Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

3/5/2019
10:30 AM
Chris Rouland
Chris Rouland
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Artificial Intelligence: The Terminator of Malware

Is it possible that the combination of AI, facial recognition, and the coalescence of global mass-hack data could lead us toward a Skynet-like future?

For many of us, The Terminator series introduced us to the potential dangers of artificial intelligence (AI). As Skynet's advanced AI became self-aware, it concluded that humanity was a threat to its existence and sprang into self-preservation mode, ultimately triggering a nuclear holocaust and deploying an army of Terminators to battle the resistance.

While this was purely fictional back in 1984, 35 years later, AI-powered threats are the new reality and raises the question: Are we headed for a Skynet-like future in which AI takes over the world? Perhaps we're not quite there yet, but the ingredients are all there and it could be a potential recipe for disaster.

As our understanding of AI progresses and evolves, AI attacks will get more sophisticated and continue to improve. Maturing open source machine learning tools like TensorFlow from Google and others will be used in malcode, distributing even more damaging botnets, viruses, worms, trojans, targeted phishing expeditions, and so on. Of particular concern is the combination of machine learning, automated facial recognition and huge amounts of data in recent dumps. This  puts billions of people at risk of being compromised more than ever before.

One recent data dump is now raising alarm flags because it has the potential to affect millions of people. Known as Collections #1–5, well over 2 billion usernames and passwords were dumped onto the Dark Web. With data the foundation of AI, hackers can now carry out machine learning-based operations that leverage automated facial recognition and the information in Collections #1–5 to traverse social media networks and other sites to carry out automated spearphishing campaigns and a variety of other villainous exploits.

An AI populated with billions of email password pairs has a huge head start on leveraging evasive and powerful attack tools such as DeepLocker and Social Mapper. Consider the kill chain of shared credentials between corporate and personal emails. That's a very soft target for the Terminator of malware. Even if only 1% of the passwords in the "Collections" are still accurate and shared across accounts, that is well over 20 million vulnerable victims. From statistical analysis, we know the rate is far higher than that.

So, how bad could it get? Realistically, a mass collective hive of botnets with knowledge of credentials, email, facial recognition, and social networks could make AI phishing lures that will be make email unusable. Theoretically, with Collections #1–5 at its disposal, Skynet could now take over the world.

Which leads us to the need for a Resistance. Fortunately, Skynet does not exist… at least, not that we know of. But it will take a lot more than John Connor to win the AI war with cybercriminals. It will take a global coalition of brilliant minds and organizations from the private and public sectors fighting fire with fire, deploying AI-based security solutions that can keep pace, outmaneuver, and outthink these AI-powered attacks. The US Department of Defense echoed this sentiment in a recently unveiled summary of its official artificial intelligence strategy:

We cannot succeed alone; this undertaking requires the skill and commitment of those in government, close collaboration with academia and non-traditional centers of innovation in the commercial sector, and strong cohesion among international allies and partners. We must learn from others to help us achieve the fullest understanding of the potential of AI, and we must lead in responsibly developing and using these powerful technologies, in accordance with the law and our values.

Perhaps the late Stephen Hawking said it best: "Unless we learn how to prepare for, and avoid, the potential risks, AI could be the worst event in the history of our civilization."

Or as the Terminator might say: "Hasta la vista, baby."

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Chris Rouland is Co-Founder and Chief Executive Officer of Phosphorus Cybersecurity, Inc. A 25-year veteran of the information security industry, Chris is a renowned leader in cybersecurity innovation and disruption. In his career, Chris has founded and led several ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
Can Your Patching Strategy Keep Up with the Demands of Open Source?
Tim Mackey, Principal Security Strategist, CyRC, at Synopsys,  6/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12881
PUBLISHED: 2019-06-18
i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact via crafted ioctl calls to /dev/dri/card0.
CVE-2019-3953
PUBLISHED: 2019-06-18
Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 10012 RPC call.
CVE-2019-12133
PUBLISHED: 2019-06-18
Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system ...
CVE-2019-12592
PUBLISHED: 2019-06-18
A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers to run arbitrary web script or HTML in the context of any loaded 3rd-party IFrame.
CVE-2017-8328
PUBLISHED: 2019-06-18
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross site request forgery prot...