New security threats in 2019 🖥️
Things are set to get worse: new and more powerful ransomware attacks, and even attacks on satellites, are emerging this year.
The latest security breaches, over the past few months, were among the largest ever. As we reported a few weeks ago, the Marriot hotel chain was the victim of a theft in which hackers accessed the personal data of around 500 million of its guests. The only thing on a similar scale was the Yahoo breach of 2013 and 2014, which affected three billion accounts.
Is this a sign of even more serious attacks in 2019? The answer is, without doubt, yes. Cyberattacks have clearly had a huge impact on the global economy over the years. And we should expect them to get even worse, given technical progress, "improvements" in malware and growing aggressiveness.
On top of this, as businesses adopt digital strategies to increase efficiency, cut costs and build data-driven businesses, they also move into hackers' line of fire. As the digital economy grows, the threat follows exactly the same path.
Adding to the situation is the use of machine learning and artificial intelligence. Looking at AI-driven chatbots: we are seeing a substantial rise in cybercrime, faster weaponisation of data, a resurgence of ransomware and a significant increase in nation-state cyberattacks.
A rise in cryptojacking
Last year also saw a rise in cryptojacking, a malicious way of using other people's devices to mine cryptocurrencies. In the past, victims were tricked into installing programs that helped the hacker do this. Now it can be done without installing any software at all.
In other words: the victim is led to pages that contain malware and, from there, the mining code runs automatically using JavaScript.
A substantial rise in software subversion is also expected, including attacks aimed specifically at developers and supply chain attacks. Let's look at the main threats in more detail.
AI chatbots
This year, cybercriminals and the infamous black hat hackers will create malicious chatbots to try to get victims to click on links, download files or share private information.
A hijacked chatbot can quite easily persuade victims to follow malicious links instead of legitimate ones. Attackers are also expected to look for flaws in web apps, even legitimate ones, to insert these chatbots into websites that do not have them.
The black economy: crimeware as a service
Attacking data integrity, disabling computers and forcing physical components, or hardware, to be replaced. These will be the new weapons of groups with links even to terrorism, and the new profile of criminals for hire.
Nation-state attacks
So far, Russia seems to sit at the top of the nations that use cybercrime as part of a wider goal. Early last year, for example, the FBI reportedly uncovered the Russian group Sofacy, a persistent threat that infected more than 500,000 home routers and network-attached storage devices around the world so that it could control them remotely.
More and more nations are likely to do the same, helped by insecure devices and software.
The weaponisation of data
This is already a serious problem and it is likely to get worse, despite the efforts of some tech giants to improve user security and privacy. Weighing up the pros and cons, tens of millions of internet users have started to wonder how much they really need it.
Take Facebook, for example, which has made no secret of using private information and messages to generate billions in profit every year. Users, of course, hand over this data voluntarily because of their interest in brands and pages. But this gives the social network a much broader picture of its user base, which becomes a real gold mine for advertisers.
And, in an even more serious case, Marck Zuckerberg's platform tried, as recently as 2018, to manipulate users' psychological state through an "emotional contagion" experiment. The chosen profiles were set against their peers to influence their emotions. In other words, we saw data being turned into a weapon.
The return of ransomware
This type of attack came onto the scene in 2017, with the major WannaCry hack and a series of other successful attacks on high-profile organisations. According to the FBI, quoted by Forbes, payments to criminals in the United States alone soon exceeded a billion dollars.
According to experts, given a number of attempts in recent months, and the fact that these attacks are cyclical, ransomware is expected to come back in force in 2019.
Software development in hackers' sights
In software development, malware has already been found in some open source software libraries. Meanwhile, in the update supply chain, attacks have hit packages on sale.
When customers download and install the updates, they unknowingly bring malware into their systems. In 2017, there was on average one of these attacks every month, compared with none detected in 2016, according to Symantec.
The trend continued in 2018 and is expected to get worse this year.
More attacks on satellites
In June, Symantec reported that an unknown group had managed to hit the satellite communications of telecoms companies in South-East Asia involved in geospatial mapping. The same company also warned of attacks from China last year that targeted a satellite belonging to a company contracted by organisations linked to national defence.
At the same time, it emerged at the annual Black Hat information security conference last August that the satellite communications used by ships, aircraft and the military are vulnerable to hacker attacks.
In the worst case, this could turn the antennas of these spacecraft into real weapons that basically work like a microwave.
Fortunately, not everything looks bad this year. In cybersecurity, a large number of experts believe two-factor authentication will become practically mandatory for every online business, moving away from access with just a password.
On top of this, some states in Donald Trump's country are reportedly preparing to adapt the European General Data Protection Regulation. California, for example, has already passed legislation that will make it easier for consumers to sue companies if their personal data is breached or accessed unlawfully. This package of new laws is expected to come into force in 2020.
In the end, the consequences are positive, above all for the public, who, together with businesses and government, will really have to do everything possible to improve the overall state of digital security. Obviously, it will not be possible to eliminate flaws completely, but things can always be improved to limit possible damage if they do happen.
