Telecrane’s cranes have an IoT security flaw that could allow hackers to take over control of the equipment.
Threatpost is reporting the discovery of yet another IoT device vulnerability. Dubbed the Telecrane flaw because it mostly affects their connected construction cranes, it could allow hackers to intercept its communications and take control of the equipment.
Telecrane’s F25 series uses a connection to the internet to help the operator control the crane’s movements.
“It’s not uncommon for the crane to not have line-of-sight view to the ‘landing spot’ and a remote controller to be there guiding the load down,” he wrote. “Bluetooth won’t work. You might be able to set up a local network but, given that there might be a big building in the way, that probably won’t work either. So the next option is to use a 3G or 4G phone connection to the web from the controller to the crane. A wired connection would be difficult as well,” explained a blog post on Bruce Schneier’s security website.
The Telecrane flaw, dubbed (CVE-2018-17935) is considered an “authentication bypass by capture-replay” by compromising transmission mechanism that connects the two pieces of hardware that enable the crane to “talk” to the controller in the operator cockpit. It intercepts those transmissions, edits them to its liking and then uses them to take control of the crane. It is basically a “man in the middle” style attack.
The security flaw has been assigned a “serious” CVSS v3 score of 7.6, and US-CERT categorized it as a basic attack not requiring advanced skills. Telecrane addressed the problem in their latest firmware update, but it’s up to construction companies to obtain and install it.
While there have been no known actual attacks, security officials urge construction companies to keep their crane’s firmware up to date, use VPNs to protect their data, and minimize the network exposure of all control devices.