Researchers Infect IoT Thermostat with Ransomware

Ken Munro and Andrew Tierney of Pen Test Partners have demonstrated at the DEF CON 24 security conference in Las Vegas that it is possible to run ransomware on an IoT device such as a thermostat.

The two took an IoT thermostat that features a large screen, to show their ransom note, and hacked its underlying codebase, which was running a modified version of Linux.

Every piece of code on the thermostat ran as root

They were able to hack the thermostat because it allowed them to connect an SD card to the device.

Additionally, it seemed that every process inside the thermostat software ran with root privileges, meaning they didn't need any special privilege escalation flaws to compromise the device.

The two loaded a large 7MB JavaScript file on the device, which called some SQL commands that then allowed them to run some shell commands on the underlying Linux OS.

Because everything was executed with root privileges, the researchers had no problem ...