Neil Stephenson imagined a meta-verse in his 1992 novel, Snow Crash. A vision of an interactive computer-generated reality or virtual world. A fully immersive persistent experience that we are all plugged into. Maybe we’re not there yet, but we are far closer today than we were pre-pandemic, and it’s a scary peak into the future power that cyber villains may wield.
We are accessing work and play, friends and information, media and experiences, in the digital realm like never before. In fact, in many forums some may argue that since the pandemic, the digital experience has become the default and primary reality, ahead of the physical (IRL) one. Who’s to say how long that will persist?
My team are well and truly embedded in online tools. Be it Microsoft Teams, Zoom, FaceTime, Houseparty, or even worldwide gaming phenom, Fortnite, which has amassed over 350 million global players. Online experiences from work to leisure and everything in between are blending. The platform may change depending on your mood, where you are and what you’re into, but that digital reality is becoming more ingrained every day.
Societal change is accelerating this shift forward towards a digital existence at an increasing rate. Film, gaming and military applications are maturing and transitioning into mainstream norms from communications to transport, entertainment, IoT and commerce.
But as technology advances, and as our habits blend into virtual ones, the risk of cybercrime is amplified. Graphic design, voice simulation, deep fake visualisations, big data, AI, AR, VR, and global interconnectivity, plus more, mean that we can virtually manifest an identity, at anytime, anywhere on the planet. And it can be near impossible to tell who is truly on the other side.
Caveat emptor / Buyer beware: Keep your hands inside the carriage!
If life were a theme park, the guides would be advising us to ‘take caution past this point’. Sophisticated cyber networks are at play, and they’re targeting the weakest link, us.
Who they are is the subject for another discussion: Private criminal networks, powerful individuals, random bedroom bound hackers, or advanced, well-resourced cyber rings sponsored by nation-states? The more important message is that you are at risk.
We’re all familiar with the debate about political intervention in the United States, but it’s happening everywhere. In June, Australian Prime Minister, Scott Morrison, ‘warned that Australia was facing an unprecedented wave of cyber attacks on all levels of government, industry and critical infrastructure.’
As we fast forward to a life immersed in a new digital reality, we must have our eyes wide open. Throughout this year as the adoption of online video calls and meetings became commonplace, replacing business conferences and get-togethers for family and friends, we were warned of the security flaws in platforms like Zoom. Squatters that were joining meetings and listening in to private conversations. Data that was being shared across platforms without the consent or knowledge of users. We learned from that, and the platforms implemented changes, and so we move forward. But in the gaps is where the true perils lie. In the technologies that are perhaps not so widely adopted.
Consider deep fakes. We rely on our own two eyes – “Seeing is believing” has been widely accepted as a universal truth for millennia. It’s an ancient fall back for proof of what is real and true. But how easily that instinct and trust can be conned. We’ve all witnessed the incredibly impressive deep fakes that are emerging. It’s powerful technology which, in the wrong hands, can be used for deception and identity fraud, and it’s at the fingertips of bedroom warriors. Check out these examples from CreativeBloq. It’s scary when you think that we’re just at the beginning for this new and emerging tech. How easily might someone assume your identity, or that of someone you trust. And if you’re not the target, who else in your network might be?
This month there has been much fanfare and celebration of the attempted takedown of the global TrickBot botnet. Regarded as one of the top 3 malware-as-a-service (MaaS) networks, it uses email-based campaigns to infect hosts with ransomware, to steal data, access bank accounts and for wire transfer fraud. The takedown attempt by a coalition of tech companies, including Microsoft, was short-lived and while it disrupted operations, the botnet has since recovered. But if you consider this attempt a window into the future, what will it look like, if or when, these cybercrime networks turn our tactics back on us. We saw the global loss and disruption from WannaCry, but what might a larger more coordinated attack look like? One of the best examples we have is the attack on Ukraine, which most accept was executed by Russia in 2017, targeting major infrastructure, banks, government, media and the energy sector. A cyber war waged with code, data and critical infrastructure. One of the tactics employed is to feed a network bad data, to make it difficult to decipher the real information from fake, but what if that technique were turned around on civilian populations?
Many are aghast at the recent documentary, A Social Dilemma, at the power wielded behind the scenes, turning our own data upon us for manipulation. Frankly, I find it more concerning that so many are surprised. They demonstrate the vulnerability of a society that is beholden to the information that it is being fed, and it highlights the weaknesses of many of our systems, and the potential for nefarious actors to use those tools for malicious reasons, and to advance their own financial interests.
And the very infrastructure itself can also be compromised, evidenced by the global debate about the roll out of 5G networks and the role of Huawei and the Chinese government.
Or on a lower level, with individual devices. WSJ suggests that “experts expect cyberattacks to increase in frequency and severity in the coming years as more consumer goods are sold with internet connectivity embedded by default, WSJ’s Future of Everything reports. Vulnerabilities abound in schools, homes, cars, airlines, cities and other venues.”
The human element – potential for good and evil
While these massive advances in technology and their widespread adoption bring risk, as humans, we do however already recognise some of the limitations. There are for example admirable efforts happening throughout the world to address AI biases. After all, these are ultimately just machines that are making decisions based on data and algorithmic models. They too can be fooled and manipulated, and we as humans understand that fact and can intervene.
Ultimately, the most powerful, nimble and acute super-computer on the planet is the human brain. We must trust it to learn and adapt. To understand the deception and new possibilities in this new world of profound and invasive technology. With education, we can teach ourselves, and our connected human networks, to spot outliers, frauds and fakes. To share and alert others when danger is proximate.
Despite all of the technology, and we are just at the beginning, we must remain eyes wide open to the risks and recognise that ultimately, they are still just new tools that are being employed by cybercriminals to deceive us.
In 1962 Arthur C. Clarke wrote in his book “Profile of the Future: An inquiry into the limits of the possible”, that “Any sufficiently advanced technology is indistinguishable from magic”. With the advancements of technology that we’re seeing today, that sentiment feels more relevant than ever.
We are all – busy, distracted, stressed, and flawed, with our own preconceptions, biases and prejudices – making us easily manipulated and susceptible to a slight of hand, the kind we have fallen for, for centuries. The pick pocket in a hawker’s market, the fortune teller with a crystal ball, or the quick-witted con artist. Today, is not so different. We just have to know they’re there, and that they have malicious intentions. We need to be awake to their tools & techniques, to make it easier to spot them.
And we must be intent to bring the whole herd with us. Most of us chuckle when we hear stories of the tarot reader, the fortune teller or the con artist with their implausible stories, but still there are those among us that are desperate to believe. The same is true with technology. Most hear theories from groups like QAnon, or other end of the world conspiracy theories online, and laugh. Most think they are too far-fetched to be true, but there are others that are convinced in their truth. It becomes their reality, and technology can amplify that experience, playing back messages and views from others far and wide that reaffirms their beliefs.
The point here is that cybercriminals are like the lions and hyenas prowling on the perimeter of the herd. They won’t come for us all. Instead, they lay in wait looking for the vulnerable ones on the fringe. Because they know that if they can get just one of us, then that may be their gateway to seize the credentials they need to access the kingdom.
The metaphor demonstrates how sinister and pervasive cybercrime is and reminds us that there is far more to defending our people, data and reputations, than just technology. We must think about the education that we are giving our teams, and not just our crack Infosec SWAT teams who are well versed in the workings of technology, but also the front line workers, and those in less technical roles like cleaners and contractors who may just be that point of least resistance. That was the case with the massive Target breach which one Gartner analyst estimated might cost the firm $420 million. It was perpetrated by gaining access to the credentials of a third-party HVAC contractor.
The moral of the story
Every day my team is defending businesses against sophisticated, socially engineered, targeted email attacks. They do much the same as what we’ve been pondering. They try to impersonate and trick the user with words and pictures. Using information about the recipient to tailor the email and make it seem more familiar and plausible. They add links to legitimate company websites, make authentic appearing copies of webpages, and add logo’s and legal disclaimers to make us think they’re real. The good ones can be almost impossible to spot. But we must try. It’s the human element, assisted by technology, that is best placed to defend a business.
Technology plays a major role, and it must be leveraged at every opportunity, but let’s not rely on it solely and believe that the job is done, and the risk has abated. It was our rationale for developing our latest solution, MailGuard 365. Co-built with Microsoft to protect Microsoft 365 users. We know threats get through even the most robust defences, so after a traditional mail-exchange vendor has scanned an email, and after it has by-passed Microsoft 365, our new solution sits as the last line of defence to stop anything that has evaded detection. If we are alert to this reality, with teams educated and ready to think before they click, assisted by the latest technology and processes, then we are in the best position to prevail and prosper.
As the technology landscape accelerates and these fraudulent attempts become even more deceptive, we must remain resilient in our resolve to learn and adapt our approaches, and to share our stories, so that we can stay ahead of the adversary.
Stay safe,
Craig
All that it takes to break into your business is a cleverly-worded email message. If scammers can trick one person in your company into clicking on a malicious link, they can gain access to your data.
For a few dollars per staff member per month, you can protect your business with MailGuard's predictive and advanced email security. Talk to a solution consultant at MailGuard today about securing your company's network: expert@mailguard.com.au
