7 ms·

Hackers Make the First-Ever Ransomware for Smart Thermostats

66 points by ProZsolt 10y ago

csydas 10y ago
I don't think there is much to say here that hasn't already been said about IoT security - like many commentors mentioned before, we're going to be going through a very rough period for some time where IoT devices just aren't up to par with expected security procedures, and consumer awareness campaigns will be necessary to educate less savvy consumers about the potential dangers of IoT devices at the moment. In particular, start ups trying to capitalized on IoT in niche products will need excess scrutiny in order to ensure they're not trying to run fly-by-night operations just to make a quick buck. Chinese IoT knock-offs will also need to be monitored carefully as well. What's most frightening to me on something like this is even tech-savvy users are fairly screwed as your ability to interact with the device and try to remove or clear the ransomware manually will be restricted by the same methods meant to prevent you from tampering with the device in the first place. This likely can leave people without any recourse to ranson scenarios like the thermostat being hijacked, and the end-user will have no option except to remove the device. Hopefully either a consumer or business alliance crops up with suggested practices for IoT devices, including remediation methods for these very scenarios. I think it's preposterous for companies to assume that their devices will never be compromised, and if they're going to lock down the devices, they need to provide a guaranteed way to reset the device; a bit of set up work certainly beats paying to make sure your fridge still works tomorrow. With IoT creeping out as the next "must include" feature for manufacturers, this sort of consumer protection is going to be essential.
- ssharp 10y ago
  I don't think there is much to say here that hasn't already been said about IoT security - like many commentors mentioned before, we're going to be going through a very rough period for some time where IoT devices just aren't up to par with expected security procedures, and consumer awareness campaigns will be necessary to educate less savvy consumers about the potential dangers of IoT devices at the moment. I suppose I can see some potential future value to devices like thermostats, that directly control "large" resources like natural gas (by "large", I mean relative to what other resources a household consumes). Smarter controls at the household level could provide substantial energy savings in the aggregate. However, the pessimist in me says "why does anyone really need appliances connected to the internet?". So you're trading off some potential future value to reduce overall energy use by better optimizing your own consumption in the present. You're also exposing yourself to faulty equipment that might also pose security risks. Do these thermostats have some sort of hardware kill switch that prevents software from doing clearly stupid things, like shutting off entirely or setting the heat to a maximum setting? Finally, there was this gem in the article that I did not remember hearing about: Munro, who last year found that a Samsung smart fridge leaked Gmail passwords What exactly is the purpose of a "smart fridge", why does it need Gmail passwords, etc.
  - 59nadir 10y ago
    > However, the pessimist in me says "why does anyone really need appliances connected to the internet?". I think it's important to answer this without any of the qualifications you write after it. No one needs it. It's not even necessarily about how secure it is; if you're paying extra for these features you're just throwing your money away in the name of gadgetism. You really don't need to fill in that they're unsafe or made with crap components. The truth is that no one would have a need of a perfectly made one.
    - Klathmon 10y ago
      Well nobody has a need for 99% of the crap in our lives. You don't need a car, you don't need a TV, you don't need a computer. But it sure as hell is nice to have all of those things. I find it funny that in an article about how manufacturers are locking down their devices to only the features that the consumer needs (effectively having the manufacturer tell you what you need), you are going around telling others what they need.
    - ssharp 10y ago
      I should have said "want" or "find value in" rather than "need". Of course you don't need it but I get hung up on what benefits a smart refrigerator is actually providing. Maybe I've reached curmudgeon-status but I don't see the benefit in a fridge telling me I need milk. I can generally tell if I need milk based on the last time I used the milk.
  - Klathmon 10y ago
    Why does a car need a radio? Why does a cell phone need "candy crush"? Why does your TV need a remote? None of these things are necessary, 99% of them aren't "need to haves", but they are "nice to haves". I've gone down the "home automation" path, and i'm currently about $600 in and with that i've got most of the light switches in my house connected, as well as my thermostat and stuff like door locks and the garage door to the house. So keep in mind that I have a bias here. Individually there is no one thing that is "worth it", but together it all adds up to a nicer life to me. Being able to turn all the lights out after i've gotten comfy in bed, being able to make sure the door is locked after i took in groceries, turning on the porch light for the delivery guy, or even checking to make sure the garage door wasn't opened when our car was broken into a few weeks ago. Nobody wants a "Fridge that needs gmail passwords", but they want a fridge that can show your calendar. A fridge that can message you when you run out of something, a fridge that can show some photos from an album on your google account, or can send usage reports to your email on how much power it's using, or show you the weather or even the news. Now there are much better ways to implement all of that than just storing the gmail password and using it, but less technical people don't know that. Don't conflate the users' want of features with them wanting the security flaws as well. Now I still don't think any refrigerators on the market have reached the point where it's worth the extra money for the "smart features" (at least as of a year ago when i was looking for a new fridge), but I feel it's close. After all, a refrigerator is a large appliance very in-view in the middle of your kitchen. People have put things on them for years with magnets and tape, it's a prime location for a touchscreen that can control not only the fridge, but can show and control other parts of your life/home. IMO it's a perfect location for something like a screen, and a pretty logical extension of what people have been using that space for already for years. But to be honest I want other appliances to be "connected" first. Namely the dishwasher, and the clothes washer and dryer. Being able to schedule those, send alerts when they are done, to have the dishwasher determine if it's full enough to run now, or if it should wait, etc... Those are the things i'm looking for.
- VLM 10y ago
  A good summary and I propose three minor additions to the issue list: 1) One big part of IoT is replacing capital goods with decades long depreciation with goods having months long depreciation. Yes your $20 Honeywell lasted three decades and a new one would last three more decades, but this $200 IoT thermostat simply won't be supported in a large number of months and the end users need an economic plan to replace it, say, annually, rather than a couple times per century. Which has interesting environmental/ecological concerns of its own. Your 1996 dumb thermostat works fine in 2016, but your 2016 IoT thermostat absolutely will not work with whatever passes for an iphone in 2036, or probably even 2026. 2) Demarcation points and interoperability and DRM need to be monitored. Oh so sorry your IoT thermostat got powned and tried to burn down your house, unfortunately instead of the standard current loop interface it uses a DRMed proprietary RS-485 based interface to talk to the DRMed furnace so rather than swapping in a new thermostat (which would just get powned in minutes anyway) you'll need a newer model thermostat and those only connect to new furnaces, so an IoT thermostat with a severe DRM infestation getting powned means a $5000 new HVAC system not just a new thermostat. 3) As more and more people recognize IoT as an anti-feature or unwanted at best, people are going to refuse to set it up, sorta like the millions of VCRs blinking 12:00 in the 80s/90s. My MiL has a long obsolete smart TV that's never been connected to the internet and is merely a dumb TV. Selected because she liked how the bezel matched her home decor. Likewise IoT devices are going to have to get used to the idea that very soon many/most users will never connect them to the internet, yet they still have to at least minimally operate.
  - pavel_lishin 10y ago
    Did your MiL refuse to set it up as a protest, or just because she couldn't be bothered, same as the blinking 12:00? My understanding of the blinking 12:00 wasn't that people refused to set them up, but most simply couldn't figure out how, and didn't see the advantage in spending more than five minutes in trying to figure it out, when there was probably a clock hanging above the TV anyway. When we bought a new TV, we picked the dumbest possible one, and did the bare minimum to make it work, skipping all the solicitations to hook it up to our wifi.
    - ryandrake 10y ago
- frandroid 10y ago
  If there's enough crap IoT devices out there, and a good, well-publicized scare, someone could run a good security certification program for IoT devices that would become a must-have.
- nbadg 10y ago
  > like many commentors mentioned before, we're going to be going through a very rough period for some time where IoT devices just aren't up to par with expected security procedures... Hopefully either a consumer or business alliance crops up with suggested practices for IoT devices, including remediation methods for these very scenarios. Part of the difficulty here is precisely that when it comes to IoT, there is no such thing as "expected security procedures", in no small part because established best practices on the internet often simply don't transfer well to a set of devices where a great many are expected to be acting as servers positioned behind very aggressive consumer firewalls. Even the "ideal case" applying the web security model to these kinds of devices leaves you with a very difficult NAT problem, and a very difficult authentication problem. You're left, more or less, with two mainstream approaches: either find a way to open up consumer firewalls (or bypass them entirely, for example by setting up your own dedicated access point for the device) and then issue the devices with its own TLS cert, OR use a centralized trusted-third-party auth model. Both, in addition to presenting enormous scaling problems, are shitty "solutions" when you're talking about devices with extremely high reliability requirements, like thermostats. If you have to connect to a TTP auth service for your heat to turn on, and your internet goes down, and it's winter in Canada... So there are countless examples and anecdotes as to why it's not really as simple as establishing new best practices; entire new technologies may need to be established here. Now on the one hand, privacy and security are always secondary markets, so I don't think we'll see any direct calls for change through their advocates. On the other hand, these problems aren't just a matter of privacy and security: if you've ever tried to put together a consumer-grade solution for something like IoT, you know how hard it is -- largely as a result of the same technological shortfalls that are compromising security. As a business, anything that can save you development time/costs is going to be tremendously appreciated. So there's a nascent market gap for a technology that 1.) makes development companies happy by decreasing time/cost to market, and 2.) gives/forces security on them, in such a way that 1.) is inseparable from 2.). And that, I think, is really the way forward for privacy and security in IoT. That's what I'm hoping, anyways, because I've sorta started a company trying to do that. The rest of this is basically a plug, so feel free to ignore it, but our product is called Hypergolix[1] and we're planning on releasing a very early preview alpha in the next few weeks. Our value prop for developers is that we're "Dropbox for Python objects, with an emphasis on IoT and privacy/security", and everything is enforced directly by cryptography. This also lets us do some really cool things like failover-to-LAN if your internet drops out, completely transparently to applications built on top of it. [1] https://www.hypergolix.com https://www.hypergolix.com
imglorp 10y ago
An observation on the example threat model the researcher presented. I don't think ransomware to unlock your thermostat is too lucrative. I think the real home threat model is foothold: sitting quietly on your network and chipping away at the rest of your network, sipping from your fileserver, opening more ports on your router, etc.
- csydas 10y ago
  Could you elaborate why you think it wouldn't be lucrative? With normal computer/phone/tablet ransomware, the thought process is largely "do I mind losing my files/pictures?" - reinstalls and HDD replacements are usually an option, and victims have time to mull over it, unless given a time limit by the ransomware. With an IoT ransomware, vital appliances or controllers can be overtaken and potentially disrupt the victim's day to day activities. (Fridge is put into vacation mode if not paid in 24 hours, thermostat cranks the heat or AC until paid). These have very immediate and often costly real world consequences that cannot be mitigated short of removing the IoT device, and the immediacy can force a payment decision much faster than other ransomware. I guess I don't see how you reason that it's less lucrative when the immediacy seems like it would prompt more payments.
  - ssharp 10y ago
    Maybe this is 21inc's vision for the future. They install their Bitcoin chip into all your IoT devices and your devices can then automatically payoff ransoms.
  - imglorp 10y ago
    In the case of a $100 thermostat, knowing it's infected, I'd throw it away and buy another brand, unless I knew how to wipe and secure it. It's two screws and few wires. Why would I pay even a $1 to someone who might or might not get off my network? In the case of a $2000 fridge, it's more persuasive. I might respond by revoking its network privs and paying for a service call to wipe and reset to factory. Again, I'm not going to trust the bad guy to get off my network. In both cases, the bad guy has shown bad intent, means, and opportunity. I'm not trusting him after a payoff.
balabaster 10y ago
Pfft... disconnect the thermostat and take it back to the store and get a new one. If their security is so asinine that it can be hacked with ransomware, they should damn well cover it under warranty. 1 bitcoin indeed. Put your old mercury switch back in place until you have the time to go and replace it. At least with your thermostat, you're not losing all your work... ...and it's simple to disconnect and reconnect yourself with 2 or 3 wires. In fact, I'd wager with a single wire and a little (and I do mean only a little) know how and a copy of the factory firmware you can recover it using the exact same process as you unbrick a router in just a few minutes. Though, you should probably close the other holes in your network first. Chances are, if your thermostat has been hacked, they're in your network and it's only a matter of time before your computers suffer the same treatment.
- tdkl 10y ago
  > If their security is so asinine that it can be hacked with ransomware, they should damn well cover it under warranty. Don't worry, this will be covered by some EULA, when connecting the device, where the owner is solely responsible for these things.
  - iRobbery 10y ago
    But not all EULAs are enforceable and certainly not in all countries.
    - CaptSpify 10y ago
      But they can add a crazy amount of friction for a lot of people
- nbadg 10y ago
  > ...and it's simple to disconnect and reconnect yourself with 2 or 3 wires. This "sort of" works for now, depending on where you live, what season, whether or not you keep junked tech, etc. But it strikes me, not only as dismissive and condescending, but also particularly short-sighted. I can imagine, 20 or 30 years ago, someone saying something similar about a car: "a bug in your ECU is keeping your car from starting? That's your problem for having bought a car running off of a computer!" Fast-forward to today. It simply isn't possible to buy a car without an ECU. The thing is, the changes that brought ECUs to cars are exactly the kinds of changes that are bringing computers into thermostats. In a surprisingly short amount of time, we're going to be living in a world where it simply isn't possible for most people to find a thermostat without a computer. When people feel their agency and autonomy is being compromised with new technology, a common sentiment to echo in the tech world is "if you don't like it, don't use it". But the plain fact of the matter is that in many cases, IoT being an emergent but prototypical example, non-participation simply isn't an option.
Cshelton 10y ago
We really just need education and prevention on the hardware side. Just like sex... if you don't absolutely know where something has come from or has been before, DON'T STICK IT INSIDE OF YOU (...without protection). Consumers: If it's an sd card, a usb-stick/flash drive...whatever, don't put it inside of your hardware. Especially critical hardware such as a thermostat. Hardware creators: Don't build slots, or at least exposed slots, for sd cards/usb drives, etc. on hardware such as thermostats, cameras, etc. I know the sales team told you the customer wants to put an image of their cat as the background of their thermostat, "it's the killer feature". Just say NO. There is absolutely no reason to do that using hardware. Build an online portal where users can upload images and then check them yourself before offering them as background choices.
- pavel_lishin 10y ago
  > There is absolutely no reason to do that using hardware. Build an online portal where users can upload images and then check them yourself before offering them as background choices. Doesn't that just move the threat surface? Now instead of having to convince end users to put something on a USB stick, you have to try a password dump against your interface.
  - Practicality 10y ago
    Right. In practical terms the online portal tacked on at the last minute is likely much less secure than the hardware tacked on. Although both ideas are nightmares for security.

66 points by ProZsolt 10y ago

I don't think there is much to say here that hasn't already been said about IoT security - like many commentors mentioned before, we're going to be going through a very rough period for some time where IoT devices just aren't up to par with expected security procedures, and consumer awareness campaigns will be necessary to educate less savvy consumers about the potential dangers of IoT devices at the moment. In particular, start ups trying to capitalized on IoT in niche products will need excess scrutiny in order to ensure they're not trying to run fly-by-night operations just to make a quick buck. Chinese IoT knock-offs will also need to be monitored carefully as well. What's most frightening to me on something like this is even tech-savvy users are fairly screwed as your ability to interact with the device and try to remove or clear the ransomware manually will be restricted by the same methods meant to prevent you from tampering with the device in the first place. This likely can leave people without any recourse to ranson scenarios like the thermostat being hijacked, and the end-user will have no option except to remove the device. Hopefully either a consumer or business alliance crops up with suggested practices for IoT devices, including remediation methods for these very scenarios. I think it's preposterous for companies to assume that their devices will never be compromised, and if they're going to lock down the devices, they need to provide a guaranteed way to reset the device; a bit of set up work certainly beats paying to make sure your fridge still works tomorrow. With IoT creeping out as the next "must include" feature for manufacturers, this sort of consumer protection is going to be essential.

ssharp 10y ago
I don't think there is much to say here that hasn't already been said about IoT security - like many commentors mentioned before, we're going to be going through a very rough period for some time where IoT devices just aren't up to par with expected security procedures, and consumer awareness campaigns will be necessary to educate less savvy consumers about the potential dangers of IoT devices at the moment. I suppose I can see some potential future value to devices like thermostats, that directly control "large" resources like natural gas (by "large", I mean relative to what other resources a household consumes). Smarter controls at the household level could provide substantial energy savings in the aggregate. However, the pessimist in me says "why does anyone really need appliances connected to the internet?". So you're trading off some potential future value to reduce overall energy use by better optimizing your own consumption in the present. You're also exposing yourself to faulty equipment that might also pose security risks. Do these thermostats have some sort of hardware kill switch that prevents software from doing clearly stupid things, like shutting off entirely or setting the heat to a maximum setting? Finally, there was this gem in the article that I did not remember hearing about: Munro, who last year found that a Samsung smart fridge leaked Gmail passwords What exactly is the purpose of a "smart fridge", why does it need Gmail passwords, etc.
- 59nadir 10y ago
  > However, the pessimist in me says "why does anyone really need appliances connected to the internet?". I think it's important to answer this without any of the qualifications you write after it. No one needs it. It's not even necessarily about how secure it is; if you're paying extra for these features you're just throwing your money away in the name of gadgetism. You really don't need to fill in that they're unsafe or made with crap components. The truth is that no one would have a need of a perfectly made one.
  - Klathmon 10y ago
    Well nobody has a need for 99% of the crap in our lives. You don't need a car, you don't need a TV, you don't need a computer. But it sure as hell is nice to have all of those things. I find it funny that in an article about how manufacturers are locking down their devices to only the features that the consumer needs (effectively having the manufacturer tell you what you need), you are going around telling others what they need.
  - ssharp 10y ago
    I should have said "want" or "find value in" rather than "need". Of course you don't need it but I get hung up on what benefits a smart refrigerator is actually providing. Maybe I've reached curmudgeon-status but I don't see the benefit in a fridge telling me I need milk. I can generally tell if I need milk based on the last time I used the milk.
- Klathmon 10y ago
  Why does a car need a radio? Why does a cell phone need "candy crush"? Why does your TV need a remote? None of these things are necessary, 99% of them aren't "need to haves", but they are "nice to haves". I've gone down the "home automation" path, and i'm currently about $600 in and with that i've got most of the light switches in my house connected, as well as my thermostat and stuff like door locks and the garage door to the house. So keep in mind that I have a bias here. Individually there is no one thing that is "worth it", but together it all adds up to a nicer life to me. Being able to turn all the lights out after i've gotten comfy in bed, being able to make sure the door is locked after i took in groceries, turning on the porch light for the delivery guy, or even checking to make sure the garage door wasn't opened when our car was broken into a few weeks ago. Nobody wants a "Fridge that needs gmail passwords", but they want a fridge that can show your calendar. A fridge that can message you when you run out of something, a fridge that can show some photos from an album on your google account, or can send usage reports to your email on how much power it's using, or show you the weather or even the news. Now there are much better ways to implement all of that than just storing the gmail password and using it, but less technical people don't know that. Don't conflate the users' want of features with them wanting the security flaws as well. Now I still don't think any refrigerators on the market have reached the point where it's worth the extra money for the "smart features" (at least as of a year ago when i was looking for a new fridge), but I feel it's close. After all, a refrigerator is a large appliance very in-view in the middle of your kitchen. People have put things on them for years with magnets and tape, it's a prime location for a touchscreen that can control not only the fridge, but can show and control other parts of your life/home. IMO it's a perfect location for something like a screen, and a pretty logical extension of what people have been using that space for already for years. But to be honest I want other appliances to be "connected" first. Namely the dishwasher, and the clothes washer and dryer. Being able to schedule those, send alerts when they are done, to have the dishwasher determine if it's full enough to run now, or if it should wait, etc... Those are the things i'm looking for.
VLM 10y ago
A good summary and I propose three minor additions to the issue list: 1) One big part of IoT is replacing capital goods with decades long depreciation with goods having months long depreciation. Yes your $20 Honeywell lasted three decades and a new one would last three more decades, but this $200 IoT thermostat simply won't be supported in a large number of months and the end users need an economic plan to replace it, say, annually, rather than a couple times per century. Which has interesting environmental/ecological concerns of its own. Your 1996 dumb thermostat works fine in 2016, but your 2016 IoT thermostat absolutely will not work with whatever passes for an iphone in 2036, or probably even 2026. 2) Demarcation points and interoperability and DRM need to be monitored. Oh so sorry your IoT thermostat got powned and tried to burn down your house, unfortunately instead of the standard current loop interface it uses a DRMed proprietary RS-485 based interface to talk to the DRMed furnace so rather than swapping in a new thermostat (which would just get powned in minutes anyway) you'll need a newer model thermostat and those only connect to new furnaces, so an IoT thermostat with a severe DRM infestation getting powned means a $5000 new HVAC system not just a new thermostat. 3) As more and more people recognize IoT as an anti-feature or unwanted at best, people are going to refuse to set it up, sorta like the millions of VCRs blinking 12:00 in the 80s/90s. My MiL has a long obsolete smart TV that's never been connected to the internet and is merely a dumb TV. Selected because she liked how the bezel matched her home decor. Likewise IoT devices are going to have to get used to the idea that very soon many/most users will never connect them to the internet, yet they still have to at least minimally operate.
- pavel_lishin 10y ago
  Did your MiL refuse to set it up as a protest, or just because she couldn't be bothered, same as the blinking 12:00? My understanding of the blinking 12:00 wasn't that people refused to set them up, but most simply couldn't figure out how, and didn't see the advantage in spending more than five minutes in trying to figure it out, when there was probably a clock hanging above the TV anyway. When we bought a new TV, we picked the dumbest possible one, and did the bare minimum to make it work, skipping all the solicitations to hook it up to our wifi.
  - ryandrake 10y ago
frandroid 10y ago
If there's enough crap IoT devices out there, and a good, well-publicized scare, someone could run a good security certification program for IoT devices that would become a must-have.
nbadg 10y ago
> like many commentors mentioned before, we're going to be going through a very rough period for some time where IoT devices just aren't up to par with expected security procedures... Hopefully either a consumer or business alliance crops up with suggested practices for IoT devices, including remediation methods for these very scenarios. Part of the difficulty here is precisely that when it comes to IoT, there is no such thing as "expected security procedures", in no small part because established best practices on the internet often simply don't transfer well to a set of devices where a great many are expected to be acting as servers positioned behind very aggressive consumer firewalls. Even the "ideal case" applying the web security model to these kinds of devices leaves you with a very difficult NAT problem, and a very difficult authentication problem. You're left, more or less, with two mainstream approaches: either find a way to open up consumer firewalls (or bypass them entirely, for example by setting up your own dedicated access point for the device) and then issue the devices with its own TLS cert, OR use a centralized trusted-third-party auth model. Both, in addition to presenting enormous scaling problems, are shitty "solutions" when you're talking about devices with extremely high reliability requirements, like thermostats. If you have to connect to a TTP auth service for your heat to turn on, and your internet goes down, and it's winter in Canada... So there are countless examples and anecdotes as to why it's not really as simple as establishing new best practices; entire new technologies may need to be established here. Now on the one hand, privacy and security are always secondary markets, so I don't think we'll see any direct calls for change through their advocates. On the other hand, these problems aren't just a matter of privacy and security: if you've ever tried to put together a consumer-grade solution for something like IoT, you know how hard it is -- largely as a result of the same technological shortfalls that are compromising security. As a business, anything that can save you development time/costs is going to be tremendously appreciated. So there's a nascent market gap for a technology that 1.) makes development companies happy by decreasing time/cost to market, and 2.) gives/forces security on them, in such a way that 1.) is inseparable from 2.). And that, I think, is really the way forward for privacy and security in IoT. That's what I'm hoping, anyways, because I've sorta started a company trying to do that. The rest of this is basically a plug, so feel free to ignore it, but our product is called Hypergolix[1] and we're planning on releasing a very early preview alpha in the next few weeks. Our value prop for developers is that we're "Dropbox for Python objects, with an emphasis on IoT and privacy/security", and everything is enforced directly by cryptography. This also lets us do some really cool things like failover-to-LAN if your internet drops out, completely transparently to applications built on top of it. [1] https://www.hypergolix.com https://www.hypergolix.com

imglorp 10y ago

An observation on the example threat model the researcher presented. I don't think ransomware to unlock your thermostat is too lucrative. I think the real home threat model is foothold: sitting quietly on your network and chipping away at the rest of your network, sipping from your fileserver, opening more ports on your router, etc.

csydas 10y ago
Could you elaborate why you think it wouldn't be lucrative? With normal computer/phone/tablet ransomware, the thought process is largely "do I mind losing my files/pictures?" - reinstalls and HDD replacements are usually an option, and victims have time to mull over it, unless given a time limit by the ransomware. With an IoT ransomware, vital appliances or controllers can be overtaken and potentially disrupt the victim's day to day activities. (Fridge is put into vacation mode if not paid in 24 hours, thermostat cranks the heat or AC until paid). These have very immediate and often costly real world consequences that cannot be mitigated short of removing the IoT device, and the immediacy can force a payment decision much faster than other ransomware. I guess I don't see how you reason that it's less lucrative when the immediacy seems like it would prompt more payments.
- ssharp 10y ago
  Maybe this is 21inc's vision for the future. They install their Bitcoin chip into all your IoT devices and your devices can then automatically payoff ransoms.
- imglorp 10y ago
  In the case of a $100 thermostat, knowing it's infected, I'd throw it away and buy another brand, unless I knew how to wipe and secure it. It's two screws and few wires. Why would I pay even a $1 to someone who might or might not get off my network? In the case of a $2000 fridge, it's more persuasive. I might respond by revoking its network privs and paying for a service call to wipe and reset to factory. Again, I'm not going to trust the bad guy to get off my network. In both cases, the bad guy has shown bad intent, means, and opportunity. I'm not trusting him after a payoff.

balabaster 10y ago

Pfft... disconnect the thermostat and take it back to the store and get a new one. If their security is so asinine that it can be hacked with ransomware, they should damn well cover it under warranty. 1 bitcoin indeed. Put your old mercury switch back in place until you have the time to go and replace it. At least with your thermostat, you're not losing all your work... ...and it's simple to disconnect and reconnect yourself with 2 or 3 wires. In fact, I'd wager with a single wire and a little (and I do mean only a little) know how and a copy of the factory firmware you can recover it using the exact same process as you unbrick a router in just a few minutes. Though, you should probably close the other holes in your network first. Chances are, if your thermostat has been hacked, they're in your network and it's only a matter of time before your computers suffer the same treatment.

tdkl 10y ago
> If their security is so asinine that it can be hacked with ransomware, they should damn well cover it under warranty. Don't worry, this will be covered by some EULA, when connecting the device, where the owner is solely responsible for these things.
- iRobbery 10y ago
  But not all EULAs are enforceable and certainly not in all countries.
  - CaptSpify 10y ago
    But they can add a crazy amount of friction for a lot of people
nbadg 10y ago
> ...and it's simple to disconnect and reconnect yourself with 2 or 3 wires. This "sort of" works for now, depending on where you live, what season, whether or not you keep junked tech, etc. But it strikes me, not only as dismissive and condescending, but also particularly short-sighted. I can imagine, 20 or 30 years ago, someone saying something similar about a car: "a bug in your ECU is keeping your car from starting? That's your problem for having bought a car running off of a computer!" Fast-forward to today. It simply isn't possible to buy a car without an ECU. The thing is, the changes that brought ECUs to cars are exactly the kinds of changes that are bringing computers into thermostats. In a surprisingly short amount of time, we're going to be living in a world where it simply isn't possible for most people to find a thermostat without a computer. When people feel their agency and autonomy is being compromised with new technology, a common sentiment to echo in the tech world is "if you don't like it, don't use it". But the plain fact of the matter is that in many cases, IoT being an emergent but prototypical example, non-participation simply isn't an option.

Cshelton 10y ago

We really just need education and prevention on the hardware side. Just like sex... if you don't absolutely know where something has come from or has been before, DON'T STICK IT INSIDE OF YOU (...without protection). Consumers: If it's an sd card, a usb-stick/flash drive...whatever, don't put it inside of your hardware. Especially critical hardware such as a thermostat. Hardware creators: Don't build slots, or at least exposed slots, for sd cards/usb drives, etc. on hardware such as thermostats, cameras, etc. I know the sales team told you the customer wants to put an image of their cat as the background of their thermostat, "it's the killer feature". Just say NO. There is absolutely no reason to do that using hardware. Build an online portal where users can upload images and then check them yourself before offering them as background choices.

pavel_lishin 10y ago
> There is absolutely no reason to do that using hardware. Build an online portal where users can upload images and then check them yourself before offering them as background choices. Doesn't that just move the threat surface? Now instead of having to convince end users to put something on a USB stick, you have to try a password dump against your interface.
- Practicality 10y ago
  Right. In practical terms the online portal tacked on at the last minute is likely much less secure than the hardware tacked on. Although both ideas are nightmares for security.