SecurityBrief Asia logo
Asia's leading source of cybersecurity and cyber-attack news
Story image

Stopping the Ransomware of Things in its path

FYI, this story is more than a year old

One of the trends that I found most worrying in 2016 was the willingness of some individuals to participate in the following three activities: holding computer systems and data files hostage (ransomware); denying access to data and systems (Distributed Denial of Service or DDoS); and infecting some of the devices that make up the Internet of Things (IoT).

Sadly, I think these trends will continue to evolve in 2017 and there is potential for cross-pollination as they do so. For example, using infected IoT devices to extort commercial websites by threatening a DDoS attack, or locking IoT devices in order to charge a ransom – something I like to call “jackware”.

Past and future threats

Abusing information systems to extort money is almost as old as computing itself. Back in 1985, an IT employee at a US insurance company programmed a logic bomb to erase vital records if he was ever fired. Two years later he was – and, accordingly, the bomb erased the records, leading to the first conviction for this type of computer crime.

Malware that used encryption to hold files for ransom was identified in 1989, as David Harley has recounted. In 2011, my colleague Cameron Camp described locking computers for a ransom as “stooping to new lows”.

So how might these elements evolve or merge in 2017? Some people have been referring to 2016 as “The Year of Ransomware” and I'm concerned 2017 could be dubbed “The Year of Jackware”.

Think of jackware as malicious software that seeks to take control of a device, the primary purpose of which is neither data processing nor digital communications.

A good example is a “connected car”, as many of today's latest models are described. These cars perform a large amount of data processing and communicating, but their primary purpose is to get you from A to B.

So think of jackware as a specialized form of ransomware. With regular ransomware, such as Locky and CryptoLocker, the malicious code encrypts documents on your computer and demands a ransom to unlock them. The goal of jackware is to lock up a car or other device until you pay up.

Picture this: on one particularly cold and frosty morning I use the car app on my phone to remote start my car from the comfort of the kitchen, but the car does not start.

Instead I get a text on my phone telling me I need to hand over X amount of digital currency to re-enable my vehicle. This is what jackware could look like from a victim's point of view. Fortunately, and I stress this: jackware is, as far as I know, still theoretical. It is not yet “in the wild”.

It's not easy to prevent jackware being developed and deployed; especially considering previous examples. We have already seen that a car company can ship more than a million vehicles containing vulnerabilities that could have been abused for jackware: take the Fiat Chrysler Jeep problem that was all over the news in 2015.

An equally serious case was Fiat Chrysler Automobiles' (FCA) apparent lack of planning for vulnerability patching in the vehicle design process.

It is one thing to ship a digital product in which ‘holes' are later discovered – in fact, this is pretty much inevitable – but it is a different and more dangerous thing to ship digital products without a quick and secure means of patching those holes.

While most “car hacking” research and discussion centers on technical issues within the vehicle, it is important to realize that a lot of IoT technology relies on a support system that extends well beyond the device itself. We saw this in 2015 with VTech, a player in the Internet of Children's Things (IoCT) space.

Weak security on the company's website exposed personal data about children, reminding everyone just how many attack surfaces the IoT creates.

We also saw this infrastructure issue in 2016 when some Fitbit accounts had problems (to be clear, the Fitbit devices themselves were not hacked, and Fitbit seems to take privacy seriously).

Also this year, bugs were discovered in the online web app for BMW ConnectedDrive, which connects BMWs to the IoT. You can use the BMW ConnectedDrive to regulate your home's heating, lights, and alarm system from inside your vehicle.

The possibility that the features and settings of an in-vehicle system could be remotely administered through a portal that could be hacked is unsettling to say the least. And reports of vehicular cyber-insecurity keep coming, like this Wi-Fi enabled Mitsubishi, and hacked radios used to steal BMWs, Audis, and Toyotas.

While I originally thought of jackware as an evolution of malicious code targeting vehicles, it was soon clear that this trend could manifest itself more broadly – think “the Ransomware of Things (RoT)”. A chilling story from a city in Finland indicates one direction that this might take (DDoS attack halts heating in Finland in winter).

While there was no indication of ransom demands in the reports, it does not take much imagination to see this as the next step. Want us to stop DDoSing the heating system? Pay up!

To stop the IoT becoming home to the RoT, a number of things need to happen; in two different spheres of human activity. First is the technical sphere, where the challenge of implementing security on a vehicular platform is considerable.

Traditional security techniques like filtering, encrypting and authenticating can consume costly processing power and bandwidth, adding overhead to systems, some of which need to operate with very low latency.

Security techniques like air-gapping and redundancy could potentially contribute significantly to increasing costs of vehicles. And we know that controlling costs has always been critical to car manufacturers, down to the last dollar.

The second sphere in which action against the RoT should be taken is policy and politics. There has been a collective international failure to prevent a thriving criminal infrastructure evolving in cyberspace; one that now threatens every innovation in digital technology you can think of, from self-driving cars to drones; from big data to telemedicine.

For example, as alluded to in Challenges and Implications of Cybersecurity Legislation, concerned politicians failed to pass legislation in 2016 that would help secure the smart grid, despite bipartisan support.

To be clear, terms like RoT and jackware are not intended to cause alarm. They symbolize things that could come to pass if we do not do enough in 2017 to prevent them from becoming a reality. So let me end with some positive developments.

First, a variety of government agencies are stepping up their efforts to make the IoT more secure. In 2016 we saw the publication of the Strategic Principles for Securing the Internet of Things from the US Department of Homeland Security, and the NIST Special Publication.

The full title of the latter is Systems Security Engineering Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems. NIST is the National Institute of Standards and Technology, part of the US Department of Commerce, and over the years the agency has exerted a positive influence on many aspects of cybersecurity.

Hopefully, these efforts – and the many others around the world – will help us make progress in 2017, working towards the goal of securing our digital lives against those who choose to abuse technology to extort us.

Finally, evidence that we might be making some progress – at least in terms of public awareness of the IoT's potential to bring problems as well as perks and productivity gains – comes from a different kind of publication: the results of an ESET consumer survey.

Reported under the title of “Our Increasingly Connected Digital Lives” the survey revealed that more than 40% of American adults were not confident that IoT devices are safe and secure. Furthermore, more than half of respondents indicated that privacy and security concerns had discouraged them from purchasing an IoT device.

Related stories
Top stories
Story image
Malware
Decrease in malware volume, but surge in encrypted malware 
The Q2 Internet Security Report found office exploits continue to spread more than any other category of malware.
Story image
Cloud Security
75% of AU companies had cloud security incident in past year
According to new Venafi research, complexity is due to increase, as companies plan to host more applications in the cloud.
Story image
Work from home
Jamf showcases new products to simplify and secure work
At the 13th annual Jamf Nation User Conference, the company shared how its continuous product innovation is helping organisations succeed with Apple.
Story image
Ransomware
Delinea updates DevOps security, remote access more seamless
New enhancements include development support on the most recent Mac computers and improved secrets' management usability through automation.
Story image
Network Management
Fortinet introduces enhanced AIOps across its gateways
FortiAIOps builds on Fortinet's rich history of developing artificial intelligence to deliver actionable network insights for self-optimising management.
Story image
Kaspersky
Cybersecurity loopholes prevalent in South East Asia
In terms of the share of vulnerabilities with publicly available exploits, three countries out of top five are located in Southeast Asia.
Story image
Cloud
How modern IT architectures are moving beyond network visibility
Dealing with multiple cloud providers makes it difficult to identify security threats and performance bottlenecks and troubleshoot issues.
Story image
IT Training
Six ways to transform your cybersecurity training and influence lasting change
If the goal is to win hearts and minds, formal awareness training can fall short and often doesn’t inspire people to care.
Story image
Observability
Virtualisation Security Market to reach over $7 billion by 2032 - report
A new report from Future Market Insights has found that the Virtualisation Security Market is anticipated to reach a valuation of US $7.6 billion.
Story image
Cybersecurity
Video: 10 Minute IT Jams - An update from SearchInform
Val Novoselova joins us today to to discuss new trends in the information security space, and how SearchInform is adapting to some of the new trends we are seeing.
Aws Marketplace
Learn how to implement a backup and recovery plan for a new generation of Kubernetes-based modern applications
Link image
Story image
Cybersecurity
Ransomware attacks continue to increase, report finds
Nearly a quarter of businesses have suffered a ransomware attack, with a fifth occurring in the past 12 months.
Story image
Cloud Security
CrowdStrike launches new partner program to expand routes to market
"We developed the CPSP program in partnership with GSIs, MDR vendors, MSPs, MSSPs and Telcos to ensure we were meeting their needs and empowering them."
Story image
Artificial Intelligence
Ordr improves security and management of connected devices
It has implemented more than 80 integrations within the Ordr Data Lake while adding security enhancements to accelerate zero trust segmentation.
Story image
Cybersecurity
Kaspersky updates endpoint detection and response solution
"One of the goals was to make all the solutions capabilities accessible for all types of our users, even those who are making their first steps in EDR."
Story image
Cybersecurity
StackHawk launches deeper API security test coverage
Expansion of test coverage includes custom scan discovery, custom test scripts and custom test data for REST APIs.
Story image
Secure Code Warrior
Secure Code Warrior announces Coding Labs innovation
Coding Labs mechanisms allow developers to move from learning to applying secure coding knowledge more efficiently, leading to fewer code vulnerabilities.
Story image
IoT security
Nozomi Networks and WALLIX strengthen OT network security
By combining WALLIX and Nozomi Networks solutions, end-to-end visibility and traceability for maximum security in an industrial environment is provided.
Story image
Malware
Kaspersky uncovers new malicious malware NullMixer
Kaspersky researchers have uncovered a new malware stealing users credentials, address, credit card data, cryptocurrencies, and accounts.
Story image
Enterprise
Delinea shares the importance of PAM, partners and security for modern enterprise
Identity-based security is becoming a crucial tool for modern enterprises as they continue to adapt to different working environments.
Story image
Cryptocurrency
Crypto giveaway scams continue to soar, according to report
There's been a fivefold increase in the number of domains used for crypto giveaway scams that involve fake YouTube streams in the first half of 2022. 
Story image
Cybersecurity
Confidence in security challenges of hybrid work improving
84% of IT professionals have some degree of confidence in their user access security systems to enable remote work securely and easily, up from 56% in 2021.
Story image
Software-as-a-Service
Enterprises yet to fully commit to cybersecurity - CompTIA
“Digital transformation driven by cloud and mobile adoption requires a new strategic approach to cybersecurity, but this poses significant challenges."
Story image
Data Protection
Cloudflare brings Data Localisation Suite to more APAC businesses
This allows any business in these countries to service their data locally while benefiting from the speed, security, and scalability of Cloudflare’s global network.
Story image
Cybersecurity
Test your API Security with Infinite API Scanner
The effectiveness of API scanning technology can mean the difference between successful and unsuccessful programming outcomes, and often enterprises and IT leaders struggle to get it right.
Story image
Cybersecurity
De-risking the innovation cycle – a modern, real-time approach to security
Many organisations see cybersecurity as an inhibitor of innovation, with burdensome protection measures standing in the way of progress and speed.
Story image
Threat intelligence
Trellix advances threat intelligence with new research centre
Trellix has announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Story image
Security vulnerabilities
Claroty finds seven vulnerabilities in Dataprobe iBoot-PDU
The Claroty research team (Team82) has found seven vulnerabilities in Dataprobe's iBoot-PDU, the company's intelligent power distribution unit product.
Story image
Cybersecurity
Hands-on review: Yubikey 5C NFC
Founded in 2007 and specialising in computer and network security, the Swedish company Yubico is now a leader in global authentication.
Story image
Malware
Cybereason delivers nation-state level of protection to enterprises
Cybereason has announced new advancements in Cybereason NGAV that deliver nation-state level protection for organisations of all sizes.
Story image
Malware
SonicWall threat report mid-year update highlights significant threat variance
The 2022 SonicWall Cyber Threat Report mid-year update from SonicWall gives an in-depth insight into many of the current trends across the threat landscape.
Story image
Virtual Private Network
95% of organisation rely on VPN as threats continue - report
There is a growing number of VPN-specific security threats and a need for Zero Trust security architecture in enterprise-level organisations.
Story image
Ransomware
Absolute recognised in KuppingerCole Leadership Compass 2022
The company's Absolute Secure Access was recognised for its ability to protect users and resources while improving the remote worker experience.
Story image
Firewall
Barracuda tackles intensified threat landscape with latest releases
"The Barracuda XDR solution combines data across our security stacks through a single dashboard view, giving us the visibility we need."
Story image
Cybersecurity
Aqua Security solution to stop software supply chain attacks
Development and security teams can now proactively address the most critical software supply chain risks from code through runtime.
Story image
Phishing
Vectra Protect team finds Microsoft Teams vulnerability
The Vectra Protect team identified a post-exploitation opportunity in August, allowing malicious actors to steal valid user credentials from Microsoft Teams.
Story image
Cybersecurity
Employees unsure who to go to to report security incident
A new study shows more than 20% of the untrained global workforce do not know who to contact during a security breach.
Story image
Edge Security
Security practices for modernising the “spaghetti” of on-premises IT
Many organisations are wondering how to securely modernise their workload, often made up of a “spaghetti” of on-premises applications and management consoles.
AWS Marketplace
Whitepaper: A practical guide for mitigating risk in today’s modern applications
Link image
Story image
Ransomware
Commvault unveils early warning system, Metallic ThreatWise
A first among data protection vendors, the new cyber deception service detects and contains ransomware threats.
Story image
Cybersecurity
Macroeconomic headwinds driving security up priority list
Current macroeconomic headwinds are driving security up enterprise’s priority list and reshaping the hardware Security Module market.