TechRisk #83: zero-click prompt attack on GenAI
Plus, $75M ransom paid, challenges running AI companies, shadow AI and data, root cause to Convergence hack and more!
Tech Risk Reading Picks
GenAI pompt-based malware: A new cybersecurity threat known as "Promptware," targeting generative AI (GenAI) applications. Unlike traditional malware, Promptware can execute harmful actions without user interaction, exploiting the AI's prompt-based interfaces. This zero-click attack method allows hackers to embed malicious prompts within seemingly innocuous inputs, potentially leading to data breaches, unauthorized access, or system manipulation. The rising popularity of GenAI tools increases the risk, highlighting the need for enhanced security measures in AI-driven applications. [more]
Challenges running AI companies: One of the key challenges for large AI companies is to operate ethically and pursue profit. Some companies often prioritize innovation and market dominance over ethical considerations, leading to challenges such as bias, privacy concerns, and the potential misuse of AI technologies. Balancing the drive for advancement with the need for ethical responsibility remains a significant struggle for the industry. [more]
Shadow AI and data risk: There are growing dangers of "shadow data" and "shadow AI," which refer to unmanaged, unmonitored data and AI systems that operate outside official oversight. These hidden elements pose significant risks, leading to higher costs in data breaches due to the complexity of detecting and mitigating them. It is important to have robust data security strategies, including encryption and Data Security Posture Management (DSPM), especially as generative AI becomes more prevalent in organizations. A proactive, data-first approach is crucial for mitigating these risks. [more][more-Data_Breach_Report_2024]
AI-fuelled threats: Scammers are increasingly using generative AI tools, such as FraudGPT and WormGPT, to launch sophisticated identity attacks and fraud campaigns. These tools are easily accessible on the dark web and allow even novice fraudsters to create realistic fake identities, deepfakes, and phishing schemes with minimal effort. The rise in these AI-driven scams has led to a significant increase in fraud cases in Australia and New Zealand. Organizations are advised to adopt advanced technologies and unified fraud prevention strategies to counter these evolving threats. [more][more-report]
$75M ransomware attack: A Fortune 50 company reportedly paid a record-breaking $75 million in response to a ransomware demand. This event underscores the escalating scale and impact of ransomware attacks on large corporations. The payment was made after the attackers encrypted critical data, threatening the company with significant operational disruption if the ransom wasn't met. [more]
Suspected attack targeting Israeli airport websites: A cyberattack has reportedly targeted Israeli airport websites, particularly affecting Ben Gurion Airport in Tel Aviv, leading to significant disruptions. The attack caused the airport's website to become inaccessible, and many flights were canceled. Israeli media attributed the website outage to heavy traffic, though it is believed to be part of a broader cyber offensive. The incident has raised concerns over the security of critical infrastructure in the region. [more]
Cyber insurers’ concerns: The rising cybercrime trends that have heightened concerns among insurers. Key risks include AI-induced vulnerabilities, sophisticated ransomware attacks, business email compromises, and supply chain attacks. These threats are exacerbated by global geopolitical tensions and the interconnectedness of corporate networks. Insurers are responding by enhancing cyber insurance products, including removing sublimits on ransomware and expanding coverage for email compromises. [more]
Crowdstrike outage saga:
Microsoft attributed its struggle to recover from a global IT outage to Delta Air Lines, suggesting that Delta's IT systems were particularly difficult to restore.[more]
CrowdStrike indicated that it strongly rejects any allegation that it was grossly negligent or committed misconduct for Delta Air Lines' recent cyber outage and mentioned that the company's CEO personally reached out to Delta's CEO to offer onsite assistance, but received no response. [more]
Web3 Cryptospace Spotlight
Enhanced Web3 security with AI: Researchers from Polygon Labs, in collaboration with leading AI companies, are utilizing artificial intelligence to enhance blockchain security. This initiative aims to address vulnerabilities and improve the robustness of blockchain technology. The team also focused on developing AI-driven solutions that can proactively identify and mitigate potential threats, ensuring safer and more secure blockchain environments. [more]
Ronin - hacked again: A recent hack on the Ronin Bridge resulted in the theft of $10 million (approximately 4,000 ETH). The attack appears to be linked to a sophisticated Miner Extractable Value (MEV) exploit, which manipulates transaction ordering on the Ethereum network. This incident prompted Ronin to suspend its operations temporarily to prevent further breaches. Notably, this isn't the first time Ronin Bridge has been compromised; it suffered a major $615 million hack in 2022, raising concerns about ongoing vulnerabilities in blockchain infrastructure. [more]
Convergence lost $210K: Convergence, a DeFi protocol, suffered a hack leading to a $210,000 loss in its native tokens and $2,000 in staking rewards. The exploit stemmed from a post-audit modification that removed crucial validation checks in the smart contract. This allowed the hacker to mint and dump 58 million CVG tokens. while Convergence has acknowledged the oversight and assured users that all funds are safe, it advised users to withdraw staked assets as a precaution. As the rewards contract also got exploited, stakers will not be able to claim their rewards. Convergence stated that it is working on a fix, and a resulting will soon be communicated. [more]
$1.5M drained from smart contract: Nexera suffered a hack resulting in the loss of $1.5 million in NXRA tokens. The attack was executed through a vulnerability in their smart contract which allow the hacker to manipulate the system and drain funds. Nexera is currently investigating the breach and working on measures to prevent future incidents. [more]
North Korea hackers and crypto attacks: North Korean hackers' increasing focus on cryptocurrency as a primary target for cyberattacks. These hackers, often linked to the North Korean government, are exploiting vulnerabilities in crypto exchanges and other digital platforms to steal large amounts of cryptocurrency. Their sophisticated cyberattacks not only result in substantial financial losses but also erode trust in the technology, potentially deterring investors and stalling adoption. Without effective law enforcement intervention, these activities could stifle innovation, increase regulatory scrutiny, and hinder the growth of the blockchain industry. The implications of these attacks extend beyond finance, affecting regional and international stability in the digital economy. [more]