Hacks expose the flaws of the connected world

Over the course of just a few weeks, a series of cyber security incidents have brought home just how fragile our connected world is. In one of the biggest thefts in history, hackers attributed by the FBI to North Korea siphoned more than $6bn worth of cryptocurrency and other digital assets out of Binance, a platform for blockchain finance.

Bizarre hijacks of internet-connected commercial refrigerators have also taken place. Most recently, supermarkets in several European countries reported attempts, some successful, to remotely raise temperatures of fridges and freezers; some cold storage facilities of France’s national blood service were also affected.

Also this month, many websites had to go offline to patch two vulnerabilities that artificial intelligence had uncovered in the ubiquitous software code known as PHP. Last week, a cyber attack drained about €100mn from an internal account of French lender Crédit Mutuel Arkéa.

Who is responsible for many of these incidents is not yet clear. But beyond the disruptions in each specific case, the incidents have common lessons for governments, businesses and individuals.

The digitisation and connectedness of everything — money, information and physical infrastructure in these three cases — has taken place with astonishing speed; it is barely three decades since the internet came into common use. But the large gains in convenience, optimisation across networked facilities and costs saved have come at the cost of increased vulnerabilities.

Decentralisation does not by itself address this. In part, that may be because things may not be as centralised as billed, despite what the hawkers of the cryptoassets bought and sold through Binance may suggest. Binance itself was a centralised node much like a conventional bank; while it initially blamed the cyber attack on a single employee’s compromised laptop, investigators later found hackers had penetrated broader parts of its internal network. Indeed, it was the fact that parts of the blockchain system remained centralised that permitted the quick freezing of some of the digital loot.

In the other instances, too, the lure of convenient networked connectivity was what exposed the systems to damage. The Internet of Things may have allowed supermarket chains to save on energy by optimising their cooling profiles centrally, but malign actors would not previously have been able to hijack refrigerators so easily from afar. With PHP, the unappreciated centralisation was that so many websites were built on the same software, which AI has rendered less secure for everyone.

The second lesson, then, is that AI is fast making these risks much worse. Large language models have proved excellent at spotting bugs and vulnerabilities unnoticed by human programmers. Increasingly, they are also used to impersonate humans or otherwise fool people into lowering their guard.

Part of the solution is to minimise human error. Too many of us take cyber security too lightly or are insufficiently knowledgeable about how to protect ourselves and our data. Governments and businesses can help, with public education campaigns, liability rules and standards. But in the end every user and business must also take responsibility for essential precautions.

Unavoidably, too, AI will force us to devote more resources to security, a case of a productivity-enhancing technology also imposing a greater cost of doing business. In the most critical cases, safety may require “airgapping” or otherwise limiting connectivity, because the gain of being connected is not worth the risk. A fully connected world was a beautiful dream. But it may have been too good to be true.