Podcast
Root Causes 126: IoT Ransomware


Hosted by
Original broadcast date
October 28, 2020
New research shows how ransomware attacks could be launched against IoT devices. Our hosts are joined by Alan Grau to understand these attacks and what can be done to defend against them, including technical controls such as strong identity and embedded firewalls.
Podcast Transcript
Lightly edited for flow and brevity.
So, I find this to be a really important topic and it’s actually interesting though because people look at IoT devices as black boxes and just assume they are going to work and it really is critical that these devices just work. I mean they perform critical functions and at some level, the thought of a coffeemaker being held ransom, you know, for ransomware is kind of a cute, funny idea but when you start to look at really the types of IoT devices that we are relying on every day, you know, we are talking about connected cars. We are talking about medical devices. We are talking about critical infrastructure that if it’s not working, you know, in some cases it really could be a matter of life or death and it’s more than just the inconvenience of not having your coffee when you wanted it.
There were some researchers who worked for a pen testing firm, you know, they discovered they could do things like recover the wi-fi encryption key used to communicate with these devices. Well, then they started to dig a little bit deeper and started to reverse engineer the protocol that was used, started to look at the firmware that was on the device, reverse engineer that, and in doing that, they found out there were really very few security controls that will tend to this. The firmware wasn’t science. They didn’t have the code signing techniques used to ensure the validity of the firmware. So, they weren’t implemented things like Secure Boot and Secure Firmware updates, let alone more advanced techniques like firmware encryption where when the firmware is stored on the device, it can actually be encrypted so that if somebody gets the device, they can’t pull the firmware off and try to break into it.
So, there are things like the Etsy IoT cybersecurity standards that they came out with, which I know was covered in I think it was Podcast 108 her recently that you guys had covered. But there are also other things like project chip which is a standard for consumer home electronics devices and that was a consortium that was formed by Amazon, Google and Apple to ensure that their products could interoperate. So, if you buy a Smart Home coffee pot it will still work with other Smart Home controls in your home. Or, if you go to connect a doorbell and connected lights, they could all work together. But part of Project Chip is addressing security. So, they are not only worried about interoperability, they are worried about security as well. So, I think that we are starting to see - -
From there there’s certainly other critical security components that need to be built onto the device. You know – how do you manage your device’s identity so that you know that the device if it’s connecting to your cloud system or if two devices are communicating with each other but they are authentic devices that they haven’t been modified or tampered with. Other elements, you know, things like embedded firewalls to control who they are talking to. One of the examples that the pen testing firm that had hacked into the coffeemaker came up with is they actually put some mining software onto the device so it could do cryptocurrency money.
Again, it’s not a very powerful process so you are not going to make a lot of progress with it on just one coffeemaker but if you can get an army of these, operating these bots doing money together, they can actually be effective and with an embedded firewall you can control who these devices were talking to. So, if suddenly the device starts talking to a cryptocurrency mining control server, then you know you have a problem and can cut that off.
So, those are some of the key capabilities. There are certainly some others as Jason alluded to but those are certainly important starting points.


