Smartphones, watches, televisions and fitness trackers could be used to hold people to ransom over personal data, cyber security experts have warned. The risk to business is “significant and growing”, the National Crime Agency and National Cyber Security Centre say. IT security experts from Trustwave, TrapX, SentinelOne, Avast, (ISC)², MWR InfoSecurity, Thales e-Security, Axians UK, Imperva, DomainTools, Tenable, AlienVault, EclecticIQ and Cylance commented below.
Lawrence Munro, Security Specialist at Trustwave:
Mobile devices are an increasingly popular target as users tend to pay less attention to emails and links, and many users aren’t aware of their devices can be infected with malware.
All connected devices are still essentially computers and therefore potentially vulnerable to attack, although it is worth noting that only connected devices with screens would actually be able to convey a ransom message to the victim. However, they pose a much greater risk for secondary infections, passing on ransomware and other malware to more traditional devices they are connected to.
The most effective way to combat ransomware is to keep all data regularly backed up, and ensure all devices are kept patched and up-to-date. Connected devices should be kept on a separate network to main enterprise, with an airgap preventing any infections from crossing over.”
Kevin Eley, VP EMEA at TrapX:
Our own research, highlighting the medical and healthcare industry, identified such dangers relating to connected medical devices (see Medjack http://deceive.trapx.com/rs/929-JEW 675/images/AOA_Report_TrapX_MEDJACK.2.pdf) It stands to reason that criminals will seek to exploit other connected devices (whether business or consumer) to steal personal information or for ransom. The ultimate motivation primarily being financial gain. It is important that government and industry recognise these threats and work together to rapidly mitigate them.”
Tony Rowan, Chief Security Consultant at SentinelOne:
Peter Turner, Security Expert at Avast:
Between October 2015 and June 2016 at AVG, an Avast company, we detected 20,044,360 ransomware threats globally. Given that each attack on average demands a 1 bitcoin ransom (with an average monetary value of around $500 during this time period), we saved consumers and businesses globally at least $10,022,180,000 worth in ransom payments by preventing such attacks. Based on our long-term statistics, we save at least one device from a ransomware attack every single second.
Consumer and businesses can help to protect themselves against ransomware by ensuring they have the latest digital security installed and ensuring they maintain their devices by keeping all apps and programmes up to date. They also need to be vigilant about not opening suspicious emails and attachments or downloading software from unauthorised sources which may not be official and could contain ransomware. Observing simple rules and being smart about what we do online are all important defences against ransomware.”
Dr. Adrian Davis, Managing Director, EMEA at (ISC)²:
Robert Miller, Head of Operational Technology at MWR InfoSecurity:
As a result, end-users are finding themselves in a quandary when it comes to advice being issued by the NCA and NCSC. Some devices have well designed and effective security measures that would prohibit all but the most determined of attackers, whereas others have flaws that expose their owners to considerable risk. What is more concerning is manufacturers using phrases like “military grade encryption”, ignoring the fact that this wouldn’t stop the most likely forms of attack (such as using hardcoded credentials). Consumers often don’t understand that in most instances it is not the devices’ assumed weak encryption being leveraged in a compromise. As the Mirai malware showed us, there are devices sold today that are accessible over the Internet and compromised and controlled with just a few lines of code.
With the success of the business model at the core of ransomware being proven as being very profitable and reasonably anonymous, this is fueling its growth. Attackers have realised that the key issue is not how valuable ransomed data are to sell on underground markets, but rather how valuable they are to the affected end-users or organisations and their appetite to losing the encrypted data.
It is therefore important that manufacturers of these devices stop seeing security as a burden to their development, but rather as a value that can benefit their customers. Given the likely PR nightmare that some manufacturers will face following ransomware attacks, it will be the companies that take security seriously that will gain the advantage in this competitive new market. Manufacturers should realise the value of using customer data security as a selling point.
In the meantime, customers will need to seek out signs that a manufacturer is taking security seriously. Does the product guarantee updates when security issues are found? Is there a place on their website to report security incidents? Do they offer a bug bounty program to promote security research? In lieu of a stamp of approval for IoT security, consumers will have to look for these indicators of maturity if they wish to avoid this new line of cyber-attack.”
Peter Carlisle, VP EMEA at Thales e-Security:
Our recent research found that one third of healthcare organisations now use IoT devices to store patient data, so it’s no surprise that hackers see this as an opportunity to breach security to steal patient data. This threat cannot be underestimated, leading to life-threatening consequences if medical devices are hacked and shutdown.
To tackle this threat before it takes hold, organisations must train employees to improve their cyber security skills whilst implementing a robust encryption policy to protect critical data from malicious attacks.”
Ian Parker, Professional Services Consultant at Axians UK:
A notable obstacle to security is that some companies that want to use network-controlled devices are not technology aware.Approximately 50 per cent of employees think that their IT department (if they have one at all) is not aware of all the company’s connected devices, and around 70 per cent perceive their organisation as being at risk from a connected device related security issue. It has been predicted that 20 billion connected devices will be in circulation by 2020, so the problem must be addressed and rectified before it gets out of control and risks global security.
Potentially all these devices, if not secured, are open doors for any malicious organisations or individuals to gain access to internal networks or the device itself. Once a hacker has access to a device, it can be used to attack a targeted company in a DDoS attack, or they may even be able to hack into the internal network devices, leading to full control of your business environment. Or more menacingly, they could be a cybercriminal, part of an organisation whose sole purpose is to obtain money via ransom, credit card theft and identify theft.
In short, IoT is only as secure as you make it. In today’s market, you cannot rely on manufacturers to produce a network-controlled device with security at the forefront. Unless the IoT device is a security device in itself, the manufacturers will want to make it as cost-effective as possible with a quick production cycle. Security, on the other hand, is time consuming, costs money and is not widely understood.
It is therefore up to the business to ensure these devices – which are essentially remote controls for the world to operate – are secure and remain accessible by authorised personnel and devices only. They can do this by seeking advice and expertise from professionals that are aware of the risks and vulnerabilities as well as the mitigation and prevention methods.”
Amichai Shulman, CTO and Co-Founder at Imperva:
Having said that, the true limitation for ransomware expansion today is distribution channels. In this domain IoT device do represent a threat to users and enterprises (and a growth opportunity for attackers). By compromising many IoT devices, attackers can (physically) make their way into more home and enterprise networks and use the compromised devices as a jumping board for attacks – including the distribution of ransomware to end stations and servers alike.”
Kyle Wilhoit, Senior Security Researcher at DomainTools:
One of the more concerning scenarios would be an ICS or SCADA network getting compromised by ransomware. While this has happened on a few different occasions, the victim was not targeted because of the importance of the connected devices. These were opportunistic infections, ultimately causing outages to PLC’s and SCADA environments, all because ransomware took over several hosts. So, regardless of the ransomware being targeted or not, these infections will cause outages…Possibly severe. ”
Gavin Millard, EMEA Technical Director at Tenable Network Security:
.
.Chris Doman, Security Researcher at AlienVault:
So far the only malware for fitness trackers I’ve seen are proof of concepts, and the same with thermostats.
Given many of these devices run standard versions of the Android operating system – they would likely be as susceptible to these attacks as a typical Android phone. However they may be less likely to encounter the attacks if users are rarely accessing the internet with them.
It’s certainly true these devices can record sensitive information. And it’s not only the devices themselves that could be compromised. A central database at a toy company was hacked in 2015, and in the process lost millions of photos taken by kids toys to hackers.”
Javvad Malik, Security Advocate at AlienVault:
We’ve seen proof of concept ransomware deployed against thermostats, but haven’t yet seen them myself against smart watches.
One of the key things to bear in mind is how easy IoT devices are to secure, for example, is it easy to change default credentials or disable insecure and unnecessary protocols.
Equally, it’s important to evaluate the recovery process. Something manufacturers can help with by building into their products, so that if it does fall victim to ransomware, it can be restored. Many devices can have factory settings reset with one click, while others may require manufacturer involvement. Worse yet, in some cases, recovery may be impossible, forcing users to pay the ransom as a last resort. It’s up to buyers to understand the recovery process for the devices they own, and to create a contingency plan should one of them be compromised.”
Joep Gommers, CEO at EclecticIQ:
“Openness is key to establishing trust. As such, support for open source standards like STIX and TAXII need to sit at the core of the fight for true threat intelligence. However, the use of these standards and the exchange of intelligence often is still very much a conscious effort and not yet a default modus operandi – like recycling, a practice that was once ignored and then slowly adopted, is now commonplace and assumed. One organisation’s reactive, becomes another’s proactive.
“Transparency is vital to success in business and embracing a stance of openness cannot only improve a business’s view of cyber threats, but can also fuel a wider cyber intelligence revolution. Only if organisations and government departments work collaboratively do we stand a chance of getting one step ahead of the bad guys.”
Zach Lanier, Research Director at Cylance:
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.