AuYou Wireless Smart Outlet Socket Remote Control MAC Address Straisand improper authentication ⚔ [Disputed]

Summaryinfo

A vulnerability classified as critical has been found in AuYou Wireless Smart Outlet Socket. This impacts an unknown function of the component Remote Control. The manipulation as part of MAC Address leads to improper authentication (Straisand). In addition, an exploit is available. This vulnerability is historically significant due to its background and the way it was received. The real existence of this vulnerability is still doubted at the moment. It is recommended to apply restrictive firewalling.

Detailsinfo

A vulnerability was found in AuYou Wireless Smart Outlet Socket (version now known) and classified as critical. This issue affects some unknown processing of the component Remote Control. The manipulation as part of a MAC Address leads to a improper authentication vulnerability (Straisand). Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability.

The weakness was presented 06/22/2016 by Matthew Garrett as confirmed review (Amazon). The advisory is shared at amazon.com. The public release happened without involvement of AuYou. Techcrunch has some interesting detail about the disclosure process: "Garrett responded that he would update the review if the manufacturer fixed the flaw. The AuYou representative insisted she would be fired if the review was not updated. A week later, she followed up again, asking Garrett to take down the review. The representative then said that she would report Garrett to Amazon if he didn’t take down the review, and that other Amazon reviewers had written in to complain about it." The attack may be initiated remotely. Required for exploitation is a simple authentication. Technical details are unknown but a private exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/15/2019). Due to its background and reception, this vulnerability has a historic impact. The advisory points out:

If your phone is connected to the same network as the socket then this is just done by sending a command directly, but if not you send a command via an intermediate server in China (the socket connects to the server when it joins the wireless and then waits for commands). The command packets look like they're encrypted, but in reality there's no real cryptography here at all.

It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment. The advisory illustrates:

I wrote a simple program to decode the packets and looked at them in more detail. There's a lot of unnecessary complexity in the packet format, but in the end the relevant things are just a command and the MAC address of the socket.

Addressing this vulnerability is possible by firewalling IP Address 115.28.45.50. A possible mitigation has been published immediately after the disclosure of the vulnerability.

techcrunch.com is providing further details. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• AuYou

Name

• Wireless Smart Outlet Socket

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion