoT devices by applying the security update released by Genivia [Article 61287]. 2. Ensuring that the companies using the gSOAP code make the patch available to their customers and encouraging customers to install the patch on their devices [Article 61287]. 3. Implementing automatic updates on IoT devices to ensure timely application of security patches [Article 61287].
References 1. Senrio security company [Article 61287] 2. Genivia, the company behind gSOAP code [Article 61287] 3. Axis Communications, the Swedish security camera maker [Article 61287] 4. ONVIF consortium [Article 61287] 5. Various member companies of the ONVIF consortium such as Bosch, Canon, Cisco, D-Link, Fortinet, Hitachi, Honeywell, Huawei, Mitsubishi, Netgear, Panasonic, Sharp, Siemens, Sony, and Toshiba [Article 61287]

Software Taxonomy of Faults

Category Option Rationale
Recurring multiple_organization (a) The software failure incident related to the vulnerability in the gSOAP code, known as Devil's Ivy, impacted multiple organizations. The incident affected at least 34 companies that use the gSOAP code in their IoT products [61287]. The vulnerability in the gSOAP code was found in a single security camera from Swedish security camera maker Axis Communications, which led to the discovery that the bug was not in Axis's code but in the gSOAP code distributed by Genivia [61287]. (b) The software failure incident involving the Devil's Ivy vulnerability in the gSOAP code affected a wide range of companies beyond just the initial security camera manufacturer. The vulnerability potentially left thousands of different models of internet-connected devices at risk, including security cameras, sensors, and access-card readers [61287]. The gSOAP code is used by nearly 500 members of the ONVIF consortium, which includes companies like Bosch, Canon, Cisco, D-Link, Fortinet, Hitachi, Honeywell, Huawei, Mitsubishi, Netgear, Panasonic, Sharp, Siemens, Sony, and Toshiba [61287]. The total number of affected devices was estimated to be in the millions, indicating the widespread impact of the software vulnerability across multiple organizations [61287].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the article. The vulnerability known as "Devil's Ivy" was discovered in a piece of code called gSOAP, which is widely used in physical security products across various vendors. This vulnerability allowed attackers to fully disable or take over thousands of models of internet-connected devices, including security cameras, sensors, and access-card readers. The issue stemmed from the reuse of code from a small company (Genivia) across a wide range of devices, leading to a widespread impact on the security of these products [61287]. (b) The software failure incident related to the operation phase is also highlighted in the article. The vulnerability in the gSOAP code, which was exploited in the Devil's Ivy attack, required sending a large payload of malicious data to the target devices. This operation-based vulnerability allowed attackers to run any code they chose on the affected devices, potentially leading to disabling the devices, installing malware, or intercepting video streams. The operation of the devices, particularly those configured as servers, made them vulnerable to exploitation through this flaw [61287].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident related to the Devil's Ivy vulnerability, also known as a buffer overflow in the gSOAP code widely used in physical security products, originated from within the system. The vulnerability was found in a piece of code called gSOAP, which was distributed by Genivia as part of its popular gSOAP developer platform. This vulnerability allowed attackers to fully disable or take over thousands of models of internet-connected devices from security cameras to sensors to access-card readers [61287]. (b) outside_system: The software failure incident was exacerbated by factors originating from outside the system, such as the interconnected nature of the Internet of Things (IoT) ecosystem. The widespread use of the gSOAP code across various IoT products from different vendors meant that a single bug in the code could impact a large number of disparate devices, highlighting the risks associated with code reuse and supply chain vulnerabilities in the IoT space [61287].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the article was primarily due to non-human actions. The vulnerability known as "Devil's Ivy" was a flaw in a piece of code called gSOAP widely used in physical security products, which potentially allowed attackers to disable or take over thousands of models of internet-connected devices [61287]. (b) However, human actions also played a role in this incident. The article mentions that the attack would have to be configured separately for each vulnerable device or application, and it required sending a significant amount of data to the target, which was described as a "silly" amount of bandwidth [61287]. Additionally, the responsibility of applying patches to protect devices rested on the companies that use the gSOAP code, as well as on the customers to install those patches [61287].
Dimension (Hardware/Software) software (a) The software failure incident reported in the articles is primarily related to software issues rather than hardware. The incident, known as "Devil's Ivy," was a vulnerability in a piece of code called gSOAP widely used in physical security products, which potentially allowed attackers to disable or take over thousands of models of internet-connected devices [61287]. The vulnerability stemmed from a buffer overflow in the firmware of a security camera, which was not in the camera's code but in a code library distributed by Genivia as part of its gSOAP developer platform. This code library was used to implement a protocol called ONVIF, which is a networking language for security cameras and other physical security devices [61287]. The incident highlights the danger of reusing code from a small company across tens of millions of gadgets, emphasizing the importance of secure software development practices and thorough code reviews to prevent such vulnerabilities [61287]. (b) The software failure incident was caused by a vulnerability in the gSOAP code, which is a software component widely used in various internet-connected devices. This vulnerability allowed attackers to exploit the devices and potentially take control of them. The incident underscores the importance of secure coding practices and thorough software testing to prevent such vulnerabilities from being exploited [61287].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the articles is malicious in nature. The incident, known as "Devil's Ivy," was a vulnerability in a piece of code called gSOAP widely used in physical security products, potentially allowing attackers to fully disable or take over thousands of models of internet-connected devices from security cameras to sensors to access-card readers [61287]. The attack required sending two full gigabytes of data to a target, indicating a deliberate effort to exploit the vulnerability [61287]. (b) The incident was not non-malicious as it involved a deliberate exploitation of a vulnerability in the code used in various IoT devices, highlighting the danger of reusing code from a small company across tens of millions of gadgets [61287].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The software failure incident described in the articles can be attributed to poor decisions made by various companies involved in using the gSOAP code in their IoT products. The vulnerability known as "Devil's Ivy" stemmed from a piece of code called gSOAP, which was widely used in physical security products from various vendors. Despite the discovery of the vulnerability, patching was described as spotty in the internet of things, leading to a situation where the flaw could persist unfixed in a large number of devices [61287]. (b) Additionally, the incident can also be linked to accidental decisions or unintended consequences. The vulnerability in the gSOAP code, which led to the Devil's Ivy flaw, was not initially identified by the company behind the affected security camera but was discovered by Senrio's researchers. This highlights how unintended consequences can arise from using third-party code across a wide range of products without thorough security assessments [61287].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident related to development incompetence can be seen in the article where a vulnerability in a piece of code called gSOAP, widely used in physical security products, was discovered. This vulnerability, named "Devil's Ivy," allowed attackers to fully disable or take over thousands of models of internet-connected devices from security cameras to sensors to access-card readers. The issue stemmed from the reuse of code from a small company across tens of millions of gadgets, highlighting the danger of supply chain code sharing in the Internet of Things [61287]. (b) The software failure incident related to accidental factors can be observed in the same article where the vulnerability known as Devil's Ivy was found in the firmware of a single security camera from Axis Communications. This bug could allow a hacker to run any code they chose on the camera, potentially disabling it, installing malware, or intercepting its video stream. The accidental nature of this failure is evident in the fact that the bug was not in Axis's code but in a code library distributed by Genivia as part of its gSOAP developer platform, which was used by various companies without clear knowledge of the potential vulnerabilities it introduced [61287].
Duration permanent, temporary The software failure incident described in the articles can be categorized as both permanent and temporary: (a) Permanent: The vulnerability known as "Devil's Ivy" discovered by Senrio in the gSOAP code widely used in physical security products could potentially allow attackers to fully disable or take over thousands of models of internet-connected devices. The widespread use of this code across various devices means that the impact of the vulnerability could persist unfixed in a large number of devices, even after a patch has been released [61287]. (b) Temporary: While a patch was released for the vulnerability, the effectiveness of the patch and the mitigation of the issue depend on the companies that use the gSOAP code making the patch available and customers actually installing it. The article mentions that not all devices affected by the bug necessarily have automatic updates or careful administrators maintaining them, which could lead to some devices remaining vulnerable [61287].
Behaviour crash, omission, value, other (a) crash: The software failure incident described in the articles can be categorized as a crash. The vulnerability known as "Devil's Ivy" allowed attackers to fully disable or take over thousands of models of internet-connected devices, such as security cameras, sensors, and access-card readers [61287]. (b) omission: The incident can also be related to omission as the vulnerability in the gSOAP code used in physical security products allowed attackers to potentially disable devices, install malware, intercept or spoof video streams, and run any code they chose on the affected cameras [61287]. (c) timing: There is no specific mention of the software failure incident being related to timing issues in the articles. (d) value: The incident can be linked to a failure in value as the vulnerability in the gSOAP code led to the system performing its intended functions incorrectly, allowing attackers to exploit the devices and compromise their security [61287]. (e) byzantine: The incident does not align with a byzantine behavior where the system behaves erroneously with inconsistent responses and interactions. (f) other: The other behavior exhibited by the software failure incident is the widespread impact of a single bug across a large number of disparate devices due to the reuse of code from a small company across tens of millions of gadgets. This highlights the danger of code reuse in the Internet of Things ecosystem and the potential for vulnerabilities to propagate extensively [61287].

IoT System Layer

Layer Option Rationale
Perception sensor, embedded_software (a) The failure was related to the perception layer of the cyber physical system that failed due to contributing factors introduced by sensor error. The vulnerability known as Devil's Ivy was found in the firmware of a single security camera from Axis Communications, allowing a hacker to run any code they chose on the camera by sending a two-gig payload of malicious data [61287]. (e) The failure was also related to the perception layer of the cyber physical system that failed due to contributing factors introduced by embedded software error. The vulnerability in the firmware of the security camera was traced back to a code library distributed by Genivia as part of its gSOAP developer platform, which is used to implement a protocol called ONVIF, a networking language for security cameras and other physical security devices [61287].
Communication connectivity_level The software failure incident described in the article [61287] was related to the communication layer of the cyber-physical system that failed at the connectivity level. The vulnerability known as "Devil's Ivy" was a flaw in a piece of code called gSOAP widely used in physical security products, which potentially allowed attackers to disable or take over thousands of models of internet-connected devices from security cameras to sensors to access-card readers. This vulnerability was introduced at the network or transport layer, affecting the communication and connectivity aspects of the devices utilizing the gSOAP code. The failure was not directly linked to the physical layer of the cyber-physical system but rather to the network protocols and communication mechanisms employed by the affected devices.
Application TRUE The software failure incident described in the article [61287] was related to the application layer of the cyber physical system. The vulnerability known as "Devil's Ivy" was a flaw in a piece of code called gSOAP widely used in physical security products, specifically in internet-connected security cameras, sensors, and access-card readers. This vulnerability allowed attackers to fully disable or take over thousands of models of internet-connected devices. The issue stemmed from a buffer overflow in the firmware of a security camera, which was actually due to a code library distributed by Genivia as part of its gSOAP developer platform, used to implement the ONVIF protocol for networking security cameras and other physical security devices. The vulnerability affected a wide range of devices from different vendors, highlighting the risks associated with reusing code across various IoT products.

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (a) unknown (b) unknown (c) unknown (d) The software failure incident described in the articles led to potential harm to people's property. The vulnerability in the gSOAP code widely used in physical security products could allow attackers to fully disable or take over thousands of models of internet-connected devices, including security cameras, sensors, and access-card readers. This could result in potential financial losses for individuals or organizations using these vulnerable devices [61287]. (e) unknown (f) The software failure incident impacted non-human entities, specifically internet-connected devices such as security cameras, sensors, and access-card readers. The vulnerability in the gSOAP code could potentially allow attackers to disable or take over these devices, affecting their functionality and security [61287]. (g) unknown (h) The articles discuss potential consequences of the software failure incident, such as the widespread impact of the vulnerability in the gSOAP code across various internet-connected devices. The vulnerability, named "Devil's Ivy," could potentially affect millions of devices from different manufacturers, highlighting the significant and widespread nature of the bug [61287]. (i) unknown
Domain health The software failure incident discussed in the articles is related to the industry of **(j) health**. The incident involved a vulnerability in a piece of code called gSOAP, widely used in physical security products, which potentially allowed attackers to disable or take over thousands of models of internet-connected devices, including security cameras, sensors, and access-card readers [Article 61287]. The affected devices included security cameras from Swedish security camera maker Axis Communications, which had a vulnerability in their firmware due to the gSOAP code [Article 61287]. The vulnerability impacted not only the specific camera model but any of the 249 models offered by Axis Communications, highlighting the widespread nature of the issue [Article 61287]. The gSOAP code was used to implement a protocol called ONVIF, which is a networking language for security cameras and other physical security devices used in the health industry among other sectors [Article 61287]. The vulnerability in the gSOAP code potentially left millions of devices vulnerable to exploitation, including those used in the health industry [Article 61287].

Sources

Back to List