CYBERSECURITY
TRENDS 2021:
Staying secure in uncertain times

TABLE OF CONTENTSINTRODUCTION

3 —4

THE FUTURE OF WORK: Embracing a new reality

1

5 —7

2

8 — 103

11 — 134

14 — 17

RANSOMWARE WITH A TWIST: Pay up or your data gets leaked

BEYOND PREVENTION: Keeping up with the shifting sands of cyberthreats

BAD VIBES: Security flaws in smart sex toys

CONCLUSION

18

www.welivesecurity.com

2

INTRODUCTION
The COVID-19 pandemic has dealt a shock to the ‘system’, thrusting many of us into aspiral of worry and giving the permanence of change a whole new meaning. With 2020
ending soon, one of the big questions on everybody’s lips is: how might 2021 play out?

2020 has been a year like no other in living memory, as

One aspect of our lives that has changed beyond recog-

hardly any facets of our lives have been spared the ef-nition in 2020 has to do with our working habits. In afects of the worst public health crisis in decades. The

way, the shift may have been long in the making, with

COVID-19 pandemic has upended our day-to-day, ex-

the pandemic vastly accelerating and intensifying

posed our collective fragility and vastly heightened our

pre-existing trends. However, businesses and the new-sense of uncertainty. The paradigm change will no

ly distributed workforce were ill-prepared to contend

doubt have profound and long-lasting effects, including

with the cyber-risks that the almost overnight switch

those that we cannot yet foresee.

to the new normal had brought on or escalated. In the
opening chapter, Jake Moore looks at this shift, as wellSome of the seismic shifts sparked or accelerated by theas at how organizations, especially those that won’t gopandemic involve our embrace of technology as theback to the old ways, and their workforce can stay safe.

global emergency has helped push some of the previ-

Just as importantly, he wonders what the near future

ously offline “touchpoints” into the online realm. Indeed,holds for working patterns and whether we’ll go back to

by increasing our reliance on connectivity and kicking

the pre-pandemic office life any time soon.

digital transformation into overdrive, the crisis may
have even given us a bit of a sneak peek into the near

It would be remiss of us not to consider at least some of

future, perhaps even after the pandemic.

the most pressing threats posed by malware, with Tony
Anscombe looking specifically at how ransomware at-This begs the question of what may be in store in 2021,

tacks have evolved. This threat has been going strong

including when it comes to threats and risks lurking infor years now; however, more and more ransomware

the digital realm. It’s well established by now that cyber-

operators are further tightening the screw on their vic-

criminals were quick to adapt to the new reality, seizing

tims by combining extortion with data exfiltration, as

the unique opportunities that the general anxiety andwell as with threats to publish, sell or auction off thethe inevitably pell-mell rush to remote work brought. As

stolen data if no payment is made. Tony also looks at an

we’re about to step into the new year, we need to pause

increase in ransom demands as another trend that’s

and think about how the cybersecurity threat landscapebeen evident of late, before looking at the broader pic-has evolved and how cyber-risks may be further re-ture and noting how the shifts are a way for cyberextor-

shaped and exacerbated going forward. Looking backtionists to maximize the ROI of their attacks. How willat, and cautiously extrapolating from, recent events andthe situation play out in 2021, perhaps even with impli-

trends remains the best way to get a sense of the future.

cations for the very definition of ‘ransomware’?

www.welivesecurity.com

3With threat actors continuing to deploy a range of in-sexual wellbeing. Adult toys certainly haven’t escaped

creasingly complex and often innovative ways to en-

the smart revolution; indeed, after the pandemic struck,snare their victims, Camilo Gutiérrez looks at one par-sales of smart sex tech surged. What has perhaps com-

ticularly evasive tactic that, while not entirely new, hasmanded less attention, however, is the privacy and cy-

gained traction over the past few years. Living-off-the-bersecurity implications of these devices. Denise Giusto

land attacks co-opt legitimate applications on the tar-and Cecilia Pastorino show that this tech is a potential

geted system and minimize the forensic footprint, allhotbed of privacy and security concerns that may ulti-

the while maximizing the stealth and effectiveness ofmately expose some of the users’ most sensitive data to

the incursions. As a result, they can be difficult to detectcybercriminals.

and prevent, serving as a powerful reminder for organizations to assess their preparedness to fend off these
attacks.

To be sure, many long-standing problems will not be going anywhere as the world will strive to come back fromthe depths of the pandemic. Nevertheless, if there is a

That technology permeates almost every facet of oursilver lining in the dark cloud cast by COVID-19, it’s thatlives was, naturally, made even more evident during athere are also valuable lessons to be learned from theyear when all things digital shaped our days more thancalamity. Among them, it reminds us to be prepared toever before. As we yearn for technology-enabled conve-

face and respond to adversity and that arming ourselves

nience, the Internet of Things has been a thing for years,

with knowledge is a powerful first step towards ‘inocu-

including when it comes to the use of technology forlation’ against various kinds of threats.

www.welivesecurity.com

4

1

THE FUTURE OF
WORK: EMBRACING
A NEW REALITY

2020 was the year when businesses transitioned to remote working, but who
really helped take these companies through accelerated digitalization? Was it
the CEO, the CTO or more truthfully, was it COVID-19? And what will work
look like after the pandemic?

Since governments around the world implemented
COVID-19 lockdowns, the world of work has changed
dramatically in ways most people could not have envisioned. The result? Mass implementation of remote
working that has seen a heavier reliance on technology than ever before, together with a resultant disruption of many businesses’ technology infrastructures. Central IT systems have been substituted witha network of disparate individuals, all with a greater
responsibility for their own technology use and cybersecurity needs. Not only does a fractured security
system leave companies vulnerable, but employees’
confidence in handling cybersecurity is also a serious
risk.

Jake Moore
ESET Security Specialist

At a time when businesses are relying on resilience,
malicious actors are continually exploiting the security vulnerabilities that accompany remote working.
Of course, there are ways to make our new environments more secure. Simple measures can be put inplace to help reduce the chance of a cyberattack– but going from one or two offices to dozens, even
hundreds of home offices, usually comes with a price.

www.welivesecurity.com

5The future of work: Embracing a new reality

WHAT COVID-19 HAS TAUGHT US

Training can go a long way in protecting staff and thisworks best when it is delivered often and in small doses.

The pandemic not only taught us how working from

This can be, for example, via quick reminders in products

home is possible, but also how companies can create andaround the importance of virtual private networks (VPNs)

enforce policies in a matter of weeks. Relocating entire

and on the awareness of phishing emails to keep people

workforces would usually take months of planning, end-

vigilant yet without frustrating or frightening them.

less consultations and then more planning before being
signed off by multiple parties. But when faced with being
told by your government that you are no longer allowed
into your offices (where possible), it is fascinating how

BEFORE VS. AFTER

quickly these changes can come into effect – and even hit
the ground running when push comes to shove.

Prior to COVID-19, cyberattacks were already on theincrease, and the pandemic and resulting lockdown

Some questions, however, still loom: How can we protect

has only heightened this risk. From phishing scams to

the remote workforce? Is working from home as safe as

COVID-19-related malware, cybercriminals have pounced

in the office? Will we ever go back to the office life of 2019?

on the innate vulnerabilities of dispersed workforces andtheir IT systems in order to find those cracks to exploit.

In order to be resilient against cyberattacks, many companies have strong policies and risk assessments in place.

Remote working has brought flexibility, but it has also

Many will also have protection to withstand the vast

dramatically altered business processes and systems

majority of threats that any normal business would ex-

in order to cater to a distributed workforce. Employee

pect. However, it is unlikely that any organization in theaccess to IT departments, and vice versa, has changed.

world was entirely prepared for this huge and rapid shift

Collaboration and teamwork are facilitated virtually, andin working when COVID-19 hit the world. The physical of-a lack of face-to-face communication can hinder direct

fice walls act as one big firewall and any abnormal inqui-channels of communication. Some of the baseline se-ry into the network can often be easily highlighted. But

curity measures taken for granted in the office must be

when everyone in the organization is now connecting tocompensated for at home, such as requiring home work-a network from outside the safety blanket of the usual

ers to use multi-factor authentication or a VPN to accessperimeter, the chief information security officer (CISO)

internal networks. Reminding workers to enable auto-and other invested parties may face some daunting tasks,

matic updates and check the security of their own Wi-Fi

to say the least.

networks is also crucial as the first line of defense against
cybercriminals. Ideally, the remote workforce will always

Remote working in some form or another is clearly here

also be using company-issued devices and remain fully

to stay for the long haul, but to efficiently operate it re-vigilant to these constant and persistent threats.

quires excellent management, as well as security at thecore. To help businesses run smoothly with minimal dis-

The overnight shift in our culture of remote working

ruption, they need to ensure the management and se-

has been critical to many organizations in proving thatcurity practices play an equal role, which in turn protect

it works as will it continue to work. However, we must

their staff and the business. Some organizations were

never become complacent. We soon miss those discus-

thrown off course when they were instructed to housesions at the water cooler or at lunch where we discuss

their staff at home, but others embraced it and even dis-the latest phishing scam or other practical security tips

covered a more productive shift (ESET included!).

that often help people to make the right choices.

www.welivesecurity.com

6

The future of work: Embracing a new reality

FUTURE-PROOFINGYOUR ORGANIZATION
Fully digital companies were clearly better suited andtaken years to come into effect, if at all. More employees

set up to move their workforce home, but not all com-around the world will naturally and effortlessly migrate

panies were so fortunate. It should be remembered thatto what works for them and their businesses, which inthousands of companies require their employees to work

turn makes a better environment for us all. The fact it canfrom home but if security is at the heart of a company’s

be taken seriously and securely enables it.

organizational policy, then there is no reason why the
majority of the world’s businesses cannot continue to securely and safely work away from the office.

Regardless of what the future will bring, two things arecertain – the way we work has been permanently alteredand cyberattacks are not going away. The COVID-19 pan-But what if there is a vaccine? Will everything just re-demic has only accelerated the implementation of tech-turn to normal? I don’t think so. We have all learned that

nology across all facets of life, and as more and more ofworking remotely can benefit organizations and can be

our working and home lives become digitized, cybersecu-

transitioned securely. I don’t think, however, that we willrity will remain the lynchpin of business safety.

work remotely five days a week. What we have foundthat as it works, we will continue to work from home

Cyberattacks are a persistent threat to organizations,when it suits us … which will no doubt benefit our healthand businesses must build resilient teams and IT systems

and well-being.

to avoid the financial and reputational consequences ofsuch an attack. An understanding of the workforce can

Personally, I have found this shift to home working im-play a key part in any business’s cybersecurity strategy,

proves my family life tremendously. I have never spent

both enhancing the effectiveness of training and en-so much time with my young children, and they havecouraging employees to be more invested in their own

commented multiple times how nice it is to have me at

self-awareness and skills. Understanding that the hu-home more often. The rigmarole of the Monday-Friday

man element of cybersecurity is just as important as the

9-5 is gone forever, and we must document COVID-19 fortechnical is the first step in building holistic protocols

this rapid speeding-up of the process that would have likelythat account for individual strengths and blind spots.

www.welivesecurity.com

7

2

RANSOMWARE
WITH A TWIST:PAY UP OR YOURDATA GETS LEAKEDWith ransomware attackers increasing their ransom demands and seeking
greater leverage to coerce businesses into paying up, the stakes are clearlyrising for the victims. What will next year look like on the ransomware scene?

One thing I predict needs to change in 2021 is the dictionary definition of “ransomware”:“Ransomware is illegal computer software thatstops a computer from working or prevents
the user from getting information until they
have paid some money.”(Collins English Dictionary)

Why should the definition change?
The 1980’s are remembered for many things: mix-

Tony Anscombe
ESET Chief Security Evangelist

tapes, shoulder pads, the Rubik’s Cube and the LiveAid concert to name a few, but few would associate
the decade with ransomware. In 1989, the AIDS Trojan was born, infecting devices through a floppy disk,
and hiding directories and encrypting the names andextensions of files stored on the hard disk. The user
was then presented with a message to renew theirlicense to resolve the issue by sending $189 to a post
office box in Panama. Thirty-one years later, withseveral twists and turns in its evolution, the term“ransomware” is a commonly used term across theworld.

www.welivesecurity.com

8

Ransomware with a twist: Pay up or your data gets leaked

Ransomware today is prominently associated with en-

The Maze team is one such cybercriminal group that has

cryption of files and data and locking access until a fee

been making their name with exfiltration and extortionis paid and a decryption method provided – at least you

attacks. At the end 2019, the group published details ofhope that’s all it is. During its evolution, ransomware has

data they claimed to have stolen from Southwire, a US

taken various forms, including locking the entire device

based cable manufacturer, that refused to pay the $6m

without encrypting anything and displaying a message

ransom. They then continued their nasty activity by pub-requiring payment to regain access; as well as locking thelishing a list of companies that refused to cooperate andscreen, displaying pornographic pictures and demanding

threatened publication of sensitive papers and data. In

payment through premium-rate SMS to regain access

March 2020, as the world was awash with chaos as theand stop the images from being displayed.

COVID-19 pandemic took grip, the Maze group reportedly tweeted that due to the global crisis they would offer

The market share of Microsoft Windows creates a nat-a discount to all companies not cooperating and would

ural target environment for cybercriminals wanting torefrain from attacking medical organizations until theextract cash from their victims. However, it’s importantsituation improved.

to note other platforms are not immune, with examplesof ransomware attacks on Apple’s OS X and on Google’s

The long-play scenario of exfiltration and extortion re-Android operating systems.

quires the bad actors to possess a different skill set anda certain amount of patience. While many ransomware
attacks have been about denying access, either by lock-

TIGHTENING THE SCREW

ing or encrypting, this growing trend of taking a copy requires the attackers to infiltrate a network and to movearound undetected so that sensitive data can be identi-

Exfiltration combined with extortion may not be a new

fied and then copied. It is no longer about a simple phish-technique, but it is certainly a growing trend. Attacks

ing link or attachment in an email that an unsuspecting

take the form of bad actors exfiltrating a copy of sensi-

employee or consumer opens and unwittingly unleashes

tive data to their own environment and then encrypting

a ransomware attack. There still needs to be an initialand locking access to the data on the victims’ servers.

point of entry, using techniques to exploit remote desk-

The sensitive data is then placed under threat of being

top protocol (RDP), brute-forcing their way in throughpublished and sold or auctioned off if no ransom is paid.

credential-stuffing attacks or by the more traditional

This technique is typically a long-play scenario on thephishing and social engineering mechanisms.

part of the attacker, since they need to gain network access, identify the sensitive data and then exfiltrate a copy

Once in the network, it’s a matter of remaining undetect-to their own environment.

ed, gathering information and collecting additional credentials and passwords to ensure that even if the initial

Consider, for a moment, the incursion from the pointroute in closes, that access is retained. The groundworkof view of the cybercriminal: companies are becoming

and intelligence to map a network and understand whatsmarter, deploying technologies that thwart attacks,

is valuable takes time and requires skilled resources tocreate resilient backup and restore processes and areachieve the ultimate aim of identifying the company’s

demonstrating less pertinacity to hand over the cash.

digital crown jewels that would, if breached, locked or

The bad actors need a “Plan B” to be able to monetize their

published cause the company the maximum disruption.

effort and build resilience into the attack, rather than be-

It’s only after the data has been stealthily removed thating reliant on a single form of threat: infect and encrypt.

the bad actor can move to the more traditional deploy-

By adding “take a copy” to the mix, they build in resilience

ment of ransomware. Through existing privileged access,and a unique selling point in order to close the deal withthe bad actor may have even taken the opportunity totheir “customer” – the victim.

disable protection software to ensure a successful attack.

www.welivesecurity.com

9

Ransomware with a twist: Pay up or your data gets leaked

THE CHANGING DEMANDSTHE STAKES GO UP

The additional skill set and time required need to be fund-

Fast forward to August 2020, and yet another data breached and this can be seen with the changing demands be-story: Blackbaud, a cloud services company that provides

ing made by cybercriminals. In 2018 the city of Atlanta

fundraising software to organizations across the world,

suffered a traditional-style ransomware attack. Key in-announced they had successfully fended off a ransomware

frastructure servers were encrypted and the bad actors

attack. In cooperation with a digital forensics expert anddemanded $51,000 for a decryption method. Atlanta didlaw enforcement, the Blackbaud cybersecurity teamthe right thing – they refused to pay and rebuilt their sys-

had stopped the cybercriminal from encrypting data andtems, which reportedly cost them $9.5 million.

locking them out of their own systems. However, theattacker quickly invoked a Plan B, offering, for a fee, to

The last 18 months have seen the demands increase, un-delete the sensitive customer data they had exfiltrated

fortunately not with normal inflation. Lake City and Riv-from the Blackbaud systems prior to being successfully

iera Beach City in Florida paid $500,000 and $600,000,

removed by the cybersecurity team.

respectively. Lion, an Australian beverage company, refused to pay a $1 million demand and the University ofBlackbaud, shockingly, paid an undisclosed sum to the

California San Francisco had a demand for $3 million andextortionist on condition that proof of deletion was pro-paid $1.1 million. In a little over two years, the demands

vided. The resilience of having a Plan B paid dividends formade on Atlanta seem miniscule, but there is definitely

the cybercriminal, despite the heroic efforts of the teams

an unwanted increase in the amount being demanded –that thwarted the attack. Had the attack been limited toa trend that is very likely to continue.

the more traditional compromise-and-encrypt scenario,
we might never have even heard about the breach. Nev-

The demand for payment in bitcoins is not the only met-

ertheless, as the data copied (stolen) included personallyric that demonstrates that this is a changing landscape.

identifiable information of individuals, the company was

Coalition, a cyber insurance company that serves 25,000

obligated in some locations by privacy legislation to in-small and midsize businesses in north America recently

form customers and regulators that a data breach had

published a report summarizing claims for the first half ofoccurred.

2020, which of course includes the start of the pandemic.
The report stats “the average severity of claims reported

Thwarted attacks or diligent backup and restore pro-by coalition policyholders increased by 65% from 2019 tocesses may no longer be enough to fend off a committed

2020, in large part driven by the rising costs of ransom-

cybercriminal who’s demanding a ransom payment. The

ware.” The report further details that 41% of all claims are

success in monetizing due to a change of technique – de-ransomware and states that “more recently a number ofspite being more resource-intensive and requiring pa-

ransomware groups are now stealing an organization’stience – offers cybercriminals an increased chance of a re-data prior to encrypting it, and then threatening to pub-turn on investment (ROI) – yes, it’s a “business” judged on

licly expose the stolen data if a ransom is not paid.” The

ROI. In the Blackbaud scenario, the ransomware attack

independent data in the Coalition report provides a dif-neither deployed malicious software nor locked access toferent perspective and confirms the change in the modus

systems or data, another evolution of the term “ransom-

operandi used by cybercriminals and the increase in theware”. This is a trend that, unfortunately, I am sure weamounts being demanded.

will witness more of in 2021.

www.welivesecurity.com

10

3

BEYOND PREVENTION:KEEPING UP WITH THE
SHIFTING SANDS OFCYBERTHREATS
Threat actors always look for ways to make their attacks harder to detectand thwart, including by co-opting a system’s legitimate tools for nefarious
ends. How can cyber defenders keep up?

Ever since the concept of “computer virus” appeared
more than 30 years ago, cybersecurity threats haven’t
stopped evolving; indeed, according to the Global Risks Report 2020 of the World Economic Forum,
cyber threats are among the top risks for humanity
over the next ten years. Add to that the COVID-19
pandemic, which on top of all its dire consequences, has also increased the risks of suffering a security
incident. This was confirmed by the uptick in attack
attempts earlier this year as observed by multiple
organizations, including the United Nations and theUnited Kingdom’s National Cyber Security Centre(NCSC).

Camilo Gutiérrez Amaya
ESET Senior Security Researcher

Against this background, we have witnessed in recent years how cybercriminal groups have turnedto the use of increasingly complex techniques to deploy increasingly targeted attacks. Some time ago,the security community began to talk about “filelessmalware” attacks, which piggyback on the operating
system’s own tools and processes and leverage themfor malicious ends. In other words, the incursions coopt pre-installed applications without the need todrop additional executables on the victim’s system.
Such executables were nicknamed LOLBaS (“Living
Off the Land Binaries and Scripts”) and since the endof 2017 the term began to be used to refer to evasivewww.welivesecurity.com

11Beyond prevention: Keeping up with the shifting sands of cyberthreatstechniques where attackers leverage binary executables

In light of all the above, then, it can be reasonably expect-that are already pre-installed on a system. Since these at-

ed that 2021 will be a year in which incidents leveraging

tacks can be difficult to detect, adversaries adopt these

these techniques will have a greater impact, with sectors

techniques in order to maximize the stealth and effec-

such as critical infrastructure or the financial sector pos-

tiveness of their attacks.

sibly being the most targeted.

WHERE IT ALL STARTEDUNDERSTANDING
THE ATTACK MODELSTO BOLSTER YOUR DEFENSES

It is important to note that the use of these techniques is
not something new. We saw how some malware families
began to abuse these characteristics way back in 2001,

Courtesy of their use of legitimate programs, one of thewhen the Code Red worm appeared. In recent years, how-main distinguishing features of these attacks is that they

ever, these techniques have gained more traction, hav-significantly reduce traces of criminal activity, as the ma-

ing been employed in various cyberespionage campaigns

licious actions are loaded and executed from the com-and by various malicious actors, mainly to hit high-pro-puter’s memory without affecting the file system. Con-

file targets such as government entities. This was thesequently, these attacks generate little-to-no forensic

case with Operation In(ter)ception, which involved attacks

artifacts that cyber defenders can analyze.

against military and aerospace companies in Europe andthe Middle East, as well as with the Evilnum group and its

This may, of course, hamper the detection and, by exten-

attacks on the financial sector.

sion, prevention of these attacks. The attacks are also
particularly effective when an organization’s security is

Many of the tactics, techniques and procedures (TTP)

geared towards whitelist-based detection technologies

leveraged by these groups are outlined in the MITRE

or when it lacks heuristics that provide advanced detec-

ATT&CK® framework. The best-documented TTPs in-tion capabilities.

clude, arguably, those leveraged by APT34, also known
as Lazarus Group, which made a name for itself in cyber-

Since these attacks seek to evade most security solu-

crime with incursions such as the attack on Sony Pictures

tions and thwart forensic analysis, another main featurein 2014, through the attacks against an online casino inunderpinning these techniques is stealth. Attackers rely

Central America in 2017 and lately due to attacks targetingon a system’s native tools such as PowerShell and WMI

financial institutions in Europe. As ESET researchers have(Windows Management Instrumentation), which arefound, the Invisimole group also bases its operations on

designed to facilitate the automation of tasks and thethe use of “living off the land” techniques with a complete

management of operating system settings.

set of tools to carry out cyberespionage campaigns. The
incursions take advantage, for example, of vulnerable

Attackers also often use these methods to achieve per-applications such as Total Video Player or speedfan.sys, insistence, privilege escalation and even data exfiltration,

addition to legitimate components like rundll32 and wom-whereas initial access is still commonly associated withapiexec, in order to remain under the radar.

exploiting vulnerabilities or social engineering cam-That said, even a quick search in the MITRE ATT&CK®

security management strategies that go beyond preven-paigns. Therefore, there’s a need to consider also otherframework about the malicious use of binaries such astion technologies and center on detection and incident

certutil, esentutl or regsvr32, to name just a few, turns up

response.

a large number of threat actors using these techniques.
Even a cursory look at groups that use these three binaries reveals more than 100 different threat actors, including some of the world’s most notorious APT groups, such
as Turla, Machete, Fancy Bear and Cobalt Group.

www.welivesecurity.com

12Beyond prevention: Keeping up with the shifting sands of cyberthreats

SECURITY
CHALLENGES FOR COMPANIESThe key part of an organization’s approach to fending off

Fileless threats have been evolving rapidly and it is ex-

fileless malware in 2021 involves strengthening internal

pected that in 2021 these methods will be used in increas-

processes and procedures that allow integrating tech-

ingly complex and larger-scale attacks. This situation

nologies and people in order to monitor the entire lifecy-

highlights the need for security teams to develop pro-cle of a threat, from the moment an attacker seeks initialcesses leveraging tools and technologies that not only

access into a system all the way until achieving data exfil-

prevent malicious code from compromising computer

tration or some other type of nefarious action. As a result,

systems, but that also have detection and response ca-

it is essential to consider several layers of technologies

pabilities – even before these attacks fulfill their mission.

that allow visibility before, during and after an attack.

Pandemic-induced changes have accelerated the digitaltransformation in 2020, but the upcoming year ushers in

These types of capabilities are achieved with technol-

new challenges for organizations, which should contin-

ogies such as endpoint detection and response (EDR),ue to adopt technologies that allow them to expand their

which enhance the defenders’ visibility into what is hap-visibility into, and monitoring of, anomalous behavior.

pening within a network. In tandem with detection tech-Hence, it is vital for organizations to be equipped withnologies, EDR can increase an organization’s capacity to

the appropriate technical tools and a team of trained

detect suspicious activities and stop behaviors seen as

people who help detect incidents early and respond todangerous, all the while making it possible to investigate

them swiftly.

potential incidents that can be part of a larger attack andto isolate devices that could be compromised.

www.welivesecurity.com

13

4

BAD VIBES:
SECURITY FLAWSIN SMART SEX TOYS

How secure are sex toys? Are vendors doing enough to protect people’s dataand privacy? And why is security so critical when it comes to adult toys?

Cecilia Pastorino

Denise Giusto Bilić

ESET Security Researcher

ESET Security Researcher

It won’t be news to anyone that Internet of Things

though IoT devices have been subject to countless(IoT) devices have vulnerabilities. ESET has foundsecurity breaches leading to the exposure of peo-

serious flaws in multiple smart home hubs and smart

ple’s login details, financial information, and geo-

cameras. Also, ESET researchers recently uncoveredgraphical location there are few kinds of data withKRØØK, a serious vulnerability that affected en-

more potential to harm a user, if published, thancryption of more than a billion Wi‑Fi devices. Al-

those relating to their sexual behavior.

www.welivesecurity.com

14

Bad vibes: Security flaws in smart sex toys

With new models of smart toys for adults entering thefirmware to be changed in the toys. These situations

market all the time, we might imagine that progress iscould lead to DoS (Denial of Service) attacks that block

being made in strengthening the mechanisms to ensure

any commands from being delivered, such as what hap-good practices in the processing of user information.

pened with a smart male chastity cage that has recently

However, many researches have shown that we are abeen proved vulnerable to being exploited by attackers

long way from being able to use smart sex toys with-

who could lock them in masse, potentially trappingout exposing ourselves to the risk of a cyberattack. Now

thousands of users. A device could also be weaponized tothese findings are more relevant than ever as we are see-carry out malicious actions and propagate malware, oring a rapid rise in sex toy sales as a consequence of social

even be deliberately modified to cause physical harm to

distancing measures related to COVID-19.

the user, such as by overheating and exploding.

So how secure are adult toys now and what lies ahead?

Alongside this, we cannot talk about the implications ofHave the necessary precautions been taken to protect

an attack on a sexual device without also reassessing thepeople’s data and privacy? Why is security so criticalsignificance of sexual abuse in the context of the digital

when it comes to sex toys?

transformation that society is going through. What are
the consequences of someone being able to take control of a sexual device without consent? Could that be

HOW SECURITY
COMES INTO PLAY

described as an act of sexual assault? The notion of cybercrime takes on a different appearance if we look at itfrom the perspective of invasion of privacy, abuse of power, and lack of consent for a sex act. Consent obtained

As one can imagine, the information processed by smart

through fraud is no consent at all, and this legislative gap

sex toys is extremely sensitive: names, sexual preferenc-

in current laws will need to be resolved in order to ensure

es and orientations, list of sexual partners, information

the sexual, physical, and psychological safety of users inabout device usage, intimate photos and videos – all

the digital arena.

these pieces of information can result in disastrous consequences if they fall into the wrong hands.
Who could be interested in this type of information?
Many countries have laws that expressly prohibit citi-

ATTACK SURFACE
OF A SMART SEX TOYzens from engaging in certain sexual practices. What would
happen if local authorities launched an oppressive cam-In terms of their architecture, most of these devices canpaign based on the forceful expropriation of data frombe controlled via Bluetooth Low Energy (BLE) from an

the companies that process them, or the exploitation of

app installed on a smartphone. In this way, the sex toysbugs or weaknesses in sex devices as a way to identify,

act as sensors, which only collect data and send it to thelocate, and persecute gays, adulterers or anyone else be-app to be processed. The app is then responsible for set-longing to a minority or social group on grounds of theirting any options on the device and controlling the user’s

sexual choices? In addition, sex toys are not exempt fromauthentication process. To do so, it connects throughthe possibility of being compromised by cyberattackers.

Wi-Fi to a server in the cloud, which stores the person’s

New forms of sextortion appear on the radar if we consid-

account information. In some cases, the app also acts as

er the intimate material accessible through the apps thatan intermediary between various users seeking to use

control these devices.

features like chat, videoconferencing and file transfers,
or if they want to give control of their device to remote

As well as concerns about data confidentiality, we must

users by sharing tokens with them.

consider the possibility that vulnerabilities in the app
could allow malware to be installed on the phone, orwww.welivesecurity.com

15

Bad vibes: Security flaws in smart sex toys

Some vendors offer users the possibility to connect to

We found that both devices had vulnerabilities in thetheir devices by installing software on their computers

implementation of BLE communications, allowing at-

and using a special BLE dongle. You can also use the BLE

tackers to intercept the data being sent and remotely

API in certain browsers to connect to the sex toys using acontrol the devices through BLE MitM (man-in-the-mid-

web app. The numerous ways in which you can connectdle) attacks. This implies that anyone could use a simple

to the devices provide more flexibility, but also increase

Bluetooth scanner to locate and control these smart sex

the attack surface.

toys in their vicinity, similar to what researcher Alex Lo-

So what could go wrong? This architecture presents sev-

discovering sex toys. This vulnerability is very common inmas did back in 2017 while walking the streets of Berlin anderal weak spots that could be used to compromise theIoT devices since most of the models that are available

security of the data being processed: intercepting thein the market do not implement secure paring, which al-

local communication between the controlling app andlows anyone to connect and control them.

the device, between the app and the cloud, between the
remote phone and the cloud, or directly attacking theRegarding the Lovense Remote app, we found some con-backend. Of course, not all attacks take place over net-

troversial design choices that may threaten the confi-

work connections and some malicious scenarios could

dentiality of intimate images sent by users. There was

be launched using malware previously installed on the

no end-to-end encryption, screen captures were notphone or by exploiting bugs in the operating system.

disabled, the “delete” option in the chat did not actuallyerase messages from the remote phone, and users could

Many security researchers ([1], [2], [3], [4], among others)

download and forward content from others without ahave proven that these devices contain security flaws

warning. Also, malicious users could find out the emailthat could threaten the security of the data stored asaddresses associated with any given username and vice

well as the user’s safety. The loopholes ranged from poor

versa. These findings constitute serious privacy concerns,

authentication procedures to devices that constantly

especially in an app specifically designed to share sexual

publicize their presence, allowing anyone to connect tocontent.

them.
The app lets users grant remote control of their devices
In 2016, two researchers presented a talk entitled

via a URL, which includes a 4-digit token. We also en-“Hacking the Internet of Vibrating Things.” They showedcountered security issues with this token that would al-

how information such as intensity, patterns, tem-

low attackers to hijack random remote devices without

perature and user habits were collected by theconsent.

We-Connect application and sent back to the servers withno anonymization at all. Last year, a researcher showed

In the We-Connect app, we realized that sensitive meta-

how easy it could be for an attacker to hack a butt plug con-data was not being stripped from files before they weretrolled over BLE. It was also the first proof of concept

sent, which means that users may have been inadver-where a smart sex device could be weaponized and used

tently sending information about their devices and theirto harm the person using it.

exact geolocation when sexting with another users. This
could be very dangerous, since many users grant control

This year, the ESET Latin America research team present-of their devices to complete strangers by sharing their to-

ed at DEF CON IoT Village new research regarding insecurekens online, both as a personal preference or as part of asmart sex toys. The investigation was based on two devic-“cam girl/boy” service.

es: a wearable device called Jive, manufactured by WeVibe, and the Max male masturbator from Lovense.

www.welivesecurity.com

16

Bad vibes: Security flaws in smart sex toys

BEST PRACTICES TO AVOID RISKS

WHAT’S NEXT?

Smart sex toys are gaining popularity as part of the con-

The era of smart sex toys is just beginning. The latest ad-

cept of “sexnology,” a combination of sex and technology.

vances in the industry include models with VR (Virtual Re-

These practices may well be here to stay, but we must notality) capabilities and AI-powered sex robots that include

forget the potential threats to users’ privacy and intima-

cameras, microphones and voice analysis capabilities

cy.

based on artificial intelligence techniques. The use of

To minimize the risks associated with the use of smart

already a reality.

these robots as replacements for sex workers in brothels is
sex devices, we recommend keeping in mind the following advice:

These sex toys are only a small expression of sexuality in1.

cludes dating apps and other devices such as “virtual girl-the digital world, an area that we could argue also inSome apps offer the possibility to control devices
locally via BLE without creating a user account. If

friends”, the technological manifestation of a bigger so-

you are not planning on letting other users control

ciological phenomenon that is transforming our society

your device remotely over the internet, look for

as IoT devices keep seeping into our lives.

one of these devices.
As has been proven time and time again, secure devel2.

As much as possible, avoid sharing photos or vid-

opment and public awareness will be key to ensuring theeos in which you can be identified and do not post

protection of sensitive data, while we empower users toremote control tokens on the Internet.

become smart consumers who are able to demand better

Avoid registering for sex apps using an official

digital intimacy in the years to come.

practices from vendors in order to maintain control of their
3.

name or email address that could identify you.
4.

Always read the terms and conditions of apps andwebsites for which you register.

5.

Use smart sex toys in a protected environment andavoid using them in public places or areas withpeople passing through (like hotels).

6.

Downloading the apps and trying out their features before buying the device can give you an
overview of how secure the product is. Use searchengines to find out if the model you are thinking of
buying has had vulnerabilities in the past.

7.

Always protect the mobile devices you use to control these gadgets, keep them updated and have asecurity solution installed on them.

8.

Protect the home Wi-Fi network you use for theconnection with strong passwords, securely encrypted algorithms and regular updating of therouter’s firmware.

www.welivesecurity.com

17

CONCLUSION
Even when the tide begins to turn and we resume a measure of pre-pandemic life, weshouldn’t let our guards down. Complacency, they say, is the enemy of progress. It also
happens to be an enemy of security.

When the COVID-19 pandemic struck, much of normal

were quick to adjust their tactics to take advantage oflife ground to a screeching halt and a new reality set in.

the expanding attack surface and the target-rich envi-

Even the Earth itself suddenly became quieter and moved

ronment, including by capitalizing on people’s fear of theless as we hunkered down, carving out working spaces

virus.

in our homes and learning to cope with being cooped up.
The lockdowns and other aspects of what has come to be

The trend of going all-in on remote work also helped

called the new normal brought about changes in our col-uncover and address some privacy and security issues

lective habits and even shifts in our perceptions of timein platforms that after a surge in popularity attracted aand place.

wave of scrutiny. These developments, in turn, helped
make it abundantly clear that the security side of things

With the world in the throes of the worst crisis in decades,

needs to be a top priority for everybody, a fact made all

we’ve had to come to grips with heightened uncertainty

the more salient as technology was instrumental in deal-

about health, relationships, finances and the future. The

ing with the widespread social disruption.

pandemic and its ripple effects have taught us a slew ofscience terms and caused many of us to reinvent our-Then there’s also a long list of familiar threats, such as

selves. Even more importantly, however, the pandemic

ransomware, that didn’t go anywhere this year. Rather

has taught us some important life lessons, bringing into

the contrary, they continued to evolve, which is whatsharp relief what is important and what isn’t.

they normally do, and hit the victims harder than everbefore. Our review of the recent major developments on

As stay-at-home orders were put in place, our lives shifted

the ransomware scene, showed how the stakes are go-

into the online realm and the digital transformation was

ing up for the victims, as well as that these attacks are apushed into overdrive. Technology is helping us maintainpersistent reality that will, as cliché as it sounds, contin-

some social and emotional wellbeing and support theue to evolve.

public health response to the pandemic. Working patterns were also upended as many companies scrambled

It’s that time of year when we pause to look back at

to keep their operations running by taking their businessthemes that defined the year that’s ending, as well as

online and pivoting to a remote workforce almost over-reflect on what lies ahead for us. While this process hasnight. The internet has become almost our sole windowa ring of familiarity to it, a lot feels – and is – different

into the world.

this time. Still, we need to look ahead, including into

These realities, however, also conspired to create agins to turn and we resume a measure of normal life,

the post-pandemic future. And even when the tide benear-perfect storm of cyber-risks. Organizations and thewe shouldn’t let our guards down, be it offline or online.

newly distributed workforce had to swim (or sink) in the

Complacency, they say, is the enemy of progress. It also

largely uncharted waters of remote work, often unwit-

happens to be an enemy of security.

tingly revealing chinks in their armors. Cybercriminals

www.welivesecurity.com

18