Bad law of series for industrial equipment manufacturer Bosch. Two products from the German multinational presented worrying computer vulnerabilities. As the cybersecurity company Bitdefender recently revealed, there was indeed a significant flaw in one of the manufacturer’s connected thermostats sold for a dozen dollars in North America.
This vulnerability, writes Bitdefender, allowed an attacker to replace the thermostat software with another malicious version. Discovered at the end of August 2023, the vulnerability, rated at a score of 8.3 out of 10, was corrected by Bosch in mid-November, according to the timeline established by Bitdefender. A chip in the device could not distinguish genuine messages from other malicious messages sent from the cloud server, allowing a fake update version to be transmitted.
Wrench
An unwelcome kind of attack in winter. But the damage from such a hack goes beyond the loss of control over its heating. Theoretically, the hacked thermostat could in fact be diverted for malicious attacks via a botnet, for example to carry out denial of service attacks, the Mirai malware being one of the illustrations of this type of campaign. It could also turn into spyware, serving as an intermediary for an attack on other, more sensitive terminals, such as a phone or computer.
A Bosch wrench
A few days earlier, the company Nozomi Networks had revealed around twenty vulnerabilities, some of which were very critical, on another of the multinational’s products, one of its connected bolters.
Researchers from this cybersecurity company thus succeeded in installing ransomware on this tool used in the automobile industry, a malicious operation which could severely hamper a production line.
Flaws in the web application
Likewise, they managed to manipulate the bolting application, making this operation dangerous for operators and for the reliability of the manufactured product. “The majority of vulnerabilities identified affected the management web application,” reports Nozomi Networks.
Concretely, an unauthenticated attacker could trigger the remote execution of arbitrary code, with a high level of privilege, allowing the tool to be completely compromised. According to Nozomi Networks, the connected bolter should be patched by the end of January.
The scenario of a ransomware attack against connected bolters appears unlikely. Ransomware gangs have no shortage of leverage to harm a target. However, this type of maneuver should not be taken lightly: it could indeed interest hacktivists or state groups for sabotage purposes, as the Stuxnet affair reminds us.