Ransomware and IOT attacks spell trouble for transportation industry by Robert Abel, Content Coordinator/Reporter
Transportation industry seeing increased IoT attacks along with energy, IT and construction.
The ransomware and IOT threat landscapes are merging as ransomware is constantly evolving to infiltrate company defenses in new ways and IOT devices are presenting new attack vectors that can pose significant threats, especially to the transportation sector.
The study found the Cyberattacks leveraging IoT devices are also becoming commonplace particularly in the transportation where 29 percent of companies indicated they experienced an IoT attack. The energy, construction, and IT sectors aren’t far behind 22 percent of respondents from each industry reported attacks, respectively.
To combat these threats researchers said companies will need to make use of comprehensive security methods that require skilled security engineers and a SIEM which may require a team of four to eight people, according to Arctic Wolf’s Ransomware of Things: When Ransomware and IoT Collide study.
Companies without the manpower, the budget or expertise for these resources and often rely on traditional perimeter and endpoint products for their cybersecurity with only 38 percent of survey respondents using log analysis tools and products, and only 25 percent using external threat data. A lack of proper security could be detrimental in the transportation industry under the right circumstances, researchers warn.
“One obvious challenge that’s been played out in movies and TV is the threat that hacked cars presents,” Arcadia Data Senior Director of Products and Solutions Dale Kim, told SC Media. “While it is a highly unusual case for a hacker to take control of a car for malicious reasons, even benign intentions around exploratory hacking could result in an accident.”
IOActive’s Director of Advisory Services Daniel Miessler told SC Media transportation is an attractive target because of the combination businesses in this sector tend to rely on older technology and because it’s high profile.
“The high profile means that if you’re seeking attention or money you have a higher chance of getting what you want by attacking core infrastructure,” Miessler said. “And the fact that core infrastructure is so expensive, and needs to be so dependable, also means it isn’t upgraded very often.
The lack of adequate cyber-security safeguards also contribute to the abundance of unsecured IoT devices in the transportation industry.
“We’re seeing that these industries are still behind other regulated sectors/industries in terms of their cyber-security posture,” Deloitte & Touche Risk and Financial Advisory partner Sean Peasley told SC Media. “The IoT devices/technology used in the ICS/OT environment are often outdated and require manual intervention to patch/upgrade.”
Other threats that could manifest from IOT and ransomware attacks could be manipulating HVAC systems during extreme weather conditions, delivering data captured from medical devices, or even hijacking consumer drones.
ESET researchers warned of similar attacks earlier this year predicting the next step in the evolution of ransomware would be what they called “jackware” or ransomware designed to target connected devices subsequently creating a ransomware of things (RoT).
As more of these vehicles become available for personal use, and as companies like Uber adapt these technologies on a larger scale there will be a lot more opportunities for cybercriminals to cause harm, researchers told SC Media.
