Skip to main content

Metal Detector Hack- Walk-Through Metal Detectors Can Be Hacked Remotely

A number of security flaws have been uncovered in a networking component in Garrett Metal Detectors that could allow remote attackers to bypass authentication requirements, tamper with metal detector configurations, and even execute arbitrary code on the devices.

"An attacker could manipulate this module to remotely monitor statistics on the metal detector, such as whether the alarm has been triggered or how many visitors have walked through," Cisco Talos noted in a disclosure publicized last week. "They could also make configuration changes, such as altering the sensitivity level of a device, which potentially poses a security risk to users who rely on these metal detectors."

Talos security researcher Matt Wiseman has been credited with discovering and reporting these vulnerabilities on August 17, 2021. Patches have been released by the vendor on December 13, 2021.

The flaws reside in Garrett iC Module, which enables users to communicate to walk-through metal detectors like Garrett PD 6500i or Garrett MZ 6100 using a computer through the network, either wired or wirelessly. It allows customers to control and monitor the devices from a remote location in real-time.

The list of security vulnerabilities is below –

  • CVE-2021-21901 (CVSS score: 9.8), CVE-2021-21903 (CVSS score: 9.8), CVE-2021-21905, and CVE-2021-21906 (CVSS scores: 8.2) - Stack-based buffer overflow vulnerabilities that can be triggered by sending a malicious packet to the device
  • CVE-2021-21902 (CVSS score: 7.5) - An authentication bypass vulnerability stemming from a race condition that can be triggered by sending a sequence of requests
  • CVE-2021-21904 (CVSS score: 9.1), CVE-2021-21907 (CVSS score: 4.9), CVE-2021-21908, and CVE-2021-21909 (CVSS scores: 6.5) – Directory traversal vulnerabilities that could be exploited by sending specially crafted commands

Successful exploitation of the aforementioned flaws in iC Module CMA version 5.0 could allow an attacker to hijack an authenticated user's session, read, write, or delete arbitrary files on the device, and worse, lead to remote code execution.

In light of the severity of the security vulnerabilities, users are highly recommended to update to the latest version of the firmware as soon as possible.

Comments

Post a Comment

Popular posts from this blog

10 Fun Linux Command-Line Programs You Should Try When Bored

The Linux terminal is a powerful utility. You can use it to control the whole system, crafting and typing commands as you go about doing your everyday tasks. But it can quickly become overwhelming to keep staring at a command line and carry on with your work. Lucky for you, the terminal is also a source of fun. You can play around with commands, listen to music, and even play games. Although expecting a great deal of entertainment from a window full of commands would be carrying it too far, you can find utilities to bind some time when bored. Here are some fun and entertaining commands every Linux user should try at least once. 1. CMatrix Starting off the list with a fun tool every Linux user loves, CMatrix is a command-line utility that generates the classic "The Matrix" animation from the popular movie franchise of the same name. You can expect to see some great animations in different colors that you also get to customize. Albeit CMatrix uses regular fonts instead of the o...
Post a Comment
Read more

OpenSubtitles Hacked, 7 Million Subscribers' Details Leaked Online

OpenSubtitles, one of the largest repositories of subtitle files on the internet, has been hacked. Founded in 2006, the site was reportedly hacked in August 2021 with the attacker obtaining the personal data of nearly seven million subscribers including email and IP addresses, usernames and passwords. The site alerted users yesterday after the hacker leaked the database online. OpenSubtitles is one of the largest and most popular subtitle repositories on the Internet. Millions of subtitle files are downloaded every week in many languages, often to be paired with downloaded movies and TV shows. The site was founded in 2006 by a Slovakian programmer who came up with the idea while drinking a few beers at a local pub. Following an announcement late yesterday, more beers might be needed to cope with an emerging crisis. OpenSubtitles Hacked, Millions of Subscribers’ Details Exposed In a post to the OpenSubtitles forum, site administrator ‘oss’ reveals that the site – which h...
Post a Comment
Read more

Teachers Hacked- Hackers steal $500 to $2,500 from teachers

An investigation is on after bank accounts of Filipino teachers were reportedly hacked by a still unknown group, the Land Bank of the Philippines and the Department of Education (DepEd) said on Monday (January 24, 2022). State-owned Land Bank of the Philippines (also known as Landbank) said the Filipino teachers whose bank accounts were hacked lost money via “phishing”. The bank, however, said its system is safe. It was not immediately clear how many teachers were hit by the latest online heist. “According to the initial investigation by Landbank, the devices of the teachers were hacked via phishing, which compromised their personal information,” the bank said in a statement. “The bank has already reached out to the affected customers and is working on the resolution of these isolated cases at the soonest possible time,” it added. The state-owned Landbank is the official depository bank of the Philippine government. The teachers are the latest victims of rising online scams...
Post a Comment
Read more