In the past two weeks, the world’s largest cryptocurrency exchange was hacked, and the FBI warned that newly discovered flaws in the coding language behind 70% of the world’s websites left the agency vulnerable to attack.
As more of daily life goes digital, are we more vulnerable than ever to criminals seeking to exploit that dependence?
Yes, but at the same time, those who seek to prevent and defend against cyberattacks also have greater tools at their disposal, said Yinzhi Cao, a Johns Hopkins associate professor of computer science and technical director of the university’s Information Security Institute.
Here is a condensed and edited version of a conversation with Cao.
You have seen the news of the largest crypto hack in history, a heist of $6.3 billion from Binance in the space of 20 minutes. Does it seem like every week there’s a new hacking incident?
So right now it’s crazy.
But it’s not that surprising. It’s just expected given the high capability of artificial intelligence. I’m expecting more incidents to come. It used to take like a month or more for hackers to really hack and create something, and right now it’s just maybe a few hours.
Recently, the FBI warned about vulnerabilities in the common programming language, PHP, urging organizations to apply patches or take down websites if they couldn’t immediately fix the flaw. Did that fix the problem?
PHP is basically a server language. Many web servers that you are visiting are powered by this.
It depends on the PHP version that the website is using. So for newer versions, the patch is pretty easy. But for older versions… to really get the patch there, you may have to do an upgrade. So that will take time. I read that some website owner maybe didn’t sleep for a long time to get this done. It’s very hard to defend against, and therefore the immediate tactic to solve it is just to take it down.
It can take a long time. Previously, there was also another vulnerability called Heartbleed [in 2014]. Even after a few years, there were still vulnerable websites. Similarly, here. I could imagine that after a few years, we might still see old things unpatched.
How can the average user protect themselves in the face of such vulnerabilities in the cybersystems they use every day?
First, this is more of a server-side vulnerability. I don’t think the consumer can do anything. The best thing is to wait for the website owners to patch it. And second, sometimes consumers may have some information being stored on the server side. So in that case, the common practice is to first change your password. Your password may have been leaked, so change your password and also enable two-factor authentication on the website.
Try to be more cautious, especially in the era of AI. Social engineering-related attacks are more advanced now.
I don’t suppose you’ve ever been tricked by spam or a phishing email?
No, we are really careful. Sometimes I even play with spammers and try to trick them. Just try to test them a little bit. We want to understand how they work, so we look at their strategies and what they are trying to look for.
How would you describe the role of AI in cybersecurity, given that it was used both to detect the PHP flaws and in the crypto attack?
It’s two sides of the coin.
Usually, we work at a fairly slow pace, and usually the defense and the attacks are on par. But right now, the attacks are getting faster. Our capability in discovering vulnerabilities is also evolving. So we find more, and then we are trying to defend against them more.
It’s a really big issue right now, and people are studying how to use AI to help them patch and fix vulnerabilities.
It’s always like a game: security researchers and those hackers. And the game is escalating: we add more defenses and they add more attacks. It’s like a shield and like a spear.
Who is winning?
Definitely, we hope we can win. But I think it’s a long-term game, so it’s probably going to take years to really figure it out.
Have the kinds of hackers changed over the years?
So it used to be that maybe state-backed hackers might be more common. But given AI, there are a lot of so-called “script kids,” who just use commercial AI tools. Recent incidents that happened in South Korea, they say that behind it is just some people that who just used a commercial AI tool, and hacked some bank services over there. Even with the lack of real expert hacker knowledge, they could hack into critical services.
Also, there are white hat hackers,so like us, we are trying to help people to defend against those black hat hackers.
Have a news tip? Contact Jean Marbella at jmarbella@baltsun.com, 410-332-6060, or @jeanmarbella.bsky.social.