32 hardware and firmware vulnerabilities

Introduction 

Hardware and firmware vulnerabilities can put your business and your customers’ sensitive data at risk, costing you in diminished sales, reputation loss and penalties. Most of them arise from continued use of legacy systems and out-of-date software that are no longer maintained by their respective vendors. The fact that the majority of these loopholes don’t necessarily raise a red flag may allow hackers to steal information, inject malware or completely hijack your applications or corporate systems.

Below, we give a breakdown of the 32 most commonly exploited hardware and firmware vulnerabilities. If any of these relate to systems or devices that are under your jurisdiction, it’s extremely important that you take steps to plug these holes before disaster strikes.

Hardware vulnerabilities

1. Directory traversal

Old computer routers can have serious flaws that enable remote adversaries to take control of them. A Kyle Lovett security researcher, for instance, found that more than 700,000 ADSL routers distributed to various customers suffered from the “directory traversal” vulnerability that provides hackers with a way to extract administrative details.

2. Rowhammer

Rowhammer is classified as a vulnerability affecting some recent DDR DRAM devices where repeated access to a memory row can result in bit flips in adjustment rows. This means that, tentatively, a hacker can change any value of the memory’s bit.

Sponsorships Available

Sponsorships Available

Sponsorships Available

3. Meltdown RDCL

Meltdown RDCL (Rogue Data Cache Load) capitalizes on the non-functional execution capabilities of Intel CPUs. Hackers can use it to break through the kernel’s privilege boundaries, which typically safeguard sensitive secrets.

4. Thunderclap 

Thunderclap is a collection of hardware vulnerabilities that reside in the Thunderbolt hardware interface produced by Intel. It can be used by hackers with physical access to a Thunderbolt port to overtake a target system in just a few seconds, executing arbitrary code at the highest (Read more...)