Industry executives and experts share their predictions for 2023. Read them in this 15th annual VMblog.com series exclusive.
From Malicious AI to Y2K38: The top 6 Cyber Threats for 2023
By Tom Van de Wiele, Principal Technology & Threat Researcher, WithSecure
Tom Van de Wiele, Principle Technology & Threat Researcher at WithSecure outlines some of the most pressing cyber-concerns for the coming new year.
#1 – Cheaper GPUs means more potential for experimentation and increased crime-as-a-service development
The change of some of the crypto currency consensus (e.g. Ethereum making the transition from “proof-of-work” to “proof-of-stake” which is more eco-friendly) and the market being able to catch up with demand has resulted in dropped GPU prices. This means that more people will have access to powerful GPUs which can then be monetized. We will see increased experimentation as well as ML/AI that will be repurposed to criminal industries e.g. synthetic AI for written works and art. But also deep-fake generation for video, audio and handwriting; as well as things where ML/AI is already being used for anti-cheat systems for the online gaming world and to devise bypass mechanisms to bypass the detection ML/AI e.g. player pattern analysis. This means that companies should slowly but steadily start prioritizing integrity as part of the data assurance equation and start assuming that just because an image, conference call screenshot or even a written e-mail or signature looks legit, doesn’t mean it is. This means more pressure on PKI implementations or other cryptographic ways of establishing integrity and trust in order to avoid large scale phishing campaigns leveraging these kinds of novel manipulation methods.
#2 – Year 2038 is closer than we think. Strap in and start preparing
We are slowly starting to see ‘Year 2038’ problems with a few expected but also some unexpected impacts where technology plays a role. Anything where the year 2038 already plays a role e.g. calculating of termination dates of contracts, expiry dates of warranty on larger purchases or in the industrial world, etc. The first 2038 problems we will see today and in the next few years leading up to 2038 will have to do with planning, tasking, PKI and other systems where future dates have to be used. The media will make this a frenzy and might potentially blow it out of proportion, which is not necessarily a bad thing. In the case of Y2K, this was positive as it served as an awareness campaign because computers were fairly new to the mainstream population and the impact was limited because of the slow adaption but also because of the awareness. The issue is that the world runs on C/C++ today far more than it ran on COBOL in 2000, as basically all of our major operating systems, libraries and software eco-systems run on C/C++.
This is not something that will just pass us by. Companies will have to perform a non-cursory review of all software used as part of their core business processes, find out what vendors and manufacturers are doing to start having the dialogue to anticipate any potential problems. But also to make sure that processes are in place for reviewing the technology used by supporting services and third parties. Business continuity and disaster recovery planning will go up in the threat maps for most organizations, especially for those that have relied on smaller or bespoke software for which obtaining support is cumbersome, expensive or even impossible and for which alternatives will have to be sought and transitioned to.
#3 – Serendipitous convulsions towards a zero-trust IT estate, but not why you think
COVID-19 along with environmental constraints (can’t get to work because highway melted, hurricane, heatwave) and the current zeitgeist has transformed offices into open offices with “floating” desks. Open offices will continue to be unproductive but serendipitously it has led to the partial implementation of one of the zero trust principles which is that every seating location has the same privileges on the network: none (until proven otherwise with TPM/MFA/PKI after which *some* privileges are given based on the unique but temporary valid set of provided credentials). The second big step is trying to help companies and the industry as a whole with their Active Directory addiction and trying to come up with alternatives that do not result in an “all or nothing” situation. Where even a partial compromise of Active Directory serving as the backbone IAM solution for the majority of organizations means a complete compromise of their digital estate and their data.
#4 – Tipping the scales, now with DDoS on top
Intercontinental disruptions such as fiber optic cable sabotage either on land or underwater will start becoming increasingly orchestrated in combination with DDoS/reflective attacks or a combination of the two. The latter we currently somewhat laugh away and blog/tweet about. Not so much when the backbone’s resilience is already under stress and companies are forced to make plans on an international disaster recovery basis. It is in these situations that impersonation, disinformation and other attacks become more prevalent when the normal methods of verification or integrity checking no longer work as there are less ways of reaching out and getting a second opinion or to verify claims.
#5 – Hybrid attack surface mapping remains an uphill battle for most companies that rushed their cloud transition/integration
Companies will continue to play catch up when it comes to knowing what their actual attack surface is, or what an attacker perceives as the attack surface relating to an organization. Especially with the introduction of so many different cloud services, the transparency levels have reached new lows of opaqueness to the point where companies are involuntarily down-prioritizing their own inventory assessment efforts and have to transfer the risk to their third parties and suppliers while for the most part betting on reactive controls such as detection and response.
#6 – Unethical AI practices and AI abuse/misuse will increase while AI legislation is still being developed and debated
Use of unethical AI practices and the biases that come with them will continue and will only really be addressed when they start happening en mass or for incidents with larger impact. As some of the larger industries start making it mainstream, there will be more data and more potential for abuse/misuse. The EU AI act will help, but the real data about us historically, the apps we use and the data we have produced are not located, processed or monetized in Europe for the most part.
Based on the above, we will have increased cases of “run away data” where on paper and for auditors the data is in a certain location but is enriched outside of certain legislated jurisdictions when it comes to ML/AI. In the same way that we currently do CO2 book-keeping to “buy clean air” from other countries, so too will there be an economy for data enrichment once the first legislation gets passed in certain regions of the world.
In the metal industry, companies spend millions shipping raw aluminum ore to Iceland because of the low cost of geothermal energy. So too will we have countries where data can be “shipped to” digitally, enriched and exported. The more moving parts and data, the more potential for misuse and abuse and thus leaks and real societal impact.
The insurance industry along with special legislation will grow and be further introduced to the market to help manage the risk of data misclassification, prosecution and other data driven decisions coming from ML/AI. Systematic probing of AI/ML will become mainstream and detection for safeguarding AI algorithms will be required to protect the quality of outcome and data as well as detection of manipulation of the algorithms.
##
ABOUT THE AUTHOR
Tom is responsible for performing and validating threat research while exploring potential protection capabilities as part of current and new technology, privacy and other cyber security related focus areas. He has an extensive background in offensive security, red team operations and targeted attack simulations for the financial, gaming and service industry. Tom is an advisor and public speaker on topics such as threat research, offensive security, data protection, critical infrastructure, IoT as well as cyber crime.
https://www.withsecure.com/nl-en/expertise/people/tom-van-de-wiele
