4 ms·

Could you elaborate why you think it wouldn't be lucrative? With normal computer/phone/tablet ransomware, the thought process is largely "do I mind losing my fi

by csydas 10y ago

Could you elaborate why you think it wouldn't be lucrative? With normal computer/phone/tablet ransomware, the thought process is largely "do I mind losing my files/pictures?" - reinstalls and HDD replacements are usually an option, and victims have time to mull over it, unless given a time limit by the ransomware. With an IoT ransomware, vital appliances or controllers can be overtaken and potentially disrupt the victim's day to day activities. (Fridge is put into vacation mode if not paid in 24 hours, thermostat cranks the heat or AC until paid). These have very immediate and often costly real world consequences that cannot be mitigated short of removing the IoT device, and the immediacy can force a payment decision much faster than other ransomware. I guess I don't see how you reason that it's less lucrative when the immediacy seems like it would prompt more payments.

ssharp 10y ago
Maybe this is 21inc's vision for the future. They install their Bitcoin chip into all your IoT devices and your devices can then automatically payoff ransoms.
imglorp 10y ago
In the case of a $100 thermostat, knowing it's infected, I'd throw it away and buy another brand, unless I knew how to wipe and secure it. It's two screws and few wires. Why would I pay even a $1 to someone who might or might not get off my network? In the case of a $2000 fridge, it's more persuasive. I might respond by revoking its network privs and paying for a service call to wipe and reset to factory. Again, I'm not going to trust the bad guy to get off my network. In both cases, the bad guy has shown bad intent, means, and opportunity. I'm not trusting him after a payoff.
- csydas 10y ago
  I understand your position here but you are familiar with ransomware scams it seems and also at least tech savvy enough to know you can restrict network access. However I do not feel you are representative of most homeowners who would be in the same situation, and my evidence by example is that ransomware is exceptionally profitable despite how well known the malware is and many reports and instructions on your options to respond are. Basically while I agree with your assessment on how to respond I think the fact that ransomware is stilk so profitable means that you are the exception in this case. I posit that the same persons who reluctantly pay ransoms for their phones/tablets/desktops/laptops would be all the more quick to pay if not paying meant an additional heating or electric bill on top of it. I don't know if utilities would be sympathetic to victims but I am not confident they would be. No, rationally there is no guarantee that payment unlocks the device or removes the attacker, but part of the attack is intending to induce an irrational state- it's likely why early ransomware pretended to be DMCA claims or FBI warnings. (Please forgive spelling errors as I am on a tablet)
- deleted 10y ago
  [deleted]

by csydas 10y ago

ssharp 10y ago

Maybe this is 21inc's vision for the future. They install their Bitcoin chip into all your IoT devices and your devices can then automatically payoff ransoms.

imglorp 10y ago

In the case of a $100 thermostat, knowing it's infected, I'd throw it away and buy another brand, unless I knew how to wipe and secure it. It's two screws and few wires. Why would I pay even a $1 to someone who might or might not get off my network? In the case of a $2000 fridge, it's more persuasive. I might respond by revoking its network privs and paying for a service call to wipe and reset to factory. Again, I'm not going to trust the bad guy to get off my network. In both cases, the bad guy has shown bad intent, means, and opportunity. I'm not trusting him after a payoff.

csydas 10y ago
I understand your position here but you are familiar with ransomware scams it seems and also at least tech savvy enough to know you can restrict network access. However I do not feel you are representative of most homeowners who would be in the same situation, and my evidence by example is that ransomware is exceptionally profitable despite how well known the malware is and many reports and instructions on your options to respond are. Basically while I agree with your assessment on how to respond I think the fact that ransomware is stilk so profitable means that you are the exception in this case. I posit that the same persons who reluctantly pay ransoms for their phones/tablets/desktops/laptops would be all the more quick to pay if not paying meant an additional heating or electric bill on top of it. I don't know if utilities would be sympathetic to victims but I am not confident they would be. No, rationally there is no guarantee that payment unlocks the device or removes the attacker, but part of the attack is intending to induce an irrational state- it's likely why early ransomware pretended to be DMCA claims or FBI warnings. (Please forgive spelling errors as I am on a tablet)
deleted 10y ago
[deleted]