August 11, 2015 By Douglas Bonderud 2 min read

Predictions made about the Internet of Things (IoT) now loom large. Soon, almost any device will be a viable candidate for network implementation, allowing companies to collect a host of data across thousands of interconnected machines. But no technology is without risk, and IoT-enabled devices have been targeted by malware. As noted by Naked Security, past targets range from Jeep Cherokees to Bluetooth-enabled skateboards. Now, malware creators have upped the ante with a ransomware-based attack on wearable devices. Is locking down user lives the next step for infected code?

IoT Threats Are Not Surprising

A December 2014 blog entry from Threatpost made it clear that this kind of IoT-based ransomware wasn’t entirely unexpected. Dino Dai Zovi, the hacker-in-residence at the New York University Polytechnic School of Engineering, argued that “we are going to see ransomware scale well in the Internet of Things.”

As part of a panel on cybercrime outlook through 2020, Dai Zovi and other experts argued that there’s a real future for vehicle-based ransomware, which would see cars kept locked unless drivers were willing to pay in bitcoin. While no real-life vehicular lock-downs have happened yet, CSO Online reported that researchers have now repackaged Android ransomware to work on Android Wear.

Using the Android.Simplocker malware, a team from Symantec was able to infect an Android-based smartphone as well as the linked smartwatch. The result? Both devices were rendered useless, and files on the watch’s SD card were encrypted. In other words, the proof of concept functioned just like typical ransomware but with a potentially larger reach — imagine the havoc if smart TVs refused to change channels or fridges demanded bitcoin payments to keep food cold. Fortunately, there have been no reports of IoT ransomware in the wild, but given the kind of tanker-sized network holes present in many new device rollouts, it’s only a matter of time.

Breaking the Bank

Is it possible to defend against this kind of attack? The short answer is no. Since phones and wearables are intended to sync smoothly and seamlessly, any updates — or malicious files — are pushed automatically to both devices, making it almost impossible to stop the spread of ransomware across a personal area network (PAN). There is some good news, however: According to Symantec researcher Kevin Savage, malware tends to rise and fall in two-year cycles, which suggests that “crypto ransomware growth is already at, or close to, its peak. This means it may soon plateau before finally entering a declining phase.”

What’s more, cybersecurity expert and Security Intelligence contributor Engin Kirda said that ransomware may be easier to defeat than previously thought. For example, Kirda found that 61 percent of ransomware apps only affected desktops, while just 35 percent actually deleted files and just 5 percent used encryption. More dangerous versions of ransomware such as Cyptolocker and Cryptowall, meanwhile, leverage encryption algorithms built into Windows, meaning it should be possible for virus tools to monitor selected behaviors like access to encryption libraries.

As tech giants push new wearable devices to market and make syncing these devices with existing smartphones ever more seamless, malware creators are looking for fresh avenues of attack. And while “ransomwear” may be the next trend for malicious actors, there’s hope it will fall quickly out of fashion as other opportunities knock and detection tools improve their rate of discovery.

More from

White House cements CISA’s role as national coordinator for cybersecurity

2 min read - In 2013, the Obama Administration rolled out "The Presidential Policy Directive (PPD) on Critical Infrastructure Security and Resilience", a forerunner to the Cybersecurity and Infrastructure Security Agency (CISA), created "to strengthen and maintain secure, functioning and resilient critical infrastructure."The directive was groundbreaking in 2013, noting the importance of the rising risk of cyberattacks against critical infrastructure. But as cyber risks are constantly shifting, every cybersecurity program needs to be re-evaluated, and CISA is no exception. That’s why, in April 2024, President…

How a new wave of deepfake-driven cybercrime targets businesses

5 min read - As deepfake attacks on businesses dominate news headlines, detection experts are gathering valuable insights into how these attacks came into being and the vulnerabilities they exploit.Between 2023 and 2024, frequent phishing and social engineering campaigns led to account hijacking and theft of assets and data, identity theft, and reputational damage to businesses across industries.Call centers of major banks and financial institutions are now overwhelmed by an onslaught of deepfake calls using voice cloning technology in efforts to break into customer…

Grandoreiro banking trojan unleashed: X-Force observing emerging global campaigns

16 min read - Since March 2024, IBM X-Force has been tracking several large-scale phishing campaigns distributing the Grandoreiro banking trojan, which is likely operated as a Malware-as-a-Service (MaaS). Analysis of the malware revealed major updates within the string decryption and domain generating algorithm (DGA), as well as the ability to use Microsoft Outlook clients on infected hosts to spread further phishing emails. The latest malware variant also specifically targets over 1500 global banks, enabling attackers to perform banking fraud in over 60 countries…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today