The Lessons of WannaCry for IoT
Moreover than 230.000 computers in 150 countries had been infected by the ransomware WannaCry. This figures sounds like a success. But compared to former ransomware cyberattacks WannaCry failed. In 2016 the ransomware locky was taking the world in storm. In its peak locky infected about 90.000 computers per day.
IoT security risks by automatically attacks
Locky infected its victims by fake E-Mail Attachment. This attack uses €œhuman fail€ as vector. While WannaCry was using a €œwormable€ security exploit, which allowed to infect systems automatically. From a technical level the WannaCry attack is high dangerous, as it allows compromising systems automatically, while locky is always depending on user interaction. But the automatically attack vectors also allows to defend easily by patching the security holes in the affected systems.
It€™s the patch, stupid!
WannaCry attack is based on a SMB exploit published by Shadow Broker Hacking Group. One month later Microsoft was publishing security patches for all Windows Versions with long term support. And most systems worldwide had been successful patched, when WannaCry stepped into world. So the WannaCry worm did not found enough unpatched systems to get feed fat. WannaCry€™s automatically attacks starved.
But what if we get wormable IoT exploits?
For IoT devices the WannaCry attack vector is a nightmare. Automatically attacks are a reasonable way to highjack IoT devices as we will have billions of connected micro controllers which are running in the background. If you want to attack them, you can€™t rely on user interactions to infect them as most of them will never require interfaces for direct users interaction. Keep in mind all the sensor nodes and gateways to collect environmental or industrial data for running smart cities, smart home and industry 4.0 applications. So attackers are relied on €œwormable€ exploits to infect those IoT systems by mass.
Feeding the worms in IoT
And they will find feed for such exploits in IoT world. Patching IoT systems is a nightmare compared to a Windows Systems ecosystem. In IoT there is no well-organized patching infrastructure in behind, which will provide security patches in a reasonable time and has the ability to deliver them worldwide to system administrators.
The IoT world is splitted in many vendors. Providing often low cost components, where maintenance is not part of the system concept or business model. By that the number of unpatchable IoT components is increasing every day dramatically. It€™s in your smart city, smart home and industry.
All what attackers need is a common automatically security exploit to run a successful infection campaign. As most IoT systems are based upon embedded software there will be a plenty of options to attack. For example, the SMB exploit of WannaCry also affects LINUX Samba SMB services and makes some of them vulnerable for remote execution.
So, when did you patched your IoT system?
