Barak Hadad Shares Details of TLStorm Flaws in APC UPS Devices

Podcast: Play in new window | Download

Subscribe: Google Podcasts | Stitcher | RSS

TechSpective Podcast Episode 087

In a former life, I was a network administrator and IT support manager. One of the core responsibilities was to ensure resilience and business continuity even in the event of a power outage–and that meant relying on UPS (uninterruptible power supply) devices. APC was the brand we used, and–as far as I know–APC is the default that most companies turn to.

New research from Armis discovered multiple vulnerabilities in APC Smart-UPS devices that could potentially be exploited remotely by attackers. An Armis blog post explains, “The latest APC Smart-UPS models are controlled through a Cloud connection. Armis researchers found that an attacker exploiting the TLStorm vulnerabilities could remotely take over devices via the Internet without any user interaction or signs of attack. As a result, attackers can perform a remote-code execution (RCE) attack on a device, which in turn could be used to alter the operations of the UPS to physically damage the device itself or other assets connected to it.”

Barak Hadad, Head of Research at Armis Labs, joins me on this episode of the TechSpective Podcast to talk about the TLStorm vulnerabilities and the importance of having complete visibility of all connected devices in an environment. Barak is responsible for hunting zero-days and reverse engineering threats to help prepare customers to proactively protect their systems and data.

Check out the full episode for more insights on the TLStorm vulnerabilities in APC Smart-UPS devices and on the challenges of IoT and IIoT in general.

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.