AI Ushers In A Whole New Era Of Hacking

Hackers won't necessarily always be human. Artificial Intelligence (AI) is a technology that also promises to revolutionize cybersecurity, could one day become the go-to hacking tool.  

Organisers of the Cyber Grand Challenge, a contest sponsored by the US defense agency DARPA, gave a glimpse of the power of AI during their August event. Seven supercomputers battled each other to show that machines can indeed find and patch software vulnerabilities.

Theoretically, the technology can be used to perfect any coding, ridding it of exploitable flaws. But what if that power was used for malicious purposes? The future of cyber defense might also pave the way for a new era of hacking.

The possible dangers

For instance, cyber-criminals might use those capabilities to scan software for previously unknown vulnerabilities and then exploit them for ill. However, unlike a human, an AI can do this with machine efficiency. Hacks that were time-consuming to develop might become cheap commodities in this nightmare scenario.

It’s a risk that the cybersecurity experts are well aware of, in a time when the tech industry is already developing self-driving cars, more advanced robots, and other forms of automation. "Technology is always frightening," said David Melski, vice president of research for GrammaTech.

Melski's company was among those that built a supercomputer to participate in August’s Cyber Grand Challenge. His firm is now considering using that technology to help vendors prevent flaws in their internet of things devices or make Internet browsers more secure.

"However, vulnerability discovery is a double-edge sword," he said. "We are also increasingly automating everything."

So it’s not hard for security experts to imagine a potential dark side, one where AIs can build or control powerful cyber weapons. Melski pointed to the case of Stuxnet, a malicious computer worm designed to disrupt Iran's nuclear program.  

"When you think about something like Stuxnet getting automated, that’s alarming," he said.

Tapping into the potential

"I don’t want to give any ideas to anyone," said Tomer Weingarten, CEO of security firm SentinelOne. But AI-driven technologies that crawl the internet, looking for vulnerabilities, might be among the future realities, he said.

That streamlining of cybercrime has already taken place. For instance, buyers on the black market can hire "rent-a-hacker" services, built with slick web interfaces and easy-to-understand commands, to pull off cybercrime like infecting computers with ransomware.  

Weingarten said it's possible these rent-a-hacker services may eventually incorporate AI technologies that can design entire attack strategies, launch them, and calculate the associated fee.  "The human attackers can then enjoy the fruits of that labor," he said.

However, the term AI is a loaded one. Tech companies may all be talking about it, but no company has created a true artificial intelligence. The industry has instead come up with technologies that can play games better than a human, act as digital assistants, or even diagnose rare diseases.

Cybersecurity firms such as Cylance have also been using a subset of AI called machine learning to stop malware. That's involved building mathematical models based on malware samples that can gauge whether certain activity on a computer is normal or not.

"Ultimately, you end up with a statistical probability that this file is good or bad," said Jon Miller, chief research officer of the security firm. More than 99 percent of the time the machine learning works to detect the malware, he said.

"We're continually adding new data, of malware samples, into the model," Miller said. "The more data you have, the more accurate you can be."

Escalation

A drawback is that using machine learning can be expensive. "We spend half a million dollars a month on computer models," he said. That money is spent on leasing cloud computing services from Amazon to run the models.

Anyone who attempts to use AI technologies for malicious purposes might face this same barrier to entry. In addition, they'll also need to secure top talent to develop the programming. But over time, the costs of computing power will inevitably decrease, Miller said.

Still, the day when hackers resort to using AI may be far off. "Why hasn’t this been done? It’s just not necessary," he said. "If you want to hack somebody, there are already enough known flaws in everything."

To this day, many hacks occur after a phishing email containing malware is sent to the target. In other instances, the victims secured their logins with weak passwords or forgot to upgrade their software with the latest patch – making them easier hack.

AI technologies like machine learning have shown the potential to resolve some of these problems, said Justin Fier, director for cyber intelligence at security firm Darktrace. But it may only be a matter of time before the hackers eventually upgrade their arsenal.

That will pit cybersecurity firms against the hackers, with AI on the frontlines. "It seems like we’re heading into a world of machine versus machine cyber warfare," Fier said.

CIO:            Five Things AI Can Do Better Than Humans:

 

« Cyber Police Stations Across India
Critical Cybersecurity Protocols To Implement »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

K2 Integrity

K2 Integrity

K2 Integrity is a preeminent risk, compliance, investigations, and monitoring firm - built by industry leaders to safeguard our clients’ operations, reputations, and economic security.

Rogue Wave Software

Rogue Wave Software

At Rogue Wave, our mission is to simplify your hardest problems, improve software quality and security, and shorten the time it takes to deliver value.

Balbix

Balbix

Balbix BreachControl™ is the industry’s first system to leverage specialized AI to provide comprehensive and continuous predictive assessment of breach risk.

Tesorion

Tesorion

Tesorion is a fusion of different enterprises each with its own specialisation in the field of cybersecurity. We have combined these specialisations to create an integrated comprehensive solution.

CHT Security

CHT Security

CHT Security is a Managed Security Service Provider (MSSP) specialized in cyber security technologies enabling enterprises to defense against cyber threats to networks, gateways and endpoints.

WisePlant

WisePlant

WisePlant's portfolio of solutions and services includes process measurement, secure automation, industrial cybersecurity, functional safety and more.

Bolt Learning

Bolt Learning

Bolt's Cyber Security eLearning module provides users with an in-depth understanding of cybercrime, how it can occur and what everyone can contribute to preventing it.

Tangible Security

Tangible Security

Tangible employs the most sophisticated cyber security tools and techniques available to protect our clients’ sensitive data, infrastructure and competitive advantage.

SilverSky

SilverSky

SilverSky offers a comprehensive suite of products and services that deliver unprecedented simplicity and expertise for compliance and cybersecurity programs.

Zemana

Zemana

Zemana provides innovative cyber-security solutions to deal with complex malicious software and other cyber threats.

8com

8com

8com is an established Managed Security Service Provider (MSSP) with over 75 employees and customers in over 40 countries.

ID R&D

ID R&D

ID R&D is an award-winning provider of AI-based facial liveness, document liveness, and voice biometrics.

Finlaw Associates

Finlaw Associates

Finlaw Associates is a trusted cybercrime law firm providing a wide range of taxation, legal, advisory and regulatory services to the financial, commercial and industrial communities.

SyberFort

SyberFort

SyberFort offers a suite of SAAS-based platforms designed to fortify your digital defenses including Threat Intelligence and Brand Protection.

Driven Technologies

Driven Technologies

Driven is a cloud native service provider transforming the way companies leverage technology to improve business by securing, modernizing, and connecting applications, users, and data.

Argantic

Argantic

Argantic aims to help organisations thrive and reach their full potential in a modern cloud-centric era.