Ransomware- Emerging Security Threat to IoT
Frequency and sophistication of cyber-attacks are at an all-time high, and the costs associated with data breaches continue to rise. While companies are investing more in cyber security to ward off attacks, they know that they won’t be able to spend their way to absolute security.
As we are inching ahead with evolution and conceptualization of IoT. A Perfect cybercrime conditions are brewing, and two of the main ingredients are “Ransomware” and the “Internet of Things”.
Gartner forecasts a 30% rise from 2015 IoT devices and expects this figure will grow further to reach 20.8 billion by year 2020. By 2016, as many as 5.5 million new connected devices will get added online every day – devices from toasters and kettles to cars and hospital equipment – will be connected to the internet. As a result, number of IoT devices would expand the growth to a gigantic 6.4 billion connected devices which will be in use worldwide. This growing IoT will support total services spending of $235 billion in 2016, up 22 percent from 2015, the analyst predicts.
By 2020, Gartner predicts that over half of all IoT implementations will use some form of cloud-based security service. However, considerable variation exists among different industry sectors as a result of different levels of prioritization and security awareness.
Amount of IoT growth expected five years ago was severely underestimated. As more data is gathered, it is presumed that more security patches will become available as the amount of entry points for cyber criminals only appears to be rising.
Ransomware Security Threats
Imagine a scenario your smart house lock refuses to allow entry to your own house or where your car is taken over by ransomware and refuses to start, allow entry, speed up, or slow down until a ransom is paid.
IoT devices including connected cars, medical devices, home appliances and manufacturing equipment are inevitable targets for Ransomware attacks, according to the Institute for Critical Infrastructure Technology (ICIT), a cyber security think tank. Most Ransomware attacks target PCs, but IoT devices could offer much more lucrative targets for cyber criminals conducting Ransomware attacks. For instance, the report warned about the possibility of hackers infecting connected pacemakers and insulin devices with Ransomware and then draining the batteries of those devices. Patients whose lives depend on such devices would have a pay a significant ransom in such cases. IoT devices offer a potential growth to any Ransomware because the IoT devices are interconnected by design and many pointedly lack any form of security. A selection of traditional malware will be too large to ever run on a number of IoT devices, but Ransomware, predominantly consisting of a few commands and an encryption algorithm, is much lighter.
Hackers could also infect connected cars with Ransomware so that the car won’t turn on until the owner pays a ransom. Hackers are already expanding their Ransomware attacks to hit mobile devices and hospital networks, so it likely won’t be long until we see Ransomware attacks targeting specific types of IoT devices.
Why would someone attack IoT devices?
IoT devices are just beginning to be exploited. The variety of devices, OS’s and Versions provides a near-term resistance to attack because few have a large enough installed base to attract cyber thieves. However, the sheer volume of devices has grown faster than we foresaw, and into industries that we did not expect, creating a massive attack surface- so it is only a matter of time until IoT device threats are widespread. Motivation for ransomware attacks are:-
- Mining crypto currencies
- Ad-clickjacking (if connected)
- Premium SMS/calls (needs a phone line)
- Ransomware/Locker
- Blackmailing user/vendor (e.g. I know what you did)
- Sell complete data sets of device data (attack backend)
- Steal passwords &CC’s and use/sell them
- Use IoT device to infect other devices
Way Ahead
Gartner predicts global spending on security for the Internet of Things (IoT) will reach $348 million this year, a 23.7 percent increase from last year’s $281.5 million spend. As the IoT gains momentum, Gartner expects the 2017 worldwide spend to fall just shy of $434 million, whilst the 2018 predicted spend is $547 million.
If IOT has to grow, it has to grow along with improvements in security tools and techniques. Although there are many tools available in the market today, new threats can be addressed only if security tools are beefed up to counter them.
To ensure IOT security, discovery of devices, and provisioning new and maintaining security of existing devices will be first checking points. Putting up authentication systems in place and ensuring security of data will also be a priority.
