Abusing information systems to extort money is almost as old as computing itself, however, Stephen Cobb, ESET Senior Security Researcher said that one of the most worrying trends in 2016 was the willingness of some humans to participate in three activities at scale.
The three activities at scale, Cobb, said were their willingness to hold computer systems and data files hostage (ransomware); deny access to data and systems (Distributed Denial of Service or DDoS); infect some of the things that make up the Internet of Things (IoT).
Sadly, Cobb believes these trends will continue in 2017 and there is potential for cross-pollination as they evolve.
Writing on ESET trends 2017, Cobb explained that abusing information systems to extort money is almost as old as computing itself.
Back in 1985, an IT employee at a US insurance company programmed a logic bomb to erase vital records if he was ever fired; two years later he was, and it did, leading to the first conviction for this type of com- puter crime.
"Malware that used encryption to hold files for ransom was seen in 1989, as David Harley recounts. By 2011, locking computers for a ransom was 'stooping to new lows' as my colleague Cameron Camp put it.
"So how might these elements evolve or merge in 2017? Some people have been referring to 2016 as
'The Year of Ransomware' but I’m concerned that a future headline will read: 'The Year of Jackware.' Think of jackware as malicious software that seeks to take control of a device, the primary purpose of which is not data processing or digital communications. A good example is a 'connected car' as many of today’s latest models are described.
"These cars perform a lot of data processing and communicating, but their primary purpose is to get you from A to B. So think of jackware as a specialized form of ransomware. With regular
"One of the trends that I found most worrying in 2016 was the willingness of some humans to participate in the following three activities at scale: hold computer systems and data files hostage (ransomware); deny access to data and systems (Distributed Denial of Service or DDoS); infect some of the things that make up the Internet of Things (IoT).
"Sadly, I think these trends will continue in 2017 and there is potential for cross-pollination as they evolve. For example, using infected IoT devices to extort commercial websites by threatening a DDoS attack, or locking IoT devices in order to charge a ransom, something I like to call jackware. ransomware, such as Locky and CryptoLocker, the malicious code encrypts documents on your computer and demands a ransom to unlock them. The goal of jackware is to lock up a car or other device until you pay up.
"A victim’s eye view of jackware might look like this: on a cold and frosty morning I use the car app on my phone to remote start my car from the comfort of the kitchen, but the car does not start. Instead I get a text on my phone telling me I need to hand over X amount of digital currency to re-enable my vehicle. Fortunately, and I stress this: jackware is, as far as I know, still theoretical. It is not yet 'in the wild'", he said.
Unfortunately, said that based on past form, he don’t have great faith in the world’s ability to stop jackware being developed and deployed.