Ransomware targeting embedded systems? Not that far-fetched

The Internet of Things may consist mostly of new technology, but these new products aren’t the only members of the IoT family. Embedded systems, some created before IoT was even a thing, are often equipped with add-ons for remote access, diagnostics and data mining. This practice, according to one researcher, poses a grave security risk if attackers become determined enough to target embedded devices.

Olaf Pfeiffer, a co-founder of the Embedded Systems Academy, argues that, with the proliferation of IoT and ransomware, cybercriminals could soon target embedded systems. He believes embedded systems, augmented to send and receive data remotely, are at high risk. Some scenarios include:

• embedded systems equipped with remote access options for diagnostics or data mining
• devices retrofitted with a gateway device or module with an Internet connection
• devices connected to an internal CAN (Controller Area Network) bus become potentially hackable even without an Internet connection
• embedded systems based on microcontrollers with Flash memory and a vendor-added secondary bootloader for firmware updates

“If an attacker has the ability to monitor the firmware update process, there is a good chance that he can figure out what type of microcontroller is at the receiving end and which file formats and checksums are used,” Pfeiffer says. “Many bootloaders out there are still completely unprotected. For some CAN applications following an industry standard, the bootloading process is included in the standard and well-documented, which can make attacks even easier.”

An embedded system is a mini computer system designed for a specific function as part of an infrastructure of such systems. Embedded systems control traffic lights, factory controllers, hybrid vehicles, MRI, avionics machinery, and many other common devices. According to Wikipedia, 98% of all microprocessors today are manufactured as components of embedded systems.

So, how can ransomware – or any other type of malware – seize control of an embedded unit?

A determined attacker could theoretically replace both the manufacturer’s firmware and the bootloader with versions that only he controls. Even reinstalling the old bootloader could be rendered impossible by the new code, leaving the device completely in the hacker’s hands.

This would cause even greater damage in scenarios where the hacker infects the computer controlling a “fleet” of such devices. And, even if a manufacturer reset/restore is possible, the devices would likely have to be shipped back to the vendor, making such an attack a very costly recall.

Applications using CAN and bootloading via CAN-only are the most vulnerable, Pfeiffer warns.

“If a hacker gets access to such a system, and if there are no further security levels, then it would be possible for him to replace update files, so that on the next update his malicious software gets installed instead of the intended update,” says the researcher.

Plenty of precautions can be taken to prevent these attacks, including:

• evaluate the true need to put a system online
• think twice before augmenting a device that was never intended to be augmented with an Internet connection
• ensure that the bootloaders have at least two layers of security, such as authentication and encryption