Ransomware's next target: Anything that's connected
"Ransomware" has turned into a lucrative business for scammers, but it could jump from a troubling annoyance to life-threatening attacks.
The hack is typically targeted at computers, with scammers encrypting files on unwitting victims' machines. They then demand a ransom -- typically about $500, payable in untraceable Bitcoin -- in exchange for a key that will decrypt the files. One new type of scam convinces consumers to download the malicious encryption software with the message "Your package has been delivered."
Already this year, the pace of ransomware attacks has quickened. Security firm Endgame noted that a dozen new variations have been identified so far, compared with about 10 for all of 2015. Security experts say the frequency and type of ransomware attacks are only going to pick up, given that hackers are profiting from it.
One think tank is predicting that the types of attacks will eventually expand to the "Internet of things," or Internet-connected devices such as cars and medical devices like pacemakers.
"Everything is connected now. It's the Internet of everything," said James Scott, senior fellow at the Institute for Critical Infrastructure Technology, which published the report on connected devices. "There are so many vulnerabilities that you can exploit."
While most people think of ransomware as targeting their computers, it has already spread to mobile phones. Last year, a version emerged called "Porn Droid" that changes an Android phone's PIN and then flashes a warning to the user that appears to come from the FBI. The warning tells the user that the phone has been locked because "suspicious files have been found" including pornography. The fee to get out of the "charges"? $500.
If a mobile phone is infected with ransomware, it's best to restore it to its factory settings, Scott noted.
When it comes to other Internet-connected devices, many "lack any form of security," according to the report.
"How much do you predict someone would pay to remove ransomware from a pacemaker?" the report asked. "The scenario is not too far-fetched; in fact, it is much more deadly. Many medical devices, such as pacemakers, insulin pumps, and other medication dispersion systems are Internet or Bluetooth enabled."
Still, the scammers face drawbacks in that it's tougher to deliver a message demanding a ransom through a pacemaker, for instance. In that case, it's likely the scammer would still use email or texting to communicate with the victim.
Scott said consumers should take several steps to avoid a ransomware or malware attack. First, back up your computer to an external hard drive, and make sure to unplug the hard drive between backups. The latter step will keep the it clear of malware or ransomware in case of an attack on the computer.
Second, maximize your privacy settings on your social media accounts, which will stop scammers (as well as anyone you don't know) from sending you texts or messages with malicious links or programs. Third, limit the personal information you disclose on sites such as Facebook (FB) or LinkedIn (LNKD).
"Guys put where they went to high school, their hobbies," Scott said. "I'm a social engineer. So, LinkedIn was the always the first place I would look when a company wanted us to penetrate their network."
Hackers can use that personal information to engineer an email campaign that looks as if it's from a company's CEO or another executive.
Browser add-ons such as self-destructing cookies and HTTPS Everywhere can help protect consumers, Scott noted. If your ISP offers antivirus or antispam services, sign up. It's also important to understand how hackers target consumers, such as through "spearphishing," which is when criminals create emails that are designed to look as though they come from a trusted source.
Consumers should also "stop filling out every form they see on the Internet," Scott added. "You don't have to put your real name in if you want to download an e-book."
