Could Wearable Ransomware be Locking Down Your Life?
It appears as though everything that was predicted about the Internet of things or simply IoT, is coming to pass. Soon, nearly any device will be able to be networked, making it easy for organizations to collect and collate data across millions of interconnected machines. However, every technology comes with risks, and IoT-enabled gadgets have been the target of malware. According to Naked Security, past targets range from Bluetooth-enabled skateboards to Jeep Cherokees. It seems that now, the creators of malware have taken the game a notch higher, introducing ransomware-based attacks on wearable devices.
Ransomware Threats Are Unsurprising
A blog post published on Threatpost in December 2014 made it clear that IoT-based ransomware was not totally unexpected. York University Polytechnic School of Engineering hacker-in-residence Dino Dai Zovi stated that we are going to witness more ransomware in the IoT. He and other experts were of the view that there is a real possibility of vehicle-based ransomware in the future, which, according to them, could mean that cars are locked unless drivers agreed to pay in Bitcoin. Although as yet there is no vehicular lockdown that has happened, it was reported by CSO Online that researchers have today repackaged Android ransomware to function on Android Wear.
Computer experts from Symantec, through using Android Simplocker malware, managed to infect a smartphone that was Android-based and the linked smartwatch. This rendered both devices useless, with files from the SD card of the watch being encrypted. Put simply, the proof of concept worked similarly to typical ransomware but with a possibly bigger reach. Just imagine what would happen if fridges demanded payments in Bitcoin to keep the food cold or smart TVs refusing to change channels. The good news though is that there haven’t been reports in the Internet of Things in the wild. However, considering the tanker-sized network gaps in most rollouts of new devices, it is just a matter of time.
Breaking the Bank
Can this sort of attack be defended? The simple answer is NO. Because wearables and phones are meant to sync seamlessly and smoothly, any updates (or malicious files) will be automatically pushed to both devices. This makes it nearly impossible to stop malware spread across a PAN (personal area network). There is however some good news: Kevin Savage, a Symantec researcher, believes that malware appears to rise and fall in 2-year cycles. It, therefore, means that a crypto-ransomware growth may already be at or even close to peaking. It thus implies that soon, it could plateau before it enters a declining phase.
Also, according to Engin Kirda, Security Intelligence, and Cybersecurity contributor, ransomware could be easier to fight than previously imagined. For instance, Kirda found that a whopping 61 percent ransomware apps affected desktops only, with 35% actually deleted files and only 5% used encryption.
Meanwhile, more deadly ransomware versions like Cryptowall and Cryptolocker leverage encryption algorithms that are built into Windows. This means that virus tools ought to be able to keep track of select behaviors such as access to encryption libraries.
While tech giants bring more wearable gadgets into the market and make it even more seamless to sync the devices, creators of malware are figuring new avenues of attack. And although ransomware appears to be the next big thing for malicious actors, there is hope that it will quickly fall out of favor as detection tools improve the rate of detection.
