Malware: Siegeware Become Mainstream

The internet of things (IoT) is expanding rapidly and is creating new opportunities for cybercriminals to cash in. What was once a novel intrusion vector is becoming a mainstream criminal enterprise. The basic concept of siegeware is that as buildings become more automated, hackers can leverage that automation to hold a company/individual ransom without affecting traditional IT systems or company data. The first major intrusion of this type to make the news was in January of 2017 when a hotel lost control of their electronic door locks. Since then, with the proliferation smart devices in buildings, companies have become increasingly susceptible to this type of hacking.

Recommendations

• Change default passwords on all IoT devices when possible.
• Put all internet connected building devices behind a firewall and a password protected portal.
• Leverage the ZeroFOX platform to monitor for vulnerabilities in your devices and any relevant patches or other cybersecurity measures to mitigate the risk.

Details

Siegeware presents a new digital threat to what has historically been seen as a physical maintenance issue. The increasing levels of automation and sensor based efficiencies are lowering energy and maintenance costs, but they have also increased business vulnerability to extortion. Most of these devices are shipped with well-documented default passwords and easy to access online control portals. Convenience and cost are the two largest considerations when it comes to crafting this new wave of high tech building equipment. As a result, this infrastructure is often insecure as it leaves the factory, and because it is being installed by building maintenance--often in multi-tenant office space--it is not secured behind corporate IT. This creates a unique situation where the asset being held at risk by the criminal may not actually belong to the target of the extortion request.

This style of attack is gaining in popularity due to the ease of execution, the large availability of vulnerable devices, and the pervasive disconnect between physical assets and cybersecurity. Additionally, these types of attacks are often most effective when coupled with a severe natural event, such as turning off the AC during a heat wave or turning off the heat during extreme cold. Until these systems are hardened and good network hygiene is implemented these types of extortion attempts are likely to grow.