2 min read

Ransomware targeting embedded systems? Not that far-fetched

Filip TRUȚĂ

July 05, 2017

Ad One product to protect all your devices, without slowing them down.
Free 90-day trial
Ransomware targeting embedded systems? Not that far-fetched

The Internet of Things may consist mostly of new technology, but these new products aren’t the only members of the IoT family. Embedded systems, some created before IoT was even a thing, are often equipped with add-ons for remote access, diagnostics and data mining. This practice, according to one researcher, poses a grave security risk if attackers become determined enough to target embedded devices.

Olaf Pfeiffer, a co-founder of the Embedded Systems Academy, argues that, with the proliferation of IoT and ransomware, cybercriminals could soon target embedded systems. He believes embedded systems, augmented to send and receive data remotely, are at high risk. Some scenarios include:

  • embedded systems equipped with remote access options for diagnostics or data mining
  • devices retrofitted with a gateway device or module with an Internet connection
  • devices connected to an internal CAN (Controller Area Network) bus become potentially hackable even without an Internet connection
  • embedded systems based on microcontrollers with Flash memory and a vendor-added secondary bootloader for firmware updates

“If an attacker has the ability to monitor the firmware update process, there is a good chance that he can figure out what type of microcontroller is at the receiving end and which file formats and checksums are used,” Pfeiffer says. “Many bootloaders out there are still completely unprotected. For some CAN applications following an industry standard, the bootloading process is included in the standard and well-documented, which can make attacks even easier.”

An embedded system is a mini computer system designed for a specific function as part of an infrastructure of such systems. Embedded systems control traffic lights, factory controllers, hybrid vehicles, MRI, avionics machinery, and many other common devices. According to Wikipedia, 98% of all microprocessors today are manufactured as components of embedded systems.

So, how can ransomware – or any other type of malware – seize control of an embedded unit?

A determined attacker could theoretically replace both the manufacturer’s firmware and the bootloader with versions that only he controls. Even reinstalling the old bootloader could be rendered impossible by the new code, leaving the device completely in the hacker’s hands.

This would cause even greater damage in scenarios where the hacker infects the computer controlling a “fleet” of such devices. And, even if a manufacturer reset/restore is possible, the devices would likely have to be shipped back to the vendor, making such an attack a very costly recall.

Applications using CAN and bootloading via CAN-only are the most vulnerable, Pfeiffer warns.

“If a hacker gets access to such a system, and if there are no further security levels, then it would be possible for him to replace update files, so that on the next update his malicious software gets installed instead of the intended update,” says the researcher.

Plenty of precautions can be taken to prevent these attacks, including:

  • evaluate the true need to put a system online
  • think twice before augmenting a device that was never intended to be augmented with an Internet connection
  • ensure that the bootloaders have at least two layers of security, such as authentication and encryption

tags


Author



Right now

Top posts

Threat actors impersonate Canadian gas retailer to deliver malicious OneNote phishing campaign, Bitdefender Labs warns

Threat actors impersonate Canadian gas retailer to deliver malicious OneNote phishing campaign, Bitdefender Labs warns

January 26, 2023

2 min read
Spammers phish eager vacationers with travel-themed lures, Bitdefender Antispam Lab warns

Spammers phish eager vacationers with travel-themed lures, Bitdefender Antispam Lab warns

January 19, 2023

4 min read
Enhance your cyber resilience and privacy on Computer Security Day in four easy steps

Enhance your cyber resilience and privacy on Computer Security Day in four easy steps

November 29, 2022

2 min read
How to monitor your online privacy during your Thanksgiving trip

How to monitor your online privacy during your Thanksgiving trip

November 22, 2022

3 min read
Just your yearly dose of Black Friday spam: Cybercrooks get ahead of the game to steal shoppers’ info

Just your yearly dose of Black Friday spam: Cybercrooks get ahead of the game to steal shoppers’ info

November 16, 2022

6 min read
Bitdefender VPN in 2022: the new, the improved, and the soon-to-be

Bitdefender VPN in 2022: the new, the improved, and the soon-to-be

November 14, 2022

5 min read

FOLLOW US ON

SOCIAL MEDIA


You might also like

Meta Pays Out Bounties for Account Takeover and Two-Factor Authentication Bypass Exploits Meta Pays Out Bounties for Account Takeover and Two-Factor Authentication Bypass Exploits
Silviu STAHIE

January 31, 2023

1 min read
Hackers steal 10 million customer details from JD Sports Hackers steal 10 million customer details from JD Sports
Graham CLULEY

January 30, 2023

2 min read
North Korean Hackers Tried to Launder $100 Million in Crypto Stolen in 2022 North Korean Hackers Tried to Launder $100 Million in Crypto Stolen in 2022
Silviu STAHIE

January 25, 2023

1 min read