A sinister new scheme among hackers exploits methods for mining crypto-currencies using Internet of things (IOT) devices. That may not be so sinister in itself, until the realisation dawns of a growing tide of hackers targeting medical devices and implants - anything from CT scanners to remotely monitored pacemakers - that may cause people to drop dead for the price of a few seconds of crypto-coin mining.
Such is the potential profit to be made from the wave of crypto-currencies sweeping the globe that they offer nefarious hackers an opportunity so lucrative many easily overcome any moral objections they may have to making a quick buck at the cost of human life.
That may well be the most odious exploit of connected technologies since the invention of the Internet, but it is not the only threat businesses, public utilities, and ordinary people face from hackers in a world increasingly crushed beneath a growing number of IOT devices.
Beware the swarm
IOT devices have long afforded hackers a comparatively easy means of creating a swarm of robots to rather primitively effect their wicked goals. Company and other system administrators, however, have grown wise to these methods and many of the methods hackers exploited have since been patched.
Far greater is the opportunity for hackers now in actively hacking IOT devices versus their previously passive effort. In the past, they would simply find those devices that had not been password-protected. Today, however, they actively exploit flaws in the code used to run the IOT devices - their operating system.
And, as opposed to their somewhat primitive application in the past of focusing on distributed denial of service (DDOS) attacks, essentially pummelling a target beneath a tidal wave of accumulated yet individually miniscule packets of data from each hacked IOT device, hackers today realise IOT devices present a new vector by which they can assault the primary network. IOT devices tend to be trusted by the networks that serve the companies in which they are deployed. Hackers exploit that trust to have the hacked IOT device run harmful code that allows the hackers network access privileges, to syphon specific information from the network, or, as is more commonly the case, to inject ransomware.
Hacking's clear and present peril to public utilities is perhaps the most alarming.
Jobs in jeopardy
Ransomware jeopardises people's livelihoods because it imperils the companies that employ them. A shipping company, which employs 88 000 people worldwide, is recently estimated to have lost $300 million due to ransomware. The fallout lasted weeks, and spread to many related businesses in more than 76 countries. A German steel mill was also infiltrated - the hackers hijacked the blast furnaces and caused them to explode, raising a slew of questions about the risk that exposed industries and public enterprises represent.
Hacking's clear and present peril to public utilities is perhaps the most alarming. It is unsettling, to say the least, when a rival nation or heinous gang of cyber crooks captures the code that runs a nuclear plant. It is equally perturbing, considering the potential consequences to human and other life, should the same occur with the precious scarcity of water resources in SA.
Already, a new botnet is brewing on the Internet. Aptly dubbed Reaper, among other names, it had, apparently, as of October 2017, infected more than a million networks. What menacing prospects lurk in its future only time will tell.
One of the many difficulties that network, IOT, and other computing administrators face in securing their networks is they are so widespread, so ubiquitous, and carry a great diversity of devices, applications and information with an equal complexity of uses. There is a severe irregularity of hardware capabilities, even among devices of the same type, simply because their deployment has occurred over a period of time. While one security camera, for example, may be capable of operating updated software that closes security loopholes, another may not. The cost and complexity of simply knowing where they all are and what they are capable of precludes many companies from securing them.
But, a too often haemorrhaged corporate fiscus, due, in many cases, to an equally clobbered global economy, will not forever expose companies to the hackers' whimsy. Network, security and IOT administrators can deploy simple endpoint security solutions and institute zero trust policies for their IOT subnets.
While endpoint security may be a simple-to-use cousin in the security family, it is nonetheless a sophisticated and highly capable actor. The zero trust policy is also directly opposed to the more common - if typically unofficial - policy of freedom for what are believed to be trustworthy devices.
Share