Predictions made about the Internet of Things (IoT) now loom large. Soon, almost any device will be a viable candidate for network implementation, allowing companies to collect a host of data across thousands of interconnected machines. But no technology is without risk, and IoT-enabled devices have been targeted by malware. As noted by Naked Security, past targets range from Jeep Cherokees to Bluetooth-enabled skateboards. Now, malware creators have upped the ante with a ransomware-based attack on wearable devices. Is locking down user lives the next step for infected code?
IoT Threats Are Not Surprising
A December 2014 blog entry from Threatpost made it clear that this kind of IoT-based ransomware wasn’t entirely unexpected. Dino Dai Zovi, the hacker-in-residence at the New York University Polytechnic School of Engineering, argued that “we are going to see ransomware scale well in the Internet of Things.”
As part of a panel on cybercrime outlook through 2020, Dai Zovi and other experts argued that there’s a real future for vehicle-based ransomware, which would see cars kept locked unless drivers were willing to pay in bitcoin. While no real-life vehicular lock-downs have happened yet, CSO Online reported that researchers have now repackaged Android ransomware to work on Android Wear.
Using the Android.Simplocker malware, a team from Symantec was able to infect an Android-based smartphone as well as the linked smartwatch. The result? Both devices were rendered useless, and files on the watch’s SD card were encrypted. In other words, the proof of concept functioned just like typical ransomware but with a potentially larger reach — imagine the havoc if smart TVs refused to change channels or fridges demanded bitcoin payments to keep food cold. Fortunately, there have been no reports of IoT ransomware in the wild, but given the kind of tanker-sized network holes present in many new device rollouts, it’s only a matter of time.
Breaking the Bank
Is it possible to defend against this kind of attack? The short answer is no. Since phones and wearables are intended to sync smoothly and seamlessly, any updates — or malicious files — are pushed automatically to both devices, making it almost impossible to stop the spread of ransomware across a personal area network (PAN). There is some good news, however: According to Symantec researcher Kevin Savage, malware tends to rise and fall in two-year cycles, which suggests that “crypto ransomware growth is already at, or close to, its peak. This means it may soon plateau before finally entering a declining phase.”
What’s more, cybersecurity expert and Security Intelligence contributor Engin Kirda said that ransomware may be easier to defeat than previously thought. For example, Kirda found that 61 percent of ransomware apps only affected desktops, while just 35 percent actually deleted files and just 5 percent used encryption. More dangerous versions of ransomware such as Cyptolocker and Cryptowall, meanwhile, leverage encryption algorithms built into Windows, meaning it should be possible for virus tools to monitor selected behaviors like access to encryption libraries.
As tech giants push new wearable devices to market and make syncing these devices with existing smartphones ever more seamless, malware creators are looking for fresh avenues of attack. And while “ransomwear” may be the next trend for malicious actors, there’s hope it will fall quickly out of fashion as other opportunities knock and detection tools improve their rate of discovery.