Netacea: Cybersecurity Threat Predictions for 2020
James Maude, Head of Threat Research at Netacea, makes his expert predictions for 2020, identifying likely attack vectors and reflecting on the growing sophistication of attacks
1: AI – the double-edged sword to watch out for
We’re set to see further advancements in artificial intelligence (AI) in 2020 – and its influence on many industries, particularly cyber security. These developments have the capacity to help those on both sides of the battlefield; the cybersecurity experts and the cybercriminals.
AI is the perfect partner for cyber defence, but the same AI-based security tools organisations use to detect threats are increasingly used by attackers to launch more sophisticated attacks, discover new vulnerabilities and carry out tasks such as efficiently mining data sets to find user credentials.
Consider, for example, the scam targeting a UK-based energy firm that took place earlier this year. Criminals used AI-based software to impersonate a chief executive’s voice and demand a fraudulent transfer of €220,000. What cybercrime experts would today describe as an unusual case of artificial intelligence being used in hacking, is at risk of becoming the norm.
While AI offers significant security advantages, organisations need to remain vigilant – and make sure they are moving at the same pace as attackers. By resting on their laurels, businesses are at risk of falling victim to attacks. Developing a true understanding of the traffic on platforms – not just the nature, but the intent – will protect businesses in 2020.
2: Risk landscape – it’s time to go back to basics
Despite cybersecurity investment increasing each year between 12 to 15% according to Gartner, organisations are struggling to keep up with the sophistication of threats. Attackers are successfully pivoting away from complex technical exploits and instead are identifying simpler ways to exploit a business’s core functionality; the business’s logic.
Business logic attacks are on the rise and pose a significant security threat to organisations across all sectors in 2020. These attacks don’t target what many consider to be traditional security vulnerabilities, but instead use automated bots to exploit weaknesses in the normal, everyday use of a website or app.
The recent Just Eat and Deliveroo hacks are good examples. Each food delivery service relies on a great customer experience and zero friction, to provide customers with this level of convenience, features such as one-click ordering and the storing of card details are incorporated into the service’s core functionality. However, bot technology simplifies the practice of fraudulently taking over an account, enabling hackers to commit fraud via the account or sell on the verified username and password for a profit. In such instances, organisations often remain unaware that any untoward behaviour has taken place and so are unable to stop it in its tracks.
Taking preventative steps is vital. Businesses must focus on identifying bot intent, by not only asking “Is this a bot?” but also “What is this bot doing?”. Once they have gained this visibility and understanding of their web-facing traffic, they can both stop the attack and mitigate risks.
3: Streaming services will be the next target
The popularity of Netflix, Amazon Prime and Hulu makes streaming services a prime target for account takeover hackers. Over the past 12 months, we’ve seen a rise of in the sales of compromised streaming services accounts. With the launch of new services such as AppleTV+ and Disney+, we don’t see this slowing down anytime soon.
These new platforms represent a new high-value service that is virgin territory for thousands of previously breached credentials. In fact, just hours after the Disney+ launch in the US, Canada and the Netherlands, accounts and combo lists were put up for sale on hacking forums.
Like food delivery companies, streaming services are facing intense competition. That means the products and services they roll-out must be as frictionless as possible, including their login systems. Therein lies the problem. These login systems naturally drive consumers to use simple, short passwords and the same password for various platforms, to make it easier to login on TVs and smart devices every time they want to watch a series or movie. On the other hand, this also makes it easier for criminals to access customer accounts using automated bots, like the recent Just Eat and Deliveroo hacks demonstrated.
The fact that users connect to their accounts when on holiday or at friends’ homes only adds to the issue. Streaming and delivery services find it harder to recognise when an account has been genuinely compromised and put the necessary, security processes in place.
As we head into 2020, streaming services need to improve their understanding of what bots are doing and not just how they are doing it. By doing so, they can start to manage good bots and rapidly mitigate malicious bot attacks, without adding friction to the customer journey.
4: Watch out for free VPNs
Earlier this year, the Motion Picture Association of America (MPAA) reported that at 613.1 million, streaming subscriptions had now surpassed cable subscriptions worldwide; the list of subscription services will continue to grow in 2020 with some big names announcing plans to launch new services.
And with all growth comes new challenges. As the number of streaming services increases, more consumers are going to use VPNs to watch movies or TV shows when visiting a country and most likely use those that are free. However, some of these “free” VPN services aren’t completely free, there is always a price to pay; whether it is monetary or otherwise. Free VPN providers often require users to forego either: speed, bandwidth or your security. Sometimes all three.
VPNs used by residential users include the right for the provider to make that connection available for use by automated bot traffic that wants to automate web requests from genuine residential addresses. These ‘residential proxy’ networks are essentially legitimate commercial botnets.
But because there is no infrastructure associated with running them, they are not detected by standard IP address blacklists and they use real consumer devices, so device-based fingerprinting will appear as a real user. Cybercriminals are taking advantage of residential proxies to perform different illegal or unauthorised activities on users’ machines. It is therefore important to diligently research a VPN provider, ensuring you thoroughly read the terms and conditions, before installing any VPN software; especially as more streaming services get launched in 2020.
