The alarming concept of IoT cyber attacks sends us straight to a dystopic vision of crashing automatic cars, and smart elevators stuck in place with evil music playing in the background. Looming over the excitement for next generation technology is a cloud of worry about the cyber implications of connecting everyday devices to the internet. While we’re sure that a hospital whose critical scanning machines are being held captive by ransomware will pay up, we don’t tend to stop and think about our small day-to-day actions that may be affected as well. If your printer was held hostage by ransomware before a critical meeting, and you had to pay $100 to free it – would you?
Researchers have started playing around with smart devices that we probably will all have soon in our offices. Avast Senior Researcher Martin Hron posted last this week that he had set out to hack a smart coffee machine. On one hand, it’s just a coffee machine, not an MRI machine or a control system for a power grid. On the other hand, imagine your coffee machine not working minutes before that critical meeting, or even worse – starting to spew frantically right as you approach it, staining your suit or dress. Would your office decide to “just go ahead” and pay the ransom, only to be attacked again a few days later?
As it turns out – coffee machines can be hacked with ransomware. The smart coffee machine uses a very unsecure firmware, which by acting as a Wi-Fi access point, allows the machine to create an unsecure, unencrypted connection to a controlling mobile application. In his research, Hron reverse-engineered the firmware, and created a ransomware locks the machine and asks for a ransom. Going one step further, Hron also embedded a code that, once triggered, permanently turns on the coffee grinder, hotbed and water heater, which will not turn off until the ransom is paid. Disconnecting the coffee machine from the power outlet is useless in the long run, as it will start spewing and making noise the second it gets plugged back in. Hron also entertained the possibility of turning the smart coffee machine in to a cryptomining device, but considering the machine’s slow CPU speed, it wouldn’t be a very effective miner.
With IoT technology rapidly developing, it is crucial that business and organizations implement strong network IT technology that can protect every connected device, from laptops to MRI machines, and yes… even smart coffee machines. Making it difficult for cyber attackers to breach your network in the first place is a great place to start.