News of high-profile cyber breaches has been uncharacteristically subdued in recent quarters. However, we recently learned that Marriott International/Starwood was the victim of the multi-year theft of personal information on up to 500 million customers — rivaled only by hacks against Yahoo in 2013 and 2014.
The answer is unequivocally yes. No question, cyber breaches have been a gigantic thorn in the global economy for years. But expect them to be even more rampant in the new year as chronically improving malware will be deployed more aggressively on more fronts.
In addition, as companies increasingly pursue digitization to drive efficiency, reduce costs and build data-driven businesses, they simultaneously move into the “target zone” of cyber attacks. As the digital economy expands, the threat landscape naturally follows suit. Compounding the situation is the use of machine learning and AI as hackers and other bad actors look to scale their bad behavior.
Look for AI-driven chatbots to go rogue, a substantial increase in crimeware-as-a-service, acceleration of the weaponization of data, a resurgence in ransomware and a significant increase in nation-stage cyberattacks. Also on a growth track is so-called cryptojacking — a quiet, more insidious avenue of profit that relies on invasive methods of initial access and drive-by scripts on websites to steal resources from unsuspecting victims.
The emergence of AI-driven chatbots.
In the new year, cybercriminals and black hat hackers will create malicious chatbots that try to socially engineer victims into clicking links, downloading files or sharing private information. A hijacked chatbot could easily misdirect victims to nefarious links rather than legitimate ones. Attackers are also likely to leverage web application flaws in legitimate websites to insert a malicious chatbot into a site that doesn’t have one.
A significant increase in nation-state attacks.
Russia has been a leader in using targeted cyberactions as part of larger objectives. Earlier this year, for example, the FBI disclosed that Sofacy group, a Russian persistent threat actor, infected more than 500,000 home office routers and network attached to storage devices worldwide to remote control them. Look for other nation-states to follow the same sort of playbook, helped by billions of poorly secured IoT devices.
The growing weaponization of data.
Already a huge problem, it is certain to worsen, notwithstanding efforts among some technology giants to enhance user security and privacy. Balancing the negatives with the positives, tens of millions of comprised web users have begun to seriously question how much they really benefit from the internet.
Consider, for example, Facebook, which has made no secret of using personal data and “private” correspondence to annually generate billions of dollars in profits. Users willingly “like” interests and brands, volunteering personal information. This enables Facebook to provide a more complete image of its user base — a gold mine for advertisers.
Much worse, Facebook earlier this year tried to manipulate user moods through an “emotional contagion” experiment. This pitted users against their peers to influence their emotions, i.e. the weaponization of data.
More cyber attacks on satellites.
In June, Symantec reported that an unnamed group had successfully targeted the satellite communications of Southeast Asia telecom companies involved in geospatial mapping and imaging. Symantec also reported attacks originating in China last year on a defense contractor’s satellite.
Separately, we learned in August at the annual Black Hat information security conference that the satellite communications used by ships, planes and the military to connect to the internet are vulnerable to hackers. In the worst-case scenario, the research said, hackers could carry out “cyber-physical attacks” that could turn satellite antennas into weapons that essentially operate like microwave ovens.
Fortunately, the cyber outlook for 2019 is not altogether grim.
On the cybersecurity side, a growing number of experts believe that multi-factor authentication will become the standard for all online businesses, abandoning password-only access. In addition, a number of states are expected to adopt some version of Europe’s strict General Data Protection Legislation. California, for one, has already passed legislation that will make it easier for consumers to sue companies after a data breach, starting in 2020.
The upshot is that individuals, businesses and government entities need to do everything possible to improve the state of their cybersecurity. They cannot eliminate breaches, but they can avert some and improve the chances of mitigating them.