Get All Access for $5/mo

Automated Cyber Attacks Are the Next Big Threat. Ever Hear of 'Review Bombing'? Nonhuman, automated attacks on their own will be able to find and breach even well-protected companies. Nervous? You should be.

By Larry Johnson Edited by Dan Bova

Opinions expressed by Entrepreneur contributors are their own.

Hiroshi Watanabe | Getty Images

If you think hacks are bad now, just wait a few more years-- because "the machines" are coming.

Related: 3 Ways To Protect Your Company's Website From Cyber Threats

In the next few years, artificial intelligence, machine learning and advanced software processes will enable cyber attacks to reach an unprecedented new scale, wreaking untold damage on companies, critical systems and individuals. As dramatic as Atlanta's March 2018 cyber "hijacking" by ransomware was, this was nothing compared to what is coming down the pike once ransomware and other malware can essentially "think" on their own.

This is not a theoretical risk, either. It is already happening. Recent incidents involving Dunkin Donuts' DD Perks program, CheapAir and even the security firm CyberReason's honeypot test showed just a few of the ways automated attacks are emerging "in the wild" and affecting businesses. (A honeypot experiment, according to Wikipedia, is a security mechanism designedto detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems.)

In November, three top antivirus companies also sounded similar alarms. Malwarebytes, Symantec and McAfee all predicted that AI-based cyber attacks would emerge in 2019, and become more and more of a significant threat in the next few years.

What this means is that we are on the verge of a new age in cybersecurity, where hackers will be able unleash formidable new attacks using self-directed software tools and processes. These automated attacks on their own will be able to find and breach even well-protected companies, aand in vastly shorter time frames than can human hackers. Automated attacks will also reproduce, multiply and spread in order to massively elevate the damage potential of any single breach.

Feeling nervous? You should be. Here are a few ways that automated attacks are evolving:

Password guessing

Crack a password, and you own the account. For years, hackers have been developing better tools to do just that.

One new innovation is an automated cyber attack called "credential stuffing," which uses previously stolen passwords to break into online accounts. This attack is extremely effective -- and dangerous -- because so many people reuse their passwords across multiple accounts. This creates a major blindspot for businesses, because even if their security is up to par, all it takes is one sloppy employee, and the whole company can unravel.

Expect these attacks to increase significantly next year, especially since there is now a glut of stolen password databases for sale in the Dark Web. Hackers recently used credential stuffing to target Dunkin Donuts' DD Perks rewards program. More businesses will fall victim to it in 2019.

Related: The Growing Menace of Cyber Attacks in the Asia-Pacific region

However, credential stuffing is just the tip of the iceberg.

Researchers have discovered that machine learning programs can be used to predict the passwords a person will create in the future based on what he or she has used in the past. Think about that for a second. This means that if a person loses a couple of passwords to data breaches over the years (and we all know how easily that can happen), that person could -- in theory at least -- be forever vulnerable to password attacks in the future by malicious AI systems scanning the web. This could lead to continual password breaches, which will be very hard to stop.

Hacker bots

New research shows that hackers are beginning to use fully automated "bots" which can carry out extensive cyber attacks all on their own.

Bots are nothing knew: Hackers have been using rudimentary versions of them for years to send spam and scan the web. However, a recent honeypot experiment shows just how far this technology has evolved: When security researchers set up a fake online financial firm, they were shocked to see what a single bot could do. In just 15 seconds, the bot was able to hack into the fake company, gain complete control of its network, scan for employee workstations and steal all the data it could. Again: This all took only 15 seconds.

At that rate of speed, it would be exceedingly difficult for an IT team to respond. And these attacks will become increasingly common over the next few years.

Malicious chatbots

Commercial chatbots are widely used, and they are expected to save companies up to $11 billion by 2023, according to a Juniper estimate. But what happens when a chatbot goes rogue?

We've already seen how easily a benign chatbot can be corrupted by "input manipulation" on the web, as in the case of Microsoft's Tay.

But cybercriminals can go much further, by hacking the bot or infecting it with malware in order to turn it into an information stealer. Ticketmaster's Inbenta chatbot fell victim to this type of attack. Hackers could also target the back-end network supporting the chatbot, like the [24]7.ai breach which affected Delta and Sears.

It is also possible for hackers to create and launch their own chatbots, designed for the sole purpose of tricking people into sharing sensitive information or clicking on malicious links. This is happening already in some dating websites and apps, but it's likely to spread to other businesses in the next few years. Such malicious chatbots could be used to impersonate the legitimate chatbots used by real businesses in order to target those customers.

Bot extortion

A few bad posts on the web can undermine a company's reputation, and cybercriminals are realizing that this is a huge market opportunity for them. With bots, such "brand extortion" is extremely easy -- and cheap -- to accomplish.

The recent attack on CheapAir, a flight price comparison website, is the perfect example: Cybercriminals threatened to launch an SEO attack on the company unless it paid them off. When CheapAir refused, the criminals followed through on their threat -- unleashing a torrent of negative reviews via bots.

"Review bombing" by bots will gain momentum next year and into the future, since this capability already exists and the attack is easy to carry out. Hackers have been extorting businesses for many years with denial-of-service and ransomware, so brand extortion is a logical next step.

Shapeshifter malware

AI is on the verge of transforming malware and attack toolkits into something far more dangerous than what we have ever seen, and many businesses will be caught off-guard.

Hackers are already tweaking traditional malware to make them stealthier and harder to root out of a network, but in the next few years we will see a new evolution in which AI "nerve centers" control and direct malware, turning them into lethal weapons with immense capabilities.

This isn't the beginning of Skynet, but it will have serious repercussions for businesses. Because of its advanced capabilities, intelligence assets, mutability, increased speed, etc., AI-based malware will be better able to hunt down specific targets inside a company, hide from detection tools like antivirus ones and spread rapidly and uncontrollably across a network. It will also mutate itself at will in order to unleash multiple attacks at the same time. These attacks could be crippling to business networks that aren't prepared -- especially smaller companies.

For a better idea of the scary potential with AI-based malware, just look at IBM's DeepLocker. This proof-of-concept malware uses facial and voice-recognition inputs to hunt down a specific human target. Almost like a guided missile.

What smaller businesses can do.

The bottom line for businesses, especially smaller businesses, is that AI will dramatically increase the potential costs of a cyber attack.

Businesses today still struggle with basic attacks like phishing, but in the years ahead, companies will be far outmatched by intelligent, organized, high-speed automated attacks that take no prisoners.

Related: Is Your Business Prepared for a Cyber Attack? (Infographic)

For this reason, it is imperative that companies, and smaller ones in particular, begin to take steps now to limit their risk exposure to AI attacks:

  • The first step is to begin migrating critical assets to more secure cloud platforms, like AWS, Microsoft Azure and Google Cloud, as these are better able to manage the threat.
  • Second, consider signing up for a managed security service provider (MSSP) to safeguard the rest of the local network.
  • Next, be sure to implement a strong password policy, two-factor authentication, employee access control and network segmentation to limit potential damage. Consider taking out a cyber insurance policy, as well.
  • Finally, have a plan in place for when disaster strikes. Know whom to contact in an emergency and what steps to take to limit the damage of a breach, such as disconnecting computers and safeguarding backups.
Larry Johnson

Chief Strategy Officer at CyberSponse

Larry Johnson is chief strategy officer of CyberSponse, a Washington, D.C.-based cyber incident response company serving Fortune 500s and government agencies. He is a 24-year veteran of the Secret Service, where he served as a high ranking supervisor at the Presidential Protection Division as well as special-agent-in-charge of its Criminal Investigative Division. He is also a former chief security officer (CSO) at a Fortune 250 company and a recipient of the International Association of Credit Card Investigators' Police Officer of the Year award and the 9-11 President's Distinguished Service Award.

Want to be an Entrepreneur Leadership Network contributor? Apply now to join.

Editor's Pick

Science & Technology

5 Rule-Bending AI Hacks to Make Your Mornings More Productive and Profitable

By 2025, AI will transform productivity by streamlining workflows and cutting costs. Major companies like Microsoft, Google, and OpenAI are leading the way, advancing AI into "Phase 3," where tools act as digital assistants. Discover 5 AI hacks to boost efficiency and redefine your daily routine.

Business Ideas

63 Small Business Ideas to Start in 2024

We put together a list of the best, most profitable small business ideas for entrepreneurs to pursue in 2024.

Science & Technology

5 Automation Strategies Every Small Business Should Follow

It's time we make IT automation work for us: streamline processes, boost efficiency and drive growth with the right tools and strategy.

Marketing

5 Critical Mistakes to Avoid When Giving a Presentation

Are you tired of enduring dull presentations? Over the years, I have compiled a list of common presentation mistakes and how to avoid them. Here are my top five tips.

Business News

Former Steve Jobs Intern Says This Is How He Would Have Approached AI

The former intern is now the CEO of AI and data company DataStax.