Is the future of cyber crime a nightmare scenario?

Cyber crime, accord­ing to the Nation­al Crime Agency (NCA) Cyber Crime Assess­ment 2016 report, account­ed for 53 per cent of all crimes in 2015.

Cameron Brown, an inde­pen­dent cyber defence advis­er, who has con­duct­ed research into emerg­ing trends in cyber-crime offend­ing, warns that oppor­tu­ni­ties to earn a liv­ing through cyber crime “will pro­pel the dis­en­fran­chised and those in low­er income bands to pur­sue a life of crime giv­en the low risk and poten­tial high yields”.

Mr Brown insists that cyber crime will con­tin­ue to grow into a high­ly lucra­tive and well organ­ised enter­prise, seek­ing com­pet­i­tive advan­tage with the aid of sophis­ti­cat­ed cyber oper­a­tions. Oper­a­tions that include research and devel­op­ment, with cyber crim­i­nals becom­ing increas­ing­ly inno­v­a­tive as far as the threats they can lever­age are con­cerned.

Jamie Saun­ders, direc­tor of the NCA Nation­al Cyber Crime Unit, argues that “senior mem­bers of UK busi­ness must think seri­ous­ly about ways they can improve their defences and help law enforce­ment in the fight against cyber crime”. And that means they must think seri­ous­ly about the shape those future threats will take.

To deter­mine the future shape of the threat land­scape, we must first look at the seeds which have already tak­en root, start­ing with ran­somware. Secu­ri­ty ven­dor Mal­ware­bytes has a hon­ey­pot to attract unwit­ting attack­ers and says in Decem­ber 2015, 17 per cent of exploit pay­loads were cat­e­gorised as ran­somware; by May 2016 this had risen 259 per cent to 61 per cent.

Ran­somware already dom­i­nates the threatscape, but it’s going to get much worse accord­ing to Liviu Arsene, senior e‑threat ana­lyst at Bit­de­fend­er, who pre­dicts “ran­somware-like attacks will become more preva­lent with the inte­gra­tion of inter­net of things (IoT) and smart sen­sors into our dai­ly lives”.

Mr Arsene envi­sions a sce­nario where a smart home or office is held hostage and the own­ers are asked to pay a fee to regain access to lights and appli­ances, for exam­ple.

Smart cars at risk

Raj Samani, chief tech­nol­o­gy offi­cer, Europe, the Mid­dle East and Africa (EMEA), at Intel Secu­ri­ty, works with the NCA and the Europol Euro­pean Cyber­crime Cen­tre as an advis­er. He sees ran­somware spread­ing to trans­port with the arrival of ever-smarter cars. “It’s only a mat­ter of time before we see instances of peo­ple left help­less, unable to dri­ve their cars unless they pay up a ran­som,” he warns, adding, “we’re not talk­ing dri­ver­less cars here, just a stan­dard mod­ern vehi­cle with con­nec­tiv­i­ty capa­bil­i­ties.”

Con­nec­tiv­i­ty, in par­tic­u­lar the increas­ing­ly con­nect­ed world of devices that is her­ald­ed by the IoT, will be front and cen­tre of any emer­gent threatscape. Strip away the lack of secure think­ing dur­ing the design process and organ­i­sa­tions are left vul­ner­a­ble to cyber attack.

Indeed, one vul­ner­a­bil­i­ty can often rule them all. “Our researchers dis­cov­ered vul­ner­a­bil­i­ties in a super­vi­so­ry con­trol and data acqui­si­tion solu­tion used in the Large Hadron Col­lid­er, sev­er­al Euro­pean air­ports, nuclear pow­er plants in Iran, the largest pipelines, water sup­ply sys­tems, trains and chem­i­cal plants in sev­er­al coun­tries,” Alex Math­ews, EMEA tech­ni­cal man­ag­er at Pos­i­tive Tech­nolo­gies, reveals. In the same way, a sin­gle vul­ner­a­bil­i­ty in a web appli­ca­tion can pro­vide direct access to cor­po­rate infra­struc­tures of myr­i­ad com­pa­nies.

Inevitability of robots

Pre­dict­ing the future of cyber crime isn’t all about evo­lu­tion though, there has to be some rev­o­lu­tion in there. This calls for some seri­ous secu­ri­ty future-gaz­ing and that inevitably means robots.

By 2040 more crime will be com­mit­ted by machines than by humans

“As the work­force moves towards more automa­tion, we could find 35 per cent of jobs now done by humans have been replaced by robots,” says Tracey Fol­lows, chief strat­e­gy and inno­va­tion offi­cer at The Future Lab­o­ra­to­ry. “Futur­ists have been fore­cast­ing a sharp rise in lone-wolf ter­ror attacks for years. But once robots can be hacked to become sui­cide-bomb­ing machines, lone-robot attacks could become rife too.”

What’s more, accord­ing to Ms Fol­lows, arti­fi­cial intel­li­gence and machine-learn­ing could enable robots to self-pro­gramme crim­i­nal activ­i­ty. “My fore­cast would be that by 2040 more crime will be com­mit­ted by machines than by humans,” she says.

Dri­ver­less cars will be our trans­porta­tion real­i­ty in the years to come and that’s anoth­er oppor­tu­ni­ty for cyber crime right there. “If you can con­vince the vehi­cle its GPS teleme­try is wrong with a sig­nal jam­mer,” says Aaron Yates, chief exec­u­tive at Berea, “you will be able to pil­fer vehi­cles at leisure.”

Hijacking drones

But if you think dri­ver­less cars are prob­lem­at­i­cal, what about deliv­ery drones? Already being test­ed by the likes of Ama­zon, what if deliv­ery drones were hijacked and deliv­er­ies stolen? What if they were herd­ed by the hun­dreds into fly­ing bot armies? Art Swift, pres­i­dent of the prpl Foun­da­tion, fears drones could be dropped on to a motor­way or flown into a plane on take-off.

And it’s not just drones that could be herd­ed by hack­ers, humans could be as well. Dar­ren Thom­son, chief tech­nol­o­gy offi­cer of Syman­tec, pre­dicts that cyber crim­i­nals could take down an entire rail­way by hack­ing the infor­ma­tion dis­play boards.

“No one knows where to go for their train, the sta­tion atri­um would fill up caus­ing a phys­i­cal or ter­ror­ist risk for that space,” says Mr Thom­son. “We are becom­ing so reliant on tech­nol­o­gy that it could poten­tial­ly be used to pool peo­ple in a par­tic­u­lar place.”

Hack­ers could decrypt sen­si­tive infor­ma­tion on the inter­net with enor­mous reper­cus­sions

Future-gaz­ing would not be com­plete, though, with­out men­tion of quan­tum com­put­ers. “In about a decade we may reach a tip­ping point in the world of cryp­tog­ra­phy, as a prac­ti­cal quan­tum com­put­er will become a real­i­ty,” says Michael Scott, chief cryp­tog­ra­ph­er at MIRACL.

This means that most cur­rent meth­ods of cryp­tog­ra­phy would be ren­dered use­less overnight. “It’s not unfea­si­ble that hack­ers could decrypt all the sen­si­tive infor­ma­tion we cur­rent­ly store on the inter­net – bank­ing details, tax records, iden­ti­ties, cor­po­rate and legal data – with enor­mous reper­cus­sions,” says Mr Scott.

We will leave the final word to ex-FBI counter-ter­ror­ism oper­a­tive and cur­rent nation­al secu­ri­ty strate­gist at Car­bon Black, Eric O’Neill, who doesn’t think this nec­es­sar­i­ly means an unhap­py end­ing as far as the vic­tim­i­sa­tion of busi­ness is con­cerned.

“In the near future, preda­tors will become the prey,” Mr O’Neill pre­dicts, as secu­ri­ty teams increas­ing­ly become proac­tive in hunt­ing for threats. “As the good guys become more active in reme­di­at­ing threats before hack­ers launch their attacks, espi­onage and dig­i­tal fraud will become far less eco­nom­i­cal­ly ben­e­fi­cial for the bad guys, giv­ing us a far bet­ter chance of keep­ing them out.”