I think the real home threat model is foothold: sitting quietly on your network and chipping away at the rest of your network, sipping from your fileserver, opening more ports on your router, etc.
With an IoT ransomware, vital appliances or controllers can be overtaken and potentially disrupt the victim's day to day activities. (Fridge is put into vacation mode if not paid in 24 hours, thermostat cranks the heat or AC until paid). These have very immediate and often costly real world consequences that cannot be mitigated short of removing the IoT device, and the immediacy can force a payment decision much faster than other ransomware.
I guess I don't see how you reason that it's less lucrative when the immediacy seems like it would prompt more payments.
In the case of a $2000 fridge, it's more persuasive. I might respond by revoking its network privs and paying for a service call to wipe and reset to factory. Again, I'm not going to trust the bad guy to get off my network.
In both cases, the bad guy has shown bad intent, means, and opportunity. I'm not trusting him after a payoff.
Basically while I agree with your assessment on how to respond I think the fact that ransomware is stilk so profitable means that you are the exception in this case. I posit that the same persons who reluctantly pay ransoms for their phones/tablets/desktops/laptops would be all the more quick to pay if not paying meant an additional heating or electric bill on top of it. I don't know if utilities would be sympathetic to victims but I am not confident they would be.
No, rationally there is no guarantee that payment unlocks the device or removes the attacker, but part of the attack is intending to induce an irrational state- it's likely why early ransomware pretended to be DMCA claims or FBI warnings.
(Please forgive spelling errors as I am on a tablet)
Try living in the north and having your heating fail in the middle of winter. $1000+ in emergency heating servicing is not all that uncommon.
Agreed. Its just cheaper to rip it off the wall and return it, or buy a new one. Its literally five wires and anyone who knows the basics of home repair can replace a thermostat.
I think the larger issue, at least to me, is that all these IoT devices are sensor devices. Does this thing ship with a SoC that also has a mic for voice commands? Or a wifi chip that can now start sniffing my data? Can someone now eavesdrop on you? This kind of thing can have serious repercussions for targeted individuals. Think blackmail, nation state snooping, corporate espionage, etc. If you can get root on an IoT device, you're definitely sniffing out data you shouldn't be.
Yes, the much bigger threat is taking control of these devices and using them as a pivot. We've done this for IP cameras, DVRs etc. It doesn't seem to engage the media or the public.
The ransomware has though.