Researchers show ransomware for smart thermostat

Two researchers from the security firm PenTestPartners presented ransomware written for a smart thermostat at the Def Con conference. With this they want to demonstrate that the Internet of Things is not excluded from malware.

The two have not disclosed which brand the thermostat in question is, Motherboard said. The vulnerability that the researchers took advantage of lies in the fact that the device does not monitor the code it runs. This makes it possible, for example, to hide the malware in an image. There is no way to remotely execute the malicious code, so the victim would have to copy or download an infected file to the device themselves. This is not entirely unimaginable, because the thermostat is equipped with an SD card reader with which users can, for example, add backgrounds themselves.

The ransomware is a way of demonstrating that it is possible to infect Internet-of-things devices. The researchers showed that the proof of concept works and is indeed able to encrypt the contents of the device. After that, an image is shown in which the user is asked to pay 1 bitcoin. The makers also point to the fact that many ‘smart’ devices lack security: “We don’t control our devices and don’t know what they do or how they function,” they told Motherboard.

The anticipation of ransomware for internet-of-things devices has been around for some time, thanks to the popularity of this form of malware. So far no variants are known and this concept is one of the first forms of ransomware for ‘smart’ devices.

Image via Motherboard