An Israeli cybersecurity researcher has uncovered 40 unknown zero-day vulnerabilities in Samsung’s operating system Tizen. The vulnerabilities “would allow someone to remotely hack millions of newer Samsung smart TVs, smart watches, and mobile phones already on the market, as well as ones slated for future release, without needing physical access to them.” IT security experts from Lastline, ESET, prpl Foundation and FireMon commented below.
Professor Giovanni Vigna, Founder and CTO at Lastline:
“This is another clear example of how the pressure to deploy software in the current consumer market can actually harm the security of systems (from phones to IoT devices). Security needs to be built-in and not be an afterthought, as it is much harder to fix something broken that has been deployed to millions of devices, than to deploy secure (or at least reasonably secure) systems in the first place.”
Mark James, Security Specialist at ESET:
“One of the biggest problems with technology is the speed at which it progresses – one minute the whole family is sat watching primates with Sir David Attenborough on one of your only 5 channels, the next you have a choice of over 240 channels with your TV being capable of viewing all your social media accounts. Internet surfing or playing games, all require intelligence and internet connectivity but more importantly access to your private data. In our quest for the “Smart TV” we often do not question how or where our data will be stored or sent and most would never look at how often the actual TV operating system or apps are going to be updated but that’s exactly what cyber criminals will do – they are looking for every new and unrestricted way they can find exploits and vulnerabilities on our new technologies. One of the only ways to stop them is having the ability to patch or update as fast and as easily as possible.”
Art Swift, President at prpl Foundation:
“In order to prevent such issues in the future, the not for profit prpl foundation is working with industry to develop ways to create a more secure IoT. The prpl security framework encourages peer review, properly signed software anchored in a hardware root of trust, the re-use of well-understood and widely used communications and security protocols and the use of security by separation to isolate vulnerabilities.”
Paul Calatayud, CTO at FireMon:
“As a security practitioner, we often use Microsoft as solid example of a company that places a sizable emphasis on product security. Operating systems are now being replaced by IoT devices, but the security programs are not keeping with the pace of innovation. Same can be said about the car, healthcare, and other markets. The demand for security professionals will continue to increase.
“Home networks are becoming complex with consumer data and connected devices, but it’s also important to note many of these consumer electronics also have a home in corporations: conferencing rooms etc.”