IoT ransomware has been mentioned and discussed on a few occasions, including at recent conferences, but has not been given serious consideration because it is being examined in the same light as the more traditional breed of malware.
Famous brands of ransomware such as Cryptowall and CTB-Locker are aimed at finding and locking valuable files on targeted machines. Aside from their anonymity, their main strength is their irreversibly — victims have no other choice than forking over the ransom money if they want to regain access to their file. IoT ransomware has the opportunity to control systems in the real world, beyond just the computer,” says Neil Cawse, CEO at Geotab, a manufacturer of IoT and telematics for vehicles. “In fact, due to the many practical applications of IoT technology, its ransomware can shut down vehicles, turn off power, or even stop production lines. This potential to cause far more damage means that the potential for hackers can charge much more, ultimately making it an appealing market for them to explore.”
The correct use of IoT ransomware hinges on being timely and critical, not on being irreversible. The entire point is to strike at the target at a time and place where they won’t be able to reset the device or counter the effects of the ransomware and will be more willing to pay the ransom.
So instead of looking for valuable files on your Nest Thermostat, hackers will lock it up with ransomware while you’re away on vacation and send you a notification to tell you that your smart home has been hacked and you either have to pay a ransom or the thermostat gets locked at a high temperature. By the time you fly back home to disable or reset the thermostat, your home will get fried, and if not, you’ll have to settle for the huge electricity bill that will come at the end of the month because of the active use of the appliance.
In the connected car industry, hackers will track you down and hack your car while you’re on a desert highway, with no means to fix the problem on your own and no access to service centers. Then you’ll be forced to either cooperate with the hackers or hitchhike your way to the nearest city to get help.
In industrial IoT, things can get even nastier. Imagine a hacked power grid (and these things do happen). The hackers won’t give you 48 or 72 hours to hand over the cash, as is the case with traditional ransomware. They’ll give you 30 or 45 minutes turn over bitcoins. And after that, it’ll be total blackout.
Medical IoT can become an attractive target for ransomware as well. Your pacemaker or drug infusion pump in the control of hackers can be a dangerous situation. How about handing over a bitcoin or seeing your heart skip a beat?
Graham Cluley, commenting on the ESET blog, claims the threat is not far-fetched, but brings up an interesting question: If ransomware targets medical devices, exactly how will an attacker deliver the ransom note to the victim? Indeed, laptops, tablets, phones, and other devices have screens, but pacemakers don’t, meaning this kind of attack will require multiple stages. A “smart” pacemaker will probably be controlled by a computer or phone, so the attacker will need to go through these steps: first, hit a device with a display screen; second, perform additional reconnaissance and determine whether it has any IoT devices connected to it; third, lock the IoT devices found; and then finally, pop a ransom note to the user of that computer or phone.
The IoT ransomware model is fundamentally different from the computer and laptop paradigm, but no less dangerous. It is only a matter of time before hackers decide it’s worth their time and try their hand at hacking IoT devices for ransom. This is another reminder of the cyber-security trade-offs that IoT poses on consumers. What’s important is that we keep our vigil and stay prepared to protect ourselves and our devices against such attacks
No comments:
Post a Comment