Ripple20 : The Set Of Vulnerabilities
 In 2020 a small cybersecurity research company has found a set of 19 vulnerabilities that originated from the Treck Internet Protocol library. The vulnerabilities have affected different manufacturers as it was used in their components.
Ripple 20
JSOF has declared information on a group of vulnerabilities known as Ripple20. They have the potential to impact millions of IoT devices across different industries. Some of them are delicate machines in the medical, transportation, manufacturing industries, etc. These vulnerabilities were seen in an American software Treck Inc. This software uses a lightweight TCP/IP stack and allows companies to connect their devices or software to the internet via TCP/IP connections. The software has been used by different manufacturers and because of this, the impact was widespread.
Read More: What Happened in the Twitter Attack?
Problems of Ripple20
Ripple 20 led the hackers to access vulnerable devices through local networks or over the internet and can take control of devices. One of the vulnerabilities is a DNS protocol where a hacker can attack devices that are not connected to the internet. Other possible attacks defined by JSOF, include the use of vulnerable devices to target other devices in a network, utilizing the vulnerable device to act hidden in-network, and broadcasting an attack to take control of all infected devices in the network, etc..Four of the Ripple20 vulnerabilities are critical, with CVSS (common vulnerability scoring system) scores over 9 and enable Remote Code Execution. Treck has released a security update addressing these vulnerabilities.
Read More
 Solutions against Ripple20
To avoid Ripple20 Vulnerabilities, detection is one of the major steps.
Products like EdgeIPSTM and EdgeFireTM can help owners find Ripple 20 vulnerabilities through network traffic scanning. Try to block abnormal IP traffic. The users take protective measures against these vulnerabilities by installing updates from Treck, minimizing network exposure, implementing firewalls, and using virtual private networks, and internal DNS servers.
Third-Party Vendor Security Risk Assessment Under DPDP: A Guide for Indian Enterprises
Key Takeaways: Third-party vendor risk assessment with DPDP practices helps Indian enterprises to verify that external partners handle personal data with adequate safeguards. The Digital Personal Data Protection Act holds data fiduciaries accountable for vendor conduct, which makes due diligence a legal and operational necessity. A structured vendor security questionnaire, covering encryption, access control, and […]
Virtual CISO Services for UAE Free Zone Startups: Affordable Security Leadership for Growing Companies
Key Takeaways: Most startups already hold sensitive data such as customer info, source code, financials, long before they feel big enough to take security seriously, and that’s exactly when the risk starts. A virtual CISO gets you someone who’s done this before, setting up strategy and guiding compliance, without the cost of putting a full-time […]
SOC as a Service for Indian BFSI and FinTech Companies: 24/7 Monitoring for CERT-In Readiness
Key Takeaways: SOC as a Service for BFSI and FinTech India gives banks, NBFCs, insurers and digital lenders continuous security visibility without the cost and hiring effort of building an in-house operations centre. CERT-In directions require regulated entities to report qualifying cyber incidents within six hours of detection, and implementing SOC for BFSI and FinTech […]
SOC as a Service in India: How It Works, Pricing, and Why Businesses Need ItÂ
Key Takeaways: SOC as a Service helps Indian businesses to get 24×7 security monitoring without huge cost and complexity of building a full in-house security operations center. A managed SOC check and analyse beyond basic log monitoring, which combining SIEM, threat intelligence, analyst-led alert triage, incident escalation, reporting, and security response support. SOC as a […]
Mobile App Security Testing for Indian Digital Lending Apps RBI, DPDP and API Risk Checklist
Key Takeaways: Mobile app security testing forms an important part of meeting RBI cybersecurity expectations, secure application development practices, and periodic security assessment requirements for digital lending platforms. APIs in lending apps are constantly under attack. Broken object-level authorization, data leaking where it shouldn’t, weak token validation, and missing rate limiting, these aren’t edge cases, […]
Cybersecurity Risk Assessment for Saudi Supply Chain Vendors Under Aramco and NCA ExpectationsÂ
Key Takeaways: Cybersecurity risk assessment becomes a practical requirement for proving security maturity, with protecting vendor relationships, and moving forward in procurement processes with Aramco and critical infrastructure clients. Vendors will need to provide evidence of access review documentation, patch deployment, monitoring artifacts, technical assessment results and more that demonstrates the controls in place are […]
