Gain valuable insights from industry leaders as they provide their perspectives on navigating the evolving digital landscape, addressing emerging cyber threats and trending topics that affect us all.

Cyber Safety Chief Technology Officer

Leadership Perspectives

<p>Today, technology is deeply woven into our daily lives and is advancing at an extraordinary pace. All of the progress in tech, however, comes with an equal measure of risk. In 2024, large-scale data breaches dominated headlines, while AI pushed the boundaries of reality, reshaping how we work, create and interact with technology.&nbsp;</p><p>With all of this, 2025 is set to be a year of profound transformation in the cybersecurity landscape.</p><p>At Gen, we don’t wait to respond to change; we anticipate it. Our experts are looking ahead to the trends that will redefine the industry while harnessing AI for good to ensure safety and trust remain at the forefront. <strong>Here’s what we see on the horizon.</strong><br>&nbsp;</p><h2>AI Will Blur the Line Between Reality and Fiction</h2><p>Artificial intelligence isn’t just a powerful tool — it’s becoming a force that reshapes how we perceive the world. But, as it becomes better, smarter, more realistic and accessible, AI will increasingly blur truth and deception, making it more difficult than ever to decipher what’s real.</p><h3>Hyper-Personalized Realities</h3><p>AI-powered Large Language Models (think ChatGPT, Gemini, etc.) are advancing at an incredibly fast pace, offering hyper-personalized interactions that could alter perceptions and decision-making.&nbsp;</p><p>Imagine a world where AI doesn’t just answer your questions but anticipates your&nbsp;needs.</p><p>But here’s the trade-off: to unlock this seamless, personal assistant experience, people are handing over everything to AI, including calendars, messages and apps. Hyper-personalization comes with a cost: the erosion of privacy and autonomy. Are you willing to lose privacy for convenience?&nbsp;</p><p>This raises critical ethical questions: Who controls the narratives AI presents? How do we safeguard independent thought in a world increasingly influenced by machine intelligence?</p><p>We believe that AI-driven solutions should ensure transparency and accountability, giving individuals tools to navigate these hyper-realities without losing sight of two key things: truth and trust.</p><h3>AI in Sensitive Roles</h3><p>We suspect that AI will also infiltrate areas once considered uniquely human, such as parenting and education. Imagine an AI tool stepping in to mentor a child, help with homework, or even act as a digital babysitter. While it offers unlimited time and patience, it challenges the boundaries of what roles and responsibilities should be left to humans.</p><p>The implications are profound:</p><ul><li><strong>Redefining Relationships:</strong>&nbsp;AI is poised to transform the family, from parenting and pets to companionship, by taking over routine tasks like homework help and schedule management or even emotional connections. Bonding moments – like bedtime stories or daily conversations – slip away. With robotics bringing AI into the physical world, the stakes grow higher: robotic pets replacing real ones, AI nannies soothing children and robot companions filling emotional gaps.&nbsp;</li><li><strong>Shaping Young Minds:&nbsp;</strong>As AI becomes more engaging, children may form stronger bonds with machines than caregivers, shifting family dynamics. While AI offers personalized guidance and companionship, overdependence could limit kids’ social and emotional growth, making real relationships harder to navigate. Families must balance the benefits of AI with the need for genuine human connection.</li></ul><p>The broader societal question is this: how much influence will we allow AI to have in shaping the next generation?<br>&nbsp;</p><h2>The Deepfake Revolution</h2><p>Deepfakes — AI-generated media designed to mimic real people — are becoming so sophisticated that even experts may struggle to distinguish truth from fabrication. In 2025 we expect increases in:</p><ul><li><strong>Personal Attacks:&nbsp;</strong>Scorned individuals could use deepfakes to harass or extort others, not just by targeting the individual directly but by creating convincing fake media of family members or friends. These fabricated videos or audio clips could be used to manipulate victims emotionally, spread false rumors, or even strain personal relationships, amplifying the psychological toll of such attacks.</li><li><strong>Political Manipulation:</strong> Governments and bad actors may leverage deepfakes to divide, spread disinformation and destabilize societies. Imagine a fake speech from a world leader announcing false policies — such content could ignite panic, erode trust in institutions and manipulate public opinion. Deepfakes could also target journalists or political opponents, fabricating damaging scandals or discrediting reliable sources, undermining public confidence in the media. This highlights the need for a system where authenticity is non-negotiable -- where digital signatures could become the standard to restore trust.&nbsp;</li><li><strong>Financial Fraud:</strong> Deepfake videos or audio clips of executives could be used to impersonate authority figures, convince employees to transfer funds, reveal sensitive company information or approve unauthorized transactions. For instance, a Business Communication Compromise (BCC) can happen when a convincing video of a CEO instructing a financial officer to expedite a payment bypasses typical safeguards, due to its perceived authenticity and established trust. The threat doesn’t end with internal fraud; deepfakes could also target investors or clients, undermining trust in corporate communications and causing long-term reputational damage. These attacks could ripple through supply chains and financial systems, creating chaos on an unprecedented scale.&nbsp;</li></ul><h2>Data Theft: The Multi-Faceted Threat to Identity</h2><p>The digital world runs on data and cybercriminals are mastering the art of leveraging it as a multifaceted threat to target individuals, organizations and societies alike.</p><h3>Comprehensive Profiles for Targeted Scams</h3><p>Large-scale breaches and public data sources provide criminals with the raw materials to build highly detailed profiles of their victims. &nbsp;This goes beyond just a first and last name or email address – criminals piece together “who” their targets really are. They know where you work, what you do for a living, your hobbies and habits. With this intimate understanding and detailed information, they can:</p><ul><li>Craft hyper-personalized phishing attempts</li><li>Launch convincing extortion schemes</li><li>Impersonate trusted services to exploit victims’ trust</li></ul><p>For example, attackers using images of victims’ homes during sextortion attempts demonstrate how cybercriminals are evolving their psychological manipulation tactics.</p><h3>Forgotten Logins, Fresh Targets: How Old Accounts Open New Doors for Hackers</h3><p>The average individual has hundreds of online accounts. Besides the active ones, there’s also a plethora of aged accounts that are long gone, such as old email addresses from Hotmail or social accounts like MySpace. These accounts can be forgotten or abandoned. Combined with the low adoption of multi-factor authentication (MFA) and the widespread practice of password reuse, these neglected accounts become gateways for attackers. Cybercriminals can pivot from one breached account to another, collecting more personal information with each step and enabling even more precise and damaging attacks.</p><h2>Scams Enter the Era of Hyper-Personalization</h2><p>2025 marks the dawn of hyper-personalized scams. Cybercriminals no longer rely on broad attacks and wait for someone to take the bait. Instead, they use meticulously crafted profiles built from breached data, public records or dark web scraps to tailor their attacks. They’re not random. They’re designed to feel personal, disarming and hard to resist because they rely on your specific data – your own identity.&nbsp;</p><p>These scams won’t feel like scams. They’ll feel real. Here are some examples:</p><ul><li><strong>Tailored Manipulation</strong>: Imagine receiving a message referencing a conversation you had last week or mimicking a friend’s tone perfectly. Attackers will use personal details to craft scams so convincing they disarm even the most vigilant.</li><li><strong>Psychological Exploits</strong>: Cognitive biases like urgency, trust, and fear will be turned against us. Emotional triggers — like a fabricated crisis involving a loved one — will make hesitation feel impossible.</li><li><strong>Platform Integration</strong>: Social media and messaging apps will become prime battlegrounds, with scams that look indistinguishable from legitimate interactions.</li></ul><p>This is the reality of where scams are heading. The lines between genuine and fraudulent will blur, forcing us to rethink how we defend against threats. Technology together with awareness, education, and proactive resilience will be critical to protecting ourselves and our communities in this new era of deception.</p><h2>Financial Theft: The New Frontier of Exploitation</h2><p>The war on financial security is escalating, with attackers blurring the boundaries between digital fraud and physical coercion. 2025 will see financial theft reach unprecedented levels, fueled by innovation in both technology and tactics.</p><h3>A New Breed of Digital Fraud</h3><p>Cybercriminals are wielding sophisticated tools to undermine trust and exploit vulnerabilities:</p><ul><li><strong>Deepfake Scams</strong>: Picture a video of a trusted leader or celebrity endorsing a high-return investment. These convincing forgeries will draw in victims by the thousands, fueling a new wave of financial deception.</li><li><strong>Voice-Cloned Lies</strong>: Fraudsters will impersonate government officials, announcing fake income distributions or policy updates, driving victims to malicious platforms.</li><li><strong>Crypto Scams on Steroids</strong>: From fake giveaways to fabricated trading platforms, cryptocurrency will remain a prime target for attackers hungry for unregulated, high-reward opportunities.</li></ul><h3>Where Cybercrime Gets Personal&nbsp;</h3><p>Financial theft is no longer confined to just the digital world. Now, it feels more and more personal. Spyware and malware will silently monitor devices, giving attackers backdoor access to banking apps and bypassing traditional security measures.</p><p>This evolving threat challenges us to rethink financial security. It’s not just about protecting devices; it’s about protecting the people behind them. The only way forward is bold innovation, collective vigilance, and an unwavering commitment to staying ahead of those who prey on trust.</p><h2>Our Vision for the Future</h2><p>The challenges of 2025 demand bold action, innovative thinking and a commitment to protecting what matters most: trust. And while threats are undoubtedly getting more complex, the future is bright, and technology will play a pivotal role in making the world safer, smarter and more secure. At Gen, we’re not just observing these challenges; we’re staying ahead of them. With products like Norton Genie for scam detection, Norton 360 Deluxe and Avast One for all-in-one protection, and LifeLock to restore what’s lost, we’re safeguarding your digital world and Powering Digital Freedom.</p><p>While technology like AI holds the promise of a more secure and innovative future, uncertainty often stands in the way of progress. This is where we see opportunity: to educate, empower and lead. By helping others understand and embrace AI responsibly, we can ensure it becomes a force for good — strengthening our defenses while driving innovation.</p><p>Make no mistake — new technology breeds new risks. However, it also serves as a powerful catalyst for positive change, paving the way to a safer and brighter future.</p><p>With every new tool, every evolving threat, and every transformative idea, we’re shaping a future where innovation and security go hand in hand.</p>

Exploring Tomorrow’s Threats, Today’s Solutions: Predictions for the Cybersecurity Landscape in 2025

Predictions 2025: Navigating the Future of Cybersecurity

<p>As technology evolves, so does our digital landscape. Many of us have witnessed this transformation firsthand; we can still remember the sound of dial-up internet and are also part of today's "always-on" culture. Most of the world is constantly connected, even expecting instant responses via text, DM or Microsoft Teams. However, increased connectivity comes with its own challenges. Scams, once confined to traditional, more obvious methods, have adapted to leverage some of the latest technology for more sophisticated and clever schemes unlike ever before.&nbsp;</p><p>When it comes to election security, the first thought often centers around the risk of hacking voting systems or machines. Artificial intelligence (AI) technology makes it easier than ever to manipulate public opinion without needing to breach highly secure systems. As AI continues to advance, its potential to affect nearly every facet of our daily lives—including news, careers, trends, social media and elections—cannot be underestimated.</p><p><strong>A Global Outlook&nbsp;</strong>&nbsp;</p><p>2024 has deemed itself the ultimate election year with 64 countries plus the European Union all headed to the polls this year. That means there’s even more at stake for the vast majority of people who can and will participate in free and fair elections in their country.&nbsp;</p><p>We’ve already seen an&nbsp;<a href="https://www.ic3.gov/Media/News/2024/240709.pdf">FBI report</a> on state-sponsored media leveraging software to manipulate public opinion through social networks.&nbsp;</p>

<h2><strong>The Influence of AI </strong> &nbsp;</h2><p>AI seems to touch every aspect of our digital existence today and is spreading through personalized advertising algorithms and even for our personal content curation. (Admit, you can hardly scroll on LinkedIn without an ad or a tip on how to use AI.)  &nbsp;</p><p>One <a href="https://vm.tiktok.com/ZGeVGdeLc/">deepfake video</a> features a journalist alongside candidates from six different Spanish political parties. Although this video is intended for fun, as indicated by its hashtags, it highlights both the potential and believability of AI technology.&nbsp;&nbsp;</p>

<p>However, AI's impact extends beyond convenience and efficiency; it also poses significant risks. For instance, AI algorithms are already being utilized to manipulate elections by spreading misinformation and propaganda; be it through automated bots, curated images or deepfake videos. We see it on social media constantly. And the real problem is determining real versus fake. With such convincing technology, AI has the potential to erode public trust and undermine democratic processes. &nbsp;</p><h2><strong>Proactive Measures to Combat Misinformation</strong>&nbsp;</h2><p>As we approach another election year, the issue of <a href="https://www.gendigital.com/blog/news/innovation/ai-disinformation">AI misinformation</a>, particularly deepfakes, has become a pressing concern. Although the U.S. federal government has yet to take action against deepfakes, there are states that are taking measures into their own hands. One U.S. state, Colorado, has proactively implemented measures to combat the spread of these deceptive technologies. The state now mandates that campaign ads featuring audio, video, and other AI-generated content include prominent disclosures.&nbsp;</p><p>The law treats deepfakes — fake videos or images created by AI showing people doing or saying things they didn't actually do — as if the people were being forced to act against their will. It highlights the risk of candidates’ reputations being "irreparably tainted" by fabricated messages and requires "clear and conspicuous" disclosures when AI-generated content is used to portray candidates within 60 days of a primary election or 90 days of a general election.&nbsp;</p><p>The new law empowers individuals to file administrative complaints with the Secretary of State’s Office for election law violations and gives candidates the ability to sue over the dissemination of deepfakes. Colorado’s proactive stance sets a precedent for safeguarding the integrity of the electoral process and protecting voters from being misled by manipulated content, ensuring a fair and transparent election.&nbsp;</p><h2><strong>Elections Under Siege</strong> &nbsp;</h2><p>How would AI impact our elections? Well, consider this: elections have already faced cyberattacks in the past through digital channels. &nbsp;</p><p>Historical data, including analyses of past election years and telemetry from significant events, show the severity of the issue and emphasize the need for proactive measures to safeguard electoral integrity. &nbsp;</p><p>We don’t have to look too far to find evidence. Case in point: the Polish Parliamentary Elections of 2023. Just two days before the elections, Polish media outlets released a video depicting a police intervention at one of the three polling stations in Poland. The intervention was prompted by an anonymous bomb threat received before the scheduled voting day. However, accounts associated with the Russian FIMI infosphere quickly seized upon this video, reframing its context to suggest that explosions had already taken place at the polling station. The incident exemplifies a calculated effort to stoke fear surrounding the purported bomb threats directed at polling stations, potentially discouraging voter turnout. &nbsp;</p><p>Recently, an AI-generated version of Indian Prime Minister Narendra Modi was spread on WhatsApp.  &nbsp;</p><p>In the United Kingdom, the state of British healthcare and the National Health Service was a hot topic during the pre-election period. The urgency of this issue has been exploited by cybercriminals, leading to a 208% increase in URL-based election attacks in 2024 compared to 2023. These attackers have primarily targeted healthcare topics to deceive and manipulate voters.&nbsp;</p><p>Similarly, in Germany, we have observed an alarming increase in blocked attacks on URLs with politically controversial content. These attacks occurred in two significant waves: the first at the turn of the year and the second from April up to the election week. From the beginning of the pre-election period in December 2023 to the end of May 2024, the monthly number of blocked attacks surged by 233%. When comparing the entire pre-election period of the last six months to the same months of the previous year, there is an astounding year-on-year increase of nearly 5000% in blocked attacks. These attacks, originating from politically charged websites, include malicious malvertising, phishing, and push notifications designed to install malware or steal sensitive personal data.&nbsp;</p><p>The 2024 European elections have seen a dramatic rise in politically based cyberattacks on German users, with an increase of almost 5000%. Cybercriminals have employed various tactics, including fake ads, phishing, and dangerous push notifications, to exploit politically charged content. Keywords and names were frequently used as clickbait to lure victims. This significant surge in political-based attacks underscores the need for robust cybersecurity measures to protect the integrity of the electoral process and ensure a safe digital environment for voters.&nbsp;&nbsp;</p><p>Below are a few examples of elections that have faced some form of cyberattack: &nbsp;</p>

<h3><strong>Types of Election Scams</strong> &nbsp;</h3><p>A myriad of election scams exists, ranging from seemingly innocuous political donation solicitations to sophisticated phishing attempts targeting voter registration databases. AI-driven scams exacerbate the threat landscape, as malicious actors leverage advanced algorithms to create videos, text and even email scams designed to sway public opinion and manipulate electoral outcomes. But AI isn’t the only threat to elections.&nbsp;</p><p>Potential threats to elections: &nbsp;</p><ul><li>Tampering with registrations, votes &nbsp;</li><li>Committing voter registration fraud&nbsp;</li><li>Hacking candidate laptops, email, social accounts &nbsp;</li><li>Hacking of campaign websites &nbsp;</li><li>Leaking of confidential info &nbsp;</li><li>Hacking government servers, comms networks,  &nbsp;</li><li>Spreading misinformation on the election process, parties, candidates or results &nbsp;</li><li>Altering results &nbsp;</li><li>Hacking internal systems used by media or press  &nbsp;</li></ul><p>Here's what scams could look like to voters: &nbsp;</p><ul><li>Political donation scams &nbsp;</li><li>Fake survey or polls &nbsp;</li><li>Voter registration phishing  &nbsp;</li><li>Scam texts &nbsp;</li><li>Social media posts&nbsp;</li><li>Fake data leaks&nbsp;</li><li>Misinformation campaigns&nbsp;</li></ul><h3><strong>Spotting the Scams&nbsp;</strong>&nbsp;</h3><p>As scams become increasingly sophisticated, it is important to equip individuals with the necessary tools and knowledge to identify and mitigate any possible threat.  &nbsp;</p>

<h2><strong>Looking Towards the Future</strong> &nbsp;</h2><p>Emerging technologies, such as deepfakes, present both opportunities and risks. (Like all technology, it’s good when put in responsible hands.) Though these tools can be exploited maliciously, they also hold the potential for positive applications.    &nbsp;</p><p>Here, we delineate both the benefits and risks stemming from AI involvement in the electoral process. &nbsp;</p><p>Benefits of AI include: &nbsp;</p><ul><li>Enhanced security: AI presents an opportunity to reinforce cybersecurity measures. &nbsp;</li><li>Voter engagement: Leveraging AI-driven chatbots and virtual assistants can foster enhanced voter engagement by facilitating communication, ensuring broader accessibility. &nbsp;</li><li>Data analysis: AI algorithms offer the capability to sift through vast datasets, uncovering valuable insights into voter trends, preferences, and potential irregularities.  &nbsp;</li></ul><p> Technological risks associated with AI include: &nbsp;</p><ul><li>Security vulnerabilities: AI systems, datasets, and models are not immune to cyberattacks.  &nbsp;</li><li>Bias and Equity Concerns: AI systems have the potential to inherit biases from their training data, potentially leading to unfair or discriminatory outcomes in voter registration, candidate selection, or data analysis processes. &nbsp;</li><li>AI-driven cyberattacks: AI-powered data mining allows for targeted and sophisticated social engineering attacks, enabling threat actors to identify potential targets and vulnerabilities more effectively.  &nbsp;</li><li>Manipulation of AI-generated Content: Synthetic media, such as AI-generated images, videos, and text, can be weaponized to spread disinformation or manipulate public opinion.  &nbsp;</li></ul>

<p>AI has become so widespread and accessible, that it is certainly a power that must be kept in the rightful hands and with a watchful eye.   &nbsp;</p><h3><strong>Our Commitment</strong> &nbsp;</h3><p>Our commitment to the ethical use of technology and our mission of powering digital freedom has led us to sign <a href="https://www.aielectionsaccord.com/">the tech accord</a> "AI for Good." By aligning ourselves with this initiative, we emphasize our dedication to leveraging AI for positive impact and ethical practices. We recognize the transformative potential of AI in addressing societal challenges, including combating scams and safeguarding online communities.  &nbsp;</p><p>We’ve already started using AI for good, with products like Norton Genie – an AI-powered tool used to detect scams via text, email and social media. We’ll continue to learn and leverage the power and potential of AI responsibly to promote a safer and more inclusive digital environment for all.&nbsp;</p>

During a Worldwide Election Year, Understand and Navigate the Power and Possibilities of AI  

Seeing Isn’t Believing – Tackling AI, Misinformation and Its Impact on an Election Year 

Security Evangelist at Gen

<p><strong>The new frontier of cyberthreats: how nation-state groups are targeting consumers</strong> &nbsp;</p><p>In recent cybersecurity trends, we've observed a troubling shift: sophisticated attacks once aimed solely at governments and enterprises are now targeting everyday consumers. Nation-state groups, traditionally known for espionage and cyber warfare, are not just targeting governments and large enterprises anymore; they're also setting their sights on everyday consumers like you, increasingly using scams to infiltrate personal devices. &nbsp;</p><p> &nbsp;</p><p><strong>The rise of nation state scams on consumers</strong> &nbsp;</p><p>Typically, we think of nation-state attacks as sophisticated, covert operations aimed at siphoning secrets from rival governments or multinational corporations. However, these powerful adversaries have begun exploiting the same advanced tactics to deploy scams against ordinary people. The distinction between advanced persistent threats (APTs) and consumer-targeting scams is blurring. These threats now coexist, leveraging sophisticated techniques to breach consumer defenses. &nbsp;</p><p> &nbsp;</p><p><strong>Advanced threats in your inbox</strong> &nbsp;</p><p>Imagine receiving an email that looks like a job offer from a reputable company. It's actually a sophisticated scam, utilizing methods that were once the hallmark of attacks against governments. These scams can bypass standard antivirus software, tricking you into compromising your personal security without even realizing it. And this is already happening.  &nbsp;</p><p>The Lazarus Group, also known as Hidden Cobra, is a notorious cybercriminal organization believed to be backed by North Korea. It has been active since at least 2009 and is known for its highly sophisticated and destructive cyberattacks, primarily aimed at espionage, sabotage, and financial gain. The group has been linked to a variety of high-profile incidents globally, indicating the scale and global reach of its operations. &nbsp;</p><p>We recently uncovered (<a href="https://decoded.avast.io/luiginocamastra/from-byovd-to-a-0-day-unveiling-advanced-exploits-in-cyber-recruiting-scams/">read here our detailed technical analysis of the attack</a>) an attack carried out by Lazarus targeting specific individuals. The victims are unlike previous attacks from this group, such as the Sony Pictures Hack in 2014 or the Bangladesh Bank heist in 2016. &nbsp;</p>

<p><strong>Tomorrow's threats, today's concerns</strong> &nbsp;</p><p>It's a sobering thought: the elite cyber threats of today are the consumer scams of tomorrow. Techniques developed for espionage are trickling down to the consumer level, bringing with them risks that were once thought to be faced only by the most secure facilities in the world. &nbsp;</p><p>The cybersecurity landscape is continually evolving. What was once an isolated incident of advanced malware in a corporate system can now turn into widespread consumer scams. These threats evolve, learning from each interaction, which makes them increasingly difficult to detect and defend against. &nbsp;</p><p> &nbsp;</p><p><strong>Conclusion</strong> &nbsp;</p><p>Understanding this shift in target from the high towers of government to the personal devices in our pockets is crucial. As consumers, staying informed about the latest threats and adopting robust cybersecurity measures are our best defense. Remember, in the digital age, anyone can be a target. Invest in comprehensive security solutions that keep pace with these evolving threats. Regularly update your software, be skeptical of unsolicited communications, and consider consulting with cybersecurity experts to ensure your digital life is secure. &nbsp;</p>

The Evolution of Cyberthreats From Global Espionage to Personal Intrusion

The new frontier of cyberthreats: how nation-state groups are targeting consumers  

<p>"Scamverse." This concept, much like the multifaceted realms of the "Spiderverse" in the world of comic books, represents the complex and interconnected web of scams that dominate today's digital threats. As a cybersecurity expert with 25 years of experience, I have witnessed the evolution of these threats, from the early days of viruses and Trojans to the sophisticated scam-centric dangers we face today.&nbsp;</p><h2><strong>The Evolution of Cyberthreats</strong>&nbsp;</h2><p>Historically, the digital world was plagued primarily by viruses and Trojans. These were malicious programs designed to disrupt, damage, or gain unauthorized access to computer systems. With the popularization of the internet, a new breed of threats emerged, notably worms. These self-replicating programs could spread across networks without human intervention, marking a significant shift in the nature of cyberthreats.&nbsp;</p><p>However, as technology advanced and the internet became increasingly integral to daily life, cybercriminals adapted and evolved. The emergence of phishing scams, botnets, and ransomware signaled a shift from mere disruption to focused, profit-driven criminal activity. Phishing scams, in particular, demonstrated the opportunity to deceive or trick individuals into divulging sensitive information. We call it social engineering.&nbsp;</p><h2><strong>The Rise of the Scamverse</strong>&nbsp;</h2><p>The term "Scamverse" describes the current era, where the majority of cyberthreats involve some form of scam. This doesn't imply that all threats originate as scams, but it highlights the reality that most people are more likely to encounter a scam than any other type of cyberthreat. Scams in the digital age are diverse and sophisticated, ranging from email phishing and fake websites to social media scams and fraudulent online marketplaces.&nbsp;</p><p>In this scam-centric landscape, the primary weapon of cybercriminals is deception. Unlike traditional malware, which relies on exploiting technical vulnerabilities, scams exploit human vulnerabilities — trust, ignorance and fear. This makes them particularly insidious and difficult to combat, as they hinge on manipulating human psychology rather than breaching digital defenses.&nbsp;</p><h3><strong>Characteristics of the Scamverse</strong>&nbsp;</h3><ol><li><strong>Social Engineering:</strong> The cornerstone of most scams is social engineering, the art of manipulating people into performing actions or divulging confidential information. Phishing emails, for instance, often masquerade as legitimate communications from trusted entities to trick individuals into clicking on malicious links or sharing sensitive data.&nbsp;</li><li><strong>Financial Motivation:</strong> The primary objective of scams is financial gain. Whether through ransomware demands, the theft of financial information or fraudulent transactions, the end goal is invariably monetary.&nbsp;</li><li><strong>Targeted Attacks:</strong> Scams are increasingly personalized and targeted. Cybercriminals often gather information about their victims to craft more convincing and effective scams, increasing the likelihood of success.&nbsp;</li><li><strong>Exploitation of Current Events:</strong> Scammers are adept at exploiting current events, such as global pandemics or political upheavals, to create timely and relevant scam campaigns that prey on people's fears and uncertainties.&nbsp;</li></ol><h3><strong>Navigating the Scamverse</strong>&nbsp;</h3><p>Staying protected in the Scamverse requires vigilance and education. Traditional cybersecurity measures like antivirus software and firewalls remain essential, but they must be supplemented with awareness and skepticism. People should educate themselves about common scam tactics and question the legitimacy of unsolicited communications. Organizations should invest in regular training to keep employees informed about the latest scam techniques.&nbsp;</p><p>Additionally, solutions like email filtering, web reputation services and behavioral analytics can help identify and block scam-related activities. Collaborative efforts between cybersecurity firms, law enforcement and regulatory bodies are also crucial in dismantling large-scale scam operations.&nbsp;</p><h2><strong>The Dual Role of AI in the Scamverse</strong>&nbsp;</h2><p>Artificial Intelligence (AI) plays a paradoxical role in the Scamverse, acting as both a facilitator for cybercriminals and a powerful tool in the cybersecurity arsenal. This dual nature of AI in the realm of cyber threats underscores the ongoing arms race between attackers and defenders.&nbsp;</p><h3><strong>AI as a Tool for Cybercriminals</strong>&nbsp;</h3><p lang="EN-US">AI, as a tool for cybercriminals, significantly enhances the sophistication, reach, and effectiveness of scams. By leveraging natural language processing and machine learning, AI can craft highly convincing phishing emails and even use deepfake techniques in video and audio, making these scams increasingly challenging to distinguish from legitimate communications. Furthermore, AI facilitates automated social engineering, enabling bots to conduct personalized and persuasive interactions with potential victims on social media or via email. Additionally, AI algorithms are adept at harvesting and analyzing vast amounts of data to identify potential targets, tailoring scams to individuals' online behavior and striking at the most opportune moments, thereby increasing the success rate of these malicious attacks.&nbsp;</p><ol><li>As a tool for cybercriminals, AI significantly enhances the sophistication, reach and effectiveness of scams. By leveraging natural language processing and machine learning, AI can craft highly convincing phishing emails and even use deepfake techniques in video and audio, making these scams increasingly challenging to distinguish from legitimate communications. Furthermore, AI facilitates automated social engineering, enabling bots to conduct personalized and persuasive interactions with potential victims on social media or via email. Additionally, AI algorithms are adept at harvesting and analyzing vast amounts of data to identify potential targets, tailoring scams to individuals' online behavior and striking at the most opportune moments, thereby increasing the success rate of these malicious attacks.&nbsp;</li></ol><h3><strong>AI as a Defense Mechanism</strong>&nbsp;</h3><p>Conversely, AI is a formidable tool in combating the Scamverse, offering several advantages in detecting and preventing scams.&nbsp;</p><ol><li><strong>Continuous Adaptation:</strong> Perhaps the most significant advantage of AI in cybersecurity is its ability to continuously learn and adapt. For example, with <a href="https://us.norton.com/products/genie-scam-detector">Norton Genie</a>, as new types of scams emerge, the AI can be trained with the latest data points to recognize them. It analyzes messages, websites, social media posts and more, alerting you if it’s a potential scam and then giving you advice on the best next steps. &nbsp;</li><li><p lang="EN-US"><strong>Anomaly Detection:</strong> AI systems can analyze patterns in data to identify anomalies that may indicate scam activities. These systems can detect unusual patterns in network traffic, email communications or online transactions that human analysts might miss.&nbsp;</p></li><li><strong>Phishing Detection:</strong> AI can be trained to recognize the subtle signs of phishing attempts, such as slight deviations in email formatting, sender information or the language used. This can help in filtering out phishing emails before they reach the intended recipient.&nbsp;</li><li><strong>Behavioral Analysis:</strong> AI can monitor user behavior to detect signs of compromise or scam interactions. For example, sudden changes in the way a user interacts with a system or unusual financial transactions can trigger alerts.&nbsp;</li></ol><h2><strong>The Future Intersection of AI and Scamverse</strong>&nbsp;</h2><p>Looking forward, the intersection of AI and the Scamverse is poised to become increasingly complex. As AI technologies become more advanced, we can expect both the sophistication of scams and the effectiveness of our defenses to escalate. This dynamic landscape will require constant vigilance, innovation and collaboration, among cybersecurity professionals, technology developers and policymakers.&nbsp;</p><p><a href="https://www.gendigital.com/blog/news/innovation/ai-based-cyberthreats">AI's role</a> in the Scamverse is a double-edged sword. While it empowers cybercriminals with advanced tools to execute scams, it also equips cybersecurity experts with potent mechanisms to thwart these threats. The future of cybersecurity in the Scamverse will undoubtedly be shaped by the ongoing development and deployment of AI technologies, emphasizing the need for cutting-edge research and ethical AI practices in the field.&nbsp;</p><p><strong>Conclusion</strong>&nbsp;</p><p>The Scamverse represents the current and perhaps most challenging era in the evolution of cyberthreats. Its reliance on social engineering makes it uniquely dangerous, as it exploits human nature itself. Navigating this landscape requires a combination of technological solutions, education, and a healthy dose of skepticism. As we continue to adapt to these challenges, one thing is clear: the battle against the Scamverse will be as much about changing human behavior as it is about advancing technological defenses.&nbsp;</p>

In the ever-evolving landscape of cyberthreats, a new term has emerged to encapsulate the current era's predominant danger: "Scamverse."

The Scamverse: Navigating the New Frontiers of Cyberthreats

Global Privacy Compliance Program Manager

<h2><strong>What is Data Privacy Week?</strong> &nbsp;</h2><p>Data Protection Day originated in Europe to commemorate the first legally binding international treaty dealing with privacy and data protection. Now, the celebration has expanded to an entire week and is recognized worldwide. The mission of <a href="https://staysafeonline.org/programs/data-privacy-week/">Data Privacy Week</a>, observed January 21-27 this year, is to <em>inspire dialogue and empower individuals and companies to respect privacy, safeguard data and enable trust</em>.&nbsp;&nbsp;</p><p>Data Privacy Week, which encourages people everywhere to take control of their digital footprints, is run by the <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fstaysafeonline.org%2Fprograms%2Fdata-privacy-week%2F&amp;data=05%7C02%7CAlisha.Robinson%40gendigital.com%7C6a003a179aef40725ccf08dc16b91ab6%7C94986b1d466f4fc0ab4b5c725603deab%7C0%7C0%7C638410231503836756%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=E3%2BMt372PJpwhWRw5v6FwZ1nCsxBCaH2fv6H1u0BOu4%3D&amp;reserved=0%22%20\o%20%22Original%20URL:%20https://staysafeonline.org/programs/data-privacy-week/%20%20Click%20to%20follow%20link.%22%20\t%20%22_blank">National Cybersecurity Alliance</a> (NCA). NCA advocates for the safe use of technology and helps governments and corporations work together to foster digital good.&nbsp;</p><p>Everything you do online generates data. Every time you shop, click, scroll, like, message, play and more, you are generating data. This personal information has tremendous value to businesses. The landscape of privacy and data protection laws and regulations continues to grow more complex. Companies with global operations that wish to advance the privacy rights of individuals and enable innovative products and services must comply with these laws and deliver meaningful data security to their customers; this can be challenging for many companies and difficult for people when trying to figure out if the apps and companies that hold their data are keeping it safe.  &nbsp;</p>

<h2><strong>How We Help People Protect Their Digital Lives</strong> &nbsp;</h2><p>For Gen, empowering people to take control of their digital lives is in our DNA. Security, transparency, and accountability are built into everything we do, and products like <a href="https://us.norton.com/products/norton-secure-vpn%22%20/t%20%22_blank">Norton Secure VPN</a> protect a person’s online privacy by hiding the computer’s address from websites visited from any device. Norton, a part of Gen, also offers <a href="https://us.norton.com/products/norton-360-deluxe%22%20/t%20%22_blank">Norton 360 Deluxe</a>, which can prevent activity or location tracking, as well as information theft, installation of malicious programs and uninvited changes to devices. We recently <a href="https://www.gendigital.com/blog/impact/community/product-donations-domestic-violence">launched a product donation pilot program</a>, donating up to 5,000 of these free product licenses to survivors of domestic violence to help them recover from financial or technological abuse. These products are also donated or discounted to nonprofits through our partnership with <a href="https://www.techsoup.org/search/products/norton/%22%20/t%20%22_blank">TechSoup</a>. &nbsp;</p><p>In addition to product donations, we work regularly with nonprofits like <a href="https://www.gendigital.com/blog/impact/community/my-digital-life%22%20/t%20%22_blank">Discovery Education</a> and the <a href="https://www.gendigital.com/blog/impact/community/the-smart-talk-2023%22%20/t%20%22_blank">National PTA</a> to help children and families learn about keeping their information private.  &nbsp;</p><h2><strong>Five Ways We Help Keep Customer Data Safe</strong>&nbsp;</h2><p>We focus on five essential elements to help keep customer data safe. Check for these key practices: &nbsp;</p><ol><li><strong>Accountability.</strong> At Gen, we hold ourselves accountable by defining our principles, conducting internal and external audits, empowering employees at all levels of the company to proactively consider privacy and data protection, engaging in continuous improvement processes, and constantly scanning for new risks and opportunities. For more details on Gen’s Privacy Operating Model, see page 34 of our <a href="https://s201.q4cdn.com/771113172/files/doc_downloads/2023/07/gen-2023-social-impact-report.pdf">2023 ESG Report</a>. &nbsp;</li><li><strong>Security.</strong> We secure personal data using appropriate technical and organizational measures to protect integrity, confidentiality, and availability. Our security monitoring alerts us to suspicious activity, and we have a robust incident response program. &nbsp;</li><li><strong>Essential rights. </strong>We take a principles-based approach, going beyond regional data protection laws to provide essential rights to our customers, such as access and deletion, regardless of whether there is a law requiring it. &nbsp;</li><li><strong>Transparency.</strong> Privacy policies are often difficult to read and understand. We work to make our policies as clear and detailed as possible. We provide additional support articles and easy access to contact information to make it easy for customers to exercise their privacy rights and get their questions answered. &nbsp;</li><li><strong>Customer-First Privacy by Design. </strong>In everything we do, we strive to anticipate, identify, and prevent invasive events before they happen. Privacy measures should not be add-ons, but fully integrated components of the system. We only collect personal data for specified, clear and legitimate purposes. And, we only collect as much personal data as we need to achieve those purposes.&nbsp;&nbsp;</li></ol><p>This Data Privacy Week, we encourage you to do a quick review of the companies and apps that have your information. Do they have systems and policies in place to keep your data secure? Will they let you delete your data? Are they explaining what personal data is collected and why? Do they respect your rights to control how your data is used? Remember, it’s your data and it has value. Be selective about who you choose to do business with and thoughtful about what information you are providing. And, no matter where you are in your data security journey, we hope Data Privacy Week serves as an important reminder to exercise your rights to safety and privacy.  </p>

This Data Privacy Week, learn what to expect from businesses that have your personal information

Helping to Keep Personal Data Safe

Chief Technology Officer

<p>As we stand on the brink of 2024, the nature of cyber threats is undergoing a profound transformation: We are now expecting the threat landscape to be filled with frequent, highly individualized attacks in 2024. The advancement of artificial intelligence (AI) will notably enable the development of sophisticated tools. Criminals will use these tools for targeted messaging in victims' languages, enhancing manipulation.</p><p>Next year, we anticipate ransomware and scams that are designed to manipulate individuals emotionally. As we navigate this changing landscape, our predictions for the next year offer insights into the challenges ahead, as well as the measures we can adopt to fortify our digital defenses.</p>

<h2>Future advancements in AI and related risks</h2><p>The coming year will be a pivotal moment in the evolution of artificial intelligence, marking a period of significant transformation and emerging challenges. This era features rapid AI advancements, changing how these tools integrate into our lives. As AI becomes more embedded in our daily routines, its impact extends beyond mere technological innovation, influencing societal norms, privacy considerations and ethical boundaries.</p><h3>AI will undergo multiple evolutions</h3><p>We suspect a significant evolution in AI, especially in Large Language Models (LLMs) in 2024. Historically, LLMs have been cloud-based, relying on extensive server resources to produce text resembling human writing. The upcoming year, however, marks a pivotal shift towards more compact LLMs that function directly on user devices. This change transcends a simple relocation; it signifies a profound transformation in the integration of AI into our everyday activities and workflows.</p><p>Several key factors drive the move towards device-based LLMs. Firstly, privacy demands are rising and data stored on devices are more private than data stored in the cloud. Local data processing on devices also enhances security, reducing cloud storage risks. Secondly, this shift promises enhanced speed and efficiency. Local processing eliminates latency issues often encountered with cloud-based solutions, leading to a more seamless and responsive user experience.</p><p>Additionally, 2024 will be significant for generative AI, particularly in multi-type conversions. The evolving LLMs are not just limited to text generation; they are branching into more dynamic forms of media conversion.</p><p>The text-to-video feature, allowing synthesized video from text, is a notable advancement. This capability will open up new vistas for content creators, educators and marketers, offering a tool to rapidly produce visually engaging material that resonates with their audience. However, it will also be misused for the creation and spread of scams and disinformation, as it will be progressively harder to recognize a truly recorded video from an AI-generated one.</p><p>The development of text-to-voice AI is equally transformative. This technology goes beyond traditional text-to-speech systems, offering more nuanced and human-like voice generation. It holds immense potential, from creating more interactive and personalized customer service experiences to aiding those with visual impairments or reading difficulties.</p><p>Evolving AI technologies raise questions about ethics, regulation and balancing innovation with user welfare. For businesses and individuals alike, the upcoming year promises to be a journey of discovery and adaptation, as these lightweight, multi-faceted generative AI solutions redefine our interaction with technology and information in profound ways.</p><h3>New tools bring new security challenges as generative AI is broadly adopted</h3><p>The increasing popularity of generative AI in business will bring new risks and challenges. One significant concern is the phenomenon of "Bring Your Own AI" (BYOAI), where employees use personal AI tools in the workplace, which we predict will become exponentially more popular.</p><p>This practice poses a considerable risk of unintentional leakage of sensitive company secrets. Employees using personal AI for work may accidentally expose confidential data to third parties. On the flip side, corporate AI solutions will offer an increasing number of privacy-preserving features, which are frequently not available at the personal level.</p><h3>Social media will become a major attack vector for AI-related scams and disinformation</h3><p>We predict that the vast troves of personal information collected by social media companies over the past decade and a half will be utilized to target AI-generated ads and scams in the form of videos and static posts. Cybercriminals will use these platforms' reach to spread sophisticated scams and disinformation. Leveraging AI, they will be able to create and distribute highly customized and convincing content that blends seamlessly into users' feeds, targeting individuals based on their online behaviors, preferences and social networks.</p><p>Scams may appear as fake news, deceptive ads, deepfakes or misleading direct messages. Social media's interactivity will facilitate quick and broad spread. This will make cybercrimes more efficient and challenging for users and platforms to counter.</p><h3>Business Email Compromise (BEC) attacks will utilize AI to create more sophisticated Business Communication Compromise (BCC) attacks</h3><p>In 2024, we will witness a significant evolution in&nbsp;Business Communication Compromise (BCC) attacks (formerly referred to as Business Email Compromise or BEC attacks), as cybercriminals increasingly adopt AI and deepfake technologies to execute more sophisticated and convincing scams.</p><p>Cybercriminals will create deepfakes mimicking executives or partners. This will challenge employees in distinguishing legitimate from fraudulent requests, particularly when quick decisions are needed.</p><p>These enhanced BEC/BCC attacks will lead to financial losses and erode trust within organizations. Companies could encounter reduced effectiveness in communication and internal mistrust, as employees grow increasingly wary and doubtful of digital interactions.</p><p>A two-factor authentication-like solution is expected in response to these threats. These changes will mandate the verification of requests through a separate, independent channel, like a person-to-person interaction or secured phone call.</p><h3>The dark side of ChatGPT's fame: Malware on the rise</h3><p>The increasing popularity of AI tools like ChatGPT has attracted the attention of cybercriminals. We expect increased attempts by attackers to exploit AI solution-seekers. This includes deceptive “GPT” apps or plugins used for data theft or malware distribution. Users might think these malicious tools are legitimate AI solutions, downloading them only to compromise their systems and data.&nbsp;</p><p>We also anticipate attempts by malicious entities to "hack" LLMs with the aim of accessing valuable information, such as training data, model configurations, internal algorithms or other sensitive internal details. Furthermore, the threat actors might backdoor public LLMs, potentially stealing user inputs, IP and PII details.</p><p>Finally, we foresee the development of new malicious LLMs like "<a href="https://decoded.avast.io/threatintel/insights-into-the-ai-based-cyber-threat-landscape/">WormGPT</a>." In contrast to commercial models—which include built-in safeguards—these malicious models are designed to support the generation of malicious content.</p>

<h2>Digital blackmail will evolve and become more targeted</h2><p>Digital blackmail is rapidly evolving and becoming more targeted. <a>This change is not limited to ransomware attacks, it encompasses a variety of tactics aimed at high-value targets.&nbsp;</a>Notably, sophisticated data exfiltration shows the shifting nature and severity of these threats. As we move forward, this trend signifies a move towards more intricate and damaging forms of digital extortion.</p><h3>Ransomware will become more complex and damaging</h3><p>Cybercriminals mainly use encrypted or stolen data to demand ransoms or sell it, but we foresee a rise in more harmful data abuse tactics. This may involve data brokers exploiting information for identity theft, targeting both employees and customers, or to steal a company’s assets. This shift points to a more complex and harmful ransomware impact on businesses.</p><h3>Evolving attack methods: exploiting VPN and cloud infrastructure</h3><p>Expect evolving ransomware delivery methods, including more sophisticated VPN infrastructure exploitation. This tactic presents a formidable challenge for organizations relying on VPNs for remote work and secure communications.&nbsp;</p><p>Recent security incidents are troubling for companies that believe being in a cloud resolves all security concerns. Many of them recently <a href="https://www.schneier.com/blog/archives/2023/08/microsoft-signing-key-stolen-by-chinese.html">learned a hard lesson</a> that attacks such as <a href="https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/">cloud authentication token theft are</a> real and impactful. We should expect a significant increase in cloud infrastructure attacks, leading to more extortion.</p><h3>Diversification of extortion methods beyond encryption</h3><p>In addition to the above threats, we predict a rise in extortion emails like sextortion and business threats. These emails, typically disseminated through botnets, use intense scare tactics but are often repetitive. In 2024, expect a surge in creative email extortion. This could include the generation of falsified images or the introduction of new subjects for extortion, further complicating the cybersecurity landscape.</p>

<h2>Threat delivery will become more sophisticated on mobile</h2><p>Mobile cyberthreats are rapidly evolving in sophistication. We anticipate an increase in unethical practices such as instant loan apps resulting in data theft and extortion, the rise of trojanized chat apps filled with spyware and crypto wallet thieves, and a shift in malware distribution methods, favoring web-based threats through social media, messaging, or email, rather than attacks through apps.</p><h3>Instant loans as a lure into blackmail and extortion</h3><p>There is a growing concern about the rise in malicious practices within the instant loan app industry as the financial industry continues to advance. With the rise of these apps, some lenders use unethical tactics for repayments. More instant loan apps are stealing data from delinquent borrowers and rogue apps misuse user data to pressure repayments and add high late fees. This practice is increasingly common and is expected to intensify in 2024.&nbsp;</p><h3>Trojanized chat apps with spyware and stealing modules</h3><p>There could be a rise in fake chat apps with hidden crypto-stealing features or spyware. These fraudulent apps may abuse the trust users have in communication platforms, penetrating devices to extract confidential information or cryptocurrency keys. These attacks could include advanced social engineering methods, persuading users to give extensive permissions under the pretense of adding chat features that are not present in standard chat clients.</p><h3>Shifts in the delivery techniques of mobile threats</h3><p>Distributing web-based threats like phishing is much easier than it would be on native applications (and often with a higher return on investment). This is a key reason for the steep rise in such attack types on mobile devices, where they account for more than <a href="https://decoded.avast.io/threatresearch/avast-q3-2023-threat-report/">80% of all attacks</a>. We predict that this trend will persist, with more malicious actors using web-delivery attack methods rather than using native mobile applications.</p>

<h2>Rising threats in the cryptocurrency sphere</h2><p>The evolving cryptocurrency landscape introduces significant cybersecurity risks. The decentralized nature of these platforms offers anonymity but lacks the traditional safeguards of financial institutions. This absence of oversight and the inability to reverse transactions or monitor for fraudulent activities amplify the risks associated with these digital assets.&nbsp;</p><h3>An increased focus on crypto wallets by cybercriminals</h3><p>Cybercriminals are quickly adapting to the growing interest in cryptocurrencies. We're observing a marked increase in attacks targeting crypto wallets. Attackers are increasingly targeting crypto wallets with refined and sophisticated methods. This trend is likely to intensify, posing a significant threat to individual and institutional investors in the cryptocurrency space.</p><h3>Malware as a service will continue to evolve</h3><p>Services like <a href="https://decoded.avast.io/threatresearch/avast-q3-2023-threat-report/">Lumma</a>&nbsp;— a Malware-as-a-Service (MaaS) product targeting cryptocurrency wallets — are evolving with new features and better anti-detection capabilities. These MaaS companies act similarly to corporations, with malware advancements funded by profits from their malicious activities.</p><p>A new technique is the renewal of stolen cookies. This method enables attackers to retain access to hacked online accounts, even when passwords are updated. The consequences for online account security are significant; and we anticipate this will profoundly affect the coming year, requiring innovative strategies in digital security and account management.</p><h3>Vulnerabilities in crypto exchanges and cross-currency transactions</h3><p>Crypto exchanges are facing more attacks, leading to significant financial losses. A unique risk lies in the vulnerability of protocols allowing currency exchange. These exchange protocols can be manipulated to issue funds or alter balances, challenging users and experts. Given the potential for significant financial damage and the complex nature of these attacks, there is an urgent need for stronger security measures and greater vigilance in the cryptocurrency exchange sector.</p><p>Using accessible formal verification systems and SAT solvers, attackers analyze crypto system source codes for vulnerabilities and exploit them to steal cryptocurrency. As a result, we anticipate more high-volume frauds next year.</p><h2>Conclusion</h2><p>The cybersecurity predictions for 2024 underscore a landscape in flux, dominated by the dual forces of AI's promise and peril. While AI tools can be leveraged for protection, their misuse by cybercriminals presents a significant challenge.&nbsp;</p><p>As we look to the future, it’s clear that a proactive and educated stance on cybersecurity is not just advisable — it is imperative. Our strategies must evolve in tandem with the threats we face, ensuring that we remain one step ahead in the ever-escalating cyber arms race.</p>

Navigating the evolving threat landscape

Cybersecurity predictions for 2024 

Threat Research Team

<p>Large language models (LLMs) and generative AI are significantly increasing their abilities and global utilization. While these tools offer undeniable utility to the general public, they also present potential risks of misuse. Furthermore, bad actors are also actively investigating tools like OpenAI's ChatGPT.&nbsp;</p><p>This document describes the following aspects of an AI-based cyber threat landscape:&nbsp;</p><ul><li>How ChatGPT brand is misused for lures, scams, or other social engineering-related threats&nbsp;</li><li>How generative AI can be used to generate malware&nbsp;</li><li>The potential pitfalls and changes it brings for security researchers and attackers&nbsp;</li><li>How ChatGPT and generative AI can help security researchers in their daily struggles, providing insights, and bringing AI-based assistants to their toolset&nbsp;</li></ul><p>Generative AI and other forms of AI are going to play a key role in the cyber threat landscape. We expect that highly believable and multilingual texts misused for phishing and scams will be leveraged at scale, providing better opportunities for more advanced social engineering.&nbsp;</p><p>On the other hand, we believe that generative AI as it stands now is unlikely to drastically alter the landscape of malware generation. Although many proofs of the concept exist—mainly from security firms and nefarious actors testing the technology—it's still a complex approach, especially when compared to existing, simpler methods.&nbsp;</p><p>Despite the risks, it is important to recognize the value that generative AI brings to the table when used for legitimate purposes. We already see security and AI-based assistant tools with various levels of maturity and specialization emerging on the market.&nbsp;&nbsp;</p><p>Given the rapid development of these tools and the widespread availability of open-source versions, we can reasonably anticipate a substantial improvement in their capabilities in the near future.&nbsp;</p>

<h3><a href="https://cmsb.nortonlifelock.com/sites/default/files/2023-09/LLM%20malware%20090523.pdf">Read the full whitepaper here.</a></h3>

With the rapid development of AI and the widespread availability of open-source versions, we can anticipate improvements in their capabilities.

Insights Into the AI-Based Cyberthreat Landscape 

<p>Join us at the end of October for a conference about new advances in machine learning. You will see how AI can help protect people against the bad guys on the Internet – a goal we trully believe in. We have teamed up with Czech Technical University to bring together the best minds in tech and academia. Experts from many universities world wide as well as a few of our own will share their vision for what the future holds and debate the possibilities of tomorrow’s digital landscape.</p><h2><strong>Speakers’s spotlight:</strong></h2><ul><li>Doug Tygar – UC Berkeley</li><li>Alex Halderman – University of Michigan</li><li>Matthias Grossglauser – EPFL Switzerland</li><li>Rachel Greenstadt – New York University</li><li>Christopher Kiekintveld – University of Texas</li></ul><p>You’ll have a chance to meet our new CTO Michal Pechoucek. He is a seasoned security specialist and a father of AI at CTU. Michal will give the opening talk.</p><h2><strong>Call for posters</strong></h2><p>If you’re a PhD student there is also a poster session where you’ve be able to present your research and achievements. The deadline is August 18th 2019.</p><h2><strong>More Info</strong></h2><ul><li>When: October 25th 2019</li><li>Where: Prague, Czech Republic</li><li>Details: <a href="https://www.cybersecprague.ai/">https://www.cybersecprague.ai/</a></li></ul>

Have you ever wondered how AI is used in cybersecurity?

CyberSec & AI Prague 2019

<p>Cryptojacking stole the limelight away from&nbsp;<a href="https://www.avast.com/c-ransomware">ransomware</a>&nbsp;at the end of 2017, becoming a major cyberthreat that continued into 2018. On March 8, 2019 Coinhive, the service that enables websites around the world to use browser CPUs to mine Monero, will shut down. Will Coinhive’s end also end browser-based cryptomining and jacking?</p><h2><strong>The rise of web-based cryptomining</strong></h2><p>Crypto coins are generated by solving a complex mathematical problem that meets certain criteria. The result confirms a set of transactions. If such a result is found, the first one to publish it receives a reward and the transaction fees from the given set. Various crypto coins use different algorithms, but most of them have been implemented in miner applications for CPU and GPU. JavaScript is a programming language used to implement the miner application and — as it’s supported by most browsers, meaning no special software is required to mine— makes it an attractive mining option. Most JavaScript miners mine Monero (XMR), because the mining algorithm is suitable for computations on a CPU, whereas mining Bitcoin (BTC), for example, on a CPU wouldn’t make much sense due to the algorithm and mining difficulty.</p><p>Mining cryptocurrency is a legit business, but to do this on a large scale, strong computing power is required. There are miners who run huge server farms to earn money with Bitcoin mining or mining of other cryptocurrencies. Running these server farms requires a high financial investment both for the infrastructure and electricity. For this reason, web-based cryptomining became popular; it doesn’t require the miner to install extra software and can be injected into websites.</p><h2><strong>Going from mining their own business to jacking around</strong></h2><p>Like most lucrative online activities, cryptomining became an attractive business model for cybercriminals. Cybercriminals began using other people’s computers and browsers to mine cryptocurrencies, without their permission, known as cryptojacking.</p><p>When it comes to cryptojacking, cybercriminals can either install software onto victims’ computers to mine or use websites to mine by implementing mining scripts into a website’s code. When a user visits an infected website, the script starts mining crypto coins using the visitor’s computing power. Installing software onto PCs requires skill, time and effort. Additionally, the chances of people noticing their computer is mining are higher when their computer’s GPU is being used to mine, slowing down their devices. Browser-based cryptojacking therefore became very popular; cybercriminals hijack websites to inject Coinhive’s JavaScript to mine using site visitors’ browsers, profiting from the time spent on the infected websites.</p><h2><strong>Cryptojacking in the gray zone</strong></h2><p>In terms of cybersecurity, cryptojacking landed in a bit of a gray zone. While the effects of cryptojacking, especially browser-based cryptojacking which mainly includes slowing down the browser, are bothersome, they aren’t devastating and often users are unaware their browser is mining. Not all browser-based cryptomining is malicious. There is a legitimate use of the cryptocurrency miners where websites give users the option to mine, to in return avoid seeing ads, or in the case of UNICEF to raise money for a charitable cause. We at Avast reached a point, however, where we needed to decide whether or not we should block all browser-based miners to protect our user base from cryptojacking.</p><p>We decided to create a set of strict rules, and miners that adhere to the rules and request to be whitelisted are not blocked, but those that do not are blocked by our antivirus. We consider mining on webpages to be ethical when users are explicitly asked permission, before the mining begins, and are educated on the process.</p><h2><strong>The decline in jacking</strong></h2><p>Security companies blocking web-based cryptojacking might be one of many reasons why cryptojacking is on a decline. In their blog post about discontinuing Coinhive, the Coinhive team mentioned the drop in the hash rate after the Monero fork and the crash of the cryptocurrency market, along with the upcoming fork and algorithm update of Monero, which will cause the hashrate to drop.</p><p>The number of browser cryptojacking attempts we blocked during Monero’s peak followed the trends in the value of Monero, as can be seen in the charts below. Bitcoin and the cryptocurrency market as a whole had a similar trend line. Coinhive’s decision to discontinue their service may not come as a surprise, given the drop in the value of cryptocurrencies and the fact that the service was often used by bad actors for cryptojacking without asking the users’ permission, resulting in the cryptominer being blocked by security companies.</p><h2><strong>The End of an Era</strong></h2><p>It’s difficult to predict whether or not browser-based cryptojacking will ever rise again after Coinhive discontinues its service or if another mining service will fill Coinhive’s void. According to&nbsp;<a href="https://twitter.com/bad_packets/status/1030201187381927936?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1030201187381927936&amp;ref_url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fcoinhive-cryptojacking-service-to-shut-down-in-march-2019%2F">Bad Packets Report</a>, Coinhive had a 62% share of website miners in August 2018. Even if another service decides to fill the gap Coinhive will leave, it may not be as successful as Coinhive once was, if it doesn’t allow cybercriminals to mine for their own financial gain.</p><p>The steady drop in Monero’s and other crypto currencies’ value might also be forcing cybercriminals to focus their attention on other, more profitable, activities. A possible rise in Monero’s value could cause cybercriminals to mine more again, but they would likely do this using PCs, if they care to make the extra effort.&nbsp;&nbsp;</p><p>Ultimately, Coinhive going out of business is a good thing for security, privacy, and transparency. Their business model relied upon taking 30% of all the coins mined on their service, and reportedly 100% of the money from coin that was mined on accounts that had been shut down for abuse. Its flaws were clear. With the value of Monero dropping significantly over the course of 2018, the hard forks and AV on their tail, it was impossible for Coinhive to maintain profit. Pushed by the AV companies, Coinhive has launched a service with explicit opt-in, so that will show us the true size of the legitimate market and if cryptomining can indeed be an alternative to advertising.</p>

Will Coinhive’s end lead to the end of browser-based cryptomining and cryptojacking?

The End of Coinhive; The end of cryptojacking?

<p>A chain is only as strong as its weakest link. This is also true in the world of security. This year, we tracked a growing threat trend — that when just one device in a home or small business (usually the router) is compromised, then the rest of the devices on the network become easy to compromise. With connected devices — known as the internet of things — growing faster than any device category in history, it’s increasingly difficult to buy appliances and home goods that do not have a connection to the internet.</p><p>From connected lights to coffee makers and smart speakers to door locks, IoT devices will continue to drive a class of attacks aimed at exploiting their weaknesses in configuration, security flaws, and consumers’ low interaction with their settings. Therefore, the main theme of our predictions is based on how infiltrating an IoT device could easily lead to breaking into the perimeter where IoT devices with compromised modems reside.</p><p>As we begin the new year, we are publishing a&nbsp;<strong>3-part series on 2019 predictions</strong>. We will cover&nbsp;<strong>IoT</strong>,&nbsp;<strong>mobile threats</strong>, and<strong>&nbsp;AI&nbsp;</strong>in these posts, all developed from insights and analysis by the Avast Threat Intelligence Team. In this first post, we are focusing on our top IoT threat predictions for 2019, including those from 2018 that continue to present challenges.</p>

<h2><strong>The internet of (vulnerable) things</strong></h2><p>The category of IoT is rapidly expanding, and for good reason — while a person typically has one laptop and mobile phone, they may have a multitude of connected devices in their home from doorbell, to entertainment, to home security. According to Juniper Research, the number of connected devices is expected to top 38.5 billion by 2020.</p><p>Here’s a peek at the brands and services that a smart home like that could encompass:</p>

<p>The trend toward smart devices will be so pronounced in the coming years that it will become difficult to buy appliances or home electronics that are&nbsp;<em>not&nbsp;</em>connected to the internet.&nbsp; &nbsp;</p><p>As much of our&nbsp;<a href="https://blog.avast.com/mqtt-vulnerabilities-hacking-smart-homes">research has shown</a>, security is unfortunately quite often an afterthought in the manufacturing of these devices. While many of the biggest brand-name smart devices do come with reasonable security embedded, some developers skimp on security to keep costs low for consumers, a mistake considering a smart home is only as safe as its weakest link.&nbsp;History tends to repeats itself, and just as PC and mobile&nbsp;<a href="https://www.avast.com/c-malware">malware</a>&nbsp;evolved, we expect to see IoT malware become more sophisticated and dangerous.</p><h2><strong>Router attacks</strong></h2><p>Anyone whose home is connected to the internet has a router to which they connect their computers, phones, and IoT devices. Routers are ubiquitous and important, but rarely maintained with the latest security standards. In fact, once an internet service provider installs the router, most people never give it a second thought, unless they experience internet disruptions.</p><p>Avast research shows that 60% of users worldwide have either never logged in to their router or have never updated their router’s firmware, leaving them potentially vulnerable to fairly simple attacks. The major problem here is that when an attacker uses a known vulnerability or weak authentication credentials to access a router, they gain access not just to the router, but to all devices connected to its network as well.</p><p>Routers have proven to be simple and fertile targets for a growing wave of attacks. While many attacks against routers use&nbsp;<a href="https://blog.avast.com/hacker-creates-seven-new-variants-of-the-mirai-botnet">variants based on the Mirai</a>&nbsp;codebase (which was released by the creator shortly after the successful attacks of September 2016), many are far more complex and point to a murky future for home network security.</p><p>Not only have we seen an increase in router-based malware in 2018, but also changes in the characteristics of those attacks. Where router-based malware has traditionally taken over a device for the purposes of carrying out a&nbsp;<a href="https://www.avast.com/c-ddos">DDoS</a>&nbsp;attack, such as the Mirai attacks, today’s attacks use malware to infect a device and open up a line of communication to a C&amp;C (command and control server), without taking any immediate action.</p><p>We saw this with VPNFilter and Torii; once the router is infected, these malware strains listen to the network traffic, fingerprint the network and the devices on it, and allow for the C&amp;C to send new payloads or instructions to the device. In this, the malware acts more like a platform and less like a&nbsp;<a href="https://www.avast.com/c-computer-virus">virus</a>. This “platform-ification” of malware opens up many possibilities such as pay-per-install as well as DDoS-for-hire or even good old-fashioned&nbsp;<a href="https://www.theregister.co.uk/2018/11/08/upnp_spam_botnet_broadcom/">spam</a>.</p><h2><strong>Downstream effects of router vulnerabilities</strong></h2><p>Routers will continue to be targeted, not just to run malicious scripts or spy on users, but also to be used as an intermediate link in chain attacks. In the case of the Mikrotik campaigns, a simple re-configuring of the router ended up affecting the entire internal network. The malware served JavaScript miners to all the browsers behind the router.</p><p>This attack also showed a potentially more worrisome trend, as these routers are not just in our homes, but also used by many smaller internet service providers. There is potential for an infected router to infect many hundreds or thousands of downstream devices. Further, it would be very difficult to figure out where the infection is coming from.</p><h2><strong>More modular IoT malware</strong></h2><p>Just as PC malware was very simple in its infancy, most IoT malware has been built for a very narrow purpose, such as to gather botnets for a DDoS attack. But like PC malware, IoT malware will learn and adjust its modus operandi from “one-trick” malware to multipurpose malware platforms capable of supporting organized pay-per-install campaigns.</p><p>There are benefits to infecting and then keeping a low profile, rather than immediately monetizing the network. After getting a large volume of IoT devices under control, malware authors can repurpose their bots to do whatever they see fit (or whatever would be most profitable).</p><h2><strong>More sophisticated spreading techniques</strong></h2><p>We expect to see more and more malware that will infect IoT devices from the browser. Browser-based attacks on personal computers and mobile phones, called Cross Site Request Forgery, are found in the wild, but are not yet very common. In this scenario, a user visits a page with malicious Javascript, which will scan the user’s local network, find a vulnerable device, and infect it. It could be a valuable way to infect a device that is not visible from the internet, for example a device behind a NAT (Network Address Translation).</p><h2><strong>IoT malware as proxy</strong></h2><p>Right now, IoT malware authors typically monetize their deeds through cryptomining or DDoS-for-hire attacks, but this is not the most profitable approach. We think more and more IoT malware authors will begin infecting more powerful and interesting devices, like mobile phones, tablets and PCs.</p><p>An example would be infecting the router to inject JavaScript or any other malicious payload into the traffic delivered to the user. It could also be used as a proxy to connect and carry out attacks on other internet users or devices. By using a chain of infected devices that barely have any logging capabilities, attackers can disguise their original location, similar to how anonymization proxies work.</p><h2><strong>IoT malware will drop support for x86 architecture</strong></h2><p><a href="https://en.wikipedia.org/wiki/X86">x86</a>&nbsp;is one of the most common backward-compatible instruction set architectures and has been in use since Intel introduced it in the late 1970s. However, as more devices operating on alternate frameworks become available, it is logical that malware authors will stop including the x86 step to make reverse engineering harder for security vendors. There are many sandboxes for PEs (portable executables) and x86 ELFs (Executable and Linkable Formats), but the majority of them struggle to support other architectures.</p><p>Despite the warnings inherent in these predictions, we believe the burgeoning IoT-verse marks a thrilling moment in our techno-evolution. Just make sure you stay smart and security-conscious with each new device you allow into your life. To be better prepared for the technological landscape ahead,&nbsp;<a href="https://cdn2.hubspot.net/hubfs/486579/Avast%20Threat%20Landscape%20Report%202019.pdf">download and read the full&nbsp;<strong>2019 Avast Predictions</strong>&nbsp;report</a>.</p>

Avast experts walk you through next year’s most menacing IoT threats in part 1 of our 2019 predictions.

2019 predictions: The internet of (vulnerable) things

<h2><strong>Introduction</strong></h2><p>Today, we hear a lot about IoT, which stands for&nbsp;<a href="https://www.avast.com/c-what-is-the-internet-of-things">Internet of Things</a>. All these smart boxes, light bulbs, shades, thermostats, voice assistants, and smart machines are slowly sneaking into our households, businesses and industrial environments. It’s a logical and inevitable next step, as we include more devices in our homes, that we develop some way to control them.</p><p>Interconnecting and controlling&nbsp;<a href="https://www.avast.com/c-what-is-a-smart-home">smart home devices</a>&nbsp;is possible using the <code>Message Queuing Telemetry Transport (MQTT)</code> protocol.</p><p>When implementing the <code>MQTT</code> protocol, users set up a server. For consumers, the server usually lives on a PC or a mini computer such as Raspberry Pi, to which devices can connect to and communicate with. While the <code>MQTT</code> protocol itself is secure, if implemented and configured incorrectly, severe security issues can arise. At Avast, we took a closer look and using the&nbsp;<code>Shodan IoT</code> search engine&nbsp;found more than <code>49,000</code> <code>MQTT</code> servers publicly visible on the internet due to a misconfigured <code>MQTT</code> protocol. This includes more than <code>32,000</code> servers that had no password protection, putting these smart homes and businesses using such <code>MQTT</code> servers at risk of leaking data. If the <code>MQTT</code> protocol is not properly configured, cybercriminals can gain complete access to a home and for example, learn when their owners are at home, manipulate entertainment systems, voice assistants, household devices, and physically open smart doors.</p><p>Focusing on smart homes, you might be asking yourself: Why is a protocol like <code>MQTT</code> necessary, if it could put my home’s security and privacy at risk?&nbsp;Manually controlling a few smart devices is not a problem, but as they increase in number in our homes, they take more time to manage, and become a burden. It’s like managing a big computer network manually. At some point, without automation, managing connected devices becomes more work than the convenience is worth. Then along come more smart devices that connect with each other and cooperate and do tasks on their own without human interaction. For example, your garage door opens automatically as you arrive back home from the office, your house lights turn on, the thermostat is configured to a comfortable temperature, and your stereo begins to play jazz music in the living room.</p><p>So far, sounds nice, but what about security? Authentication? Authorization?</p><p>Complex systems that allow you to control your whole house from a mobile device, basically from anywhere in the world, are being built. The question is —how secure are these systems? They may not be as secure as you think.</p><h2><strong>The problem with IoT security</strong></h2><p>The reason IoT security is lacking is because the devices are built using technology protocols that date back to the 1980s. This is generally because the early use cases for IoT devices were largely industrial. There was high demand for systems that could collect and process data from various machines in factories or production lines. These “networks” weren’t using internet protocols to exchange data. In fact, they usually did not have external connectivity, so security was not a top concern.</p><p>The other problem is that people don’t generally &nbsp;focus on security when setting up IoT devices. If you don’t encourage the user to change the settings (at least to change the default password), they will probably end up using the default configuration.</p><h2><strong>Meet MQTT</strong></h2><p>One of the most common protocols that smart devices use to communicate is <code>MQTT</code>. It stands for&nbsp;<code>Message Queuing Telemetry Transport</code>, and was developed in the late 1990s as one of the <code>SCADA</code> protocols. It was used mainly for industrial automation and is, as its name suggests, for transporting short telemetry data messages. There is no standard for the format of data it transports — it will carry virtually any payload. The protocol is meant as a subscriber/publisher model. It works like an RSS feed: you subscribe to a topic, and once someone publishes something on the topic, the payload is delivered to all subscribers.</p><p>As mentioned earlier, there isn’t a security issue with the <code>MQTT</code> protocol nor the most common server software that implements this protocol (or&nbsp;<em>broker&nbsp;</em>as it is known in the case of <code>MQTT</code>), which is called&nbsp;<code>Mosquitto</code>. In fact, both <code>MQTT</code> and <code>Mosquitto</code> have broad security capabilities — for example, to provide fine-grained access control by user and topic. As with many things, the problems are created in the implementation and configuration. Let’s explore some real world use cases for <code>MQTT</code> before we dive into what can go wrong.</p><p><code>MQTT</code> is often used to overcome the gap between different protocols, so that different devices can communicate with each other even if they do not communicate using the same protocol. It’s very convenient as it allows topics to be organized in a hierarchical structure, creating a unified namespace for the whole smart home. For example, a topic structure can look like this:</p>

<p>You can see the structure is hierarchical, in this case outlining a structure for connected devices in a home. One of the things that makes <code>MQTT</code> so useful is that you can use wildcards when subscribing to the topics, similar to how filename or search wildcards work.</p><p><code>MQTT</code> has two wildcards:&nbsp;<code><strong>#</strong></code>&nbsp;and&nbsp;<code><strong>?</strong></code></p><p><code><strong>#</strong></code><strong>&nbsp;</strong>stands for all levels from its location/occurence, down the hierarchy, so for example by subscribing to:</p>

<p>An IoT device will get any message published to <code>/myhouse/garage/lights</code> or <code>/myhouse/garage/garagedoor</code>.</p><p>The&nbsp;<code>?</code> stands for all categories on any level and can be used anywhere in the hierarchy, more than once. So by subscribing to:</p>

<p>the device will receive all messages regarding the lights in any room, as ? in this case can be a kitchen or garage, for example.</p><p>By combining subscriptions, you can create a very complex scenario for controlling a group of devices by publishing on just one topic. Publishers can be, for example, <code>MQTT-capable</code> light switches. By pressing them, an <code>MQTT</code> message is published and action is taken. Any device can be a publisher, subscriber, or both.</p><p>But&nbsp;to create a<em>&nbsp;really</em>&nbsp;smart home&nbsp;we are still missing one crucial component: Automation.</p><p>Home automation usually comes in the form of software, or perhaps a smart box, which contains “business logic” and acts as a “smart home hub” to unify the control of the devices, which is where <code>MQTT</code> comes into the picture. <code>MQTT</code> is included in most smart home hub software solutions, such as Home Assistant, so users can either install a package that includes <code>MQTT</code> or install <code>MQTT</code> separately when setting up their smart home hub. Smart home hubs usually subscribe and publish <code>MQTT</code> messages and provide logic. They also provides some kind of dashboard, either locally or remotely, where you can control the whole “smart” home.</p><p>For example, if the hub gets the message from a soil sensor in your garden that the soil is too dry and knows that your water tank has enough water, it can activate the irrigation system to water your flowers. In this way, a number of smart devices can be connected to a smart hub, controlled, and even automated, using the <code>MQTT</code> protocol, even if they weren’t originally designed to work together.&nbsp;&nbsp;</p><h2><strong>The problem with MQTT</strong></h2><p>Let’s lay out the problem more clearly.</p><p>We have an <code>MQTT server</code> (<code>broker</code>) with embedded security capabilities, which serves as a “messenger” between all components. We have a smart home hub which orchestrates all our devices and adds real intelligence to the whole system, and we have various <code>MQTT-capable</code> or <code>MQTT-bridged</code> devices that are connected to the <code>MQTT</code> server/broker.</p><p>This all sounds good and makes sense, but what if the <code>MQTT</code> server does not have a secure configuration? As with a lot of vulnerabilities, the main issues are insecure and default configurations. What makes the misconfiguration of <code>MQTT</code> worse is that by getting access to the <code>MQTT</code> server, you get access to all the messages flowing through it. How? Remember <code>#</code> as a wildcard? You can subscribe to just <code>#</code> and nothing else. In such cases, every time someone publishes something on any topic, you’ll get that data.</p><p>More concerning is that many poorly configured <code>MQTT</code> servers are also publicly available on the internet without any password, allowing a cybercriminal to spy on any house that uses it. The “advantage” for the cybercriminal is that if the server is publicly available, he or she can connect to it from anywhere. Further, as most users don’t set up access controls— in the form of Access Control Lists (<code>ACLs</code>)—when they configure a <code>Mosquitto</code> while setting up their smart home hub, cybercriminals can not only subscribe to the server, but can also publish to it, thus seizing control of all devices in a smart home.</p><p>So, what is the scale of this problem? According to the&nbsp;<code>Shodan IoT search engine</code>, there are almost <code>49,000 MQTT servers exposed</code> on the internet. Of these, there are approximately <code>32,000 servers with no password</code> protection.</p>

MQTT servers publicly available on the internet (source: shodan.io)

<p>The vulnerabilities reflected by the total results above are most likely due to misconfigured <code>MQTT</code> servers. As users set up these systems to remotely control their smart home, they often expose not only the “dashboard” or control panel of the system, but also the <code>MQTT</code> server, as these two components usually run on the same machine or server. When this happens, it can leave users exposed.&nbsp;We found that, generally, it was not overly clear to users how they securely configure their <code>MQTT</code> connection during the installation process.&nbsp;</p><p>Here are a few examples of what can happen in the event the system is misconfigured.</p><h2><strong>Five easy ways to hack a smart home</strong></h2><p>We decided to see how easy it would be to gain access to an exposed smart home:</p><h3><strong>1) Connecting and subscribing to wildcard topics on an unprotected MQTT server</strong></h3><p>Our first test was to find an open and unprotected <code>MQTT</code> server and subscribe to the&nbsp;<code><strong>#</strong></code><strong>&nbsp;</strong>topic. This was easy enough and, once connected, we were able to receive every message published. In the case of some home automation systems, we could see the status of window sensors and open/closed doors. We could see every press of any light switch in the house and even the local weather forecast as you can see in the following image.</p>

<p>There are usually no <code>ACLs</code> (Access Control Lists), which is a fine grained access control to the topics in place, so once you are connected, you can also publish to topics. In this case, you can control devices or at least poison the data being collected by publishing on behalf of the devices. For example, you can send messages to the hub as if you were the security sensor at the smart home’s front door smart lock, because <code>MQTT</code> messages do not have a sender field so the message receiver is unable to determine where the request came from. Due to this, cybercriminals can easily perform “<code>replay attacks</code>” and send messages on behalf of the devices connected to the hub.</p><h3><strong>2) Connecting to unprotected smart hub dashboards on a secure MQTT server</strong></h3><p>What if the server is protected? Can we still get access to the home dashboard? We found that a smart home can be hacked even on a secure <code>MQTT</code> server, as sometimes a dashboard (smart home control panel) runs on the same IP address as the MQTT server.</p><p>Many homeowners use open source solutions for their smart home. The most popular software for smart hubs are readily available solutions such as <code>Domoticz</code>, <code>Home Assistant</code> and <code>OpenHAB</code>. When we looked for these, we were able to see a lot of default configurations, which surprisingly required no password. So, even if the <code>MQTT</code> server is secure, the dashboard can be accessed as easily as typing the IP address into a browser. By doing this, onecan get complete access to the house, all through a nice UI, like this:</p>

<p>Exploiting this access would allow a cybercriminal to control any of the devices connected via the dashboard including lights, locks, heating and cooling systems, cameras, and more. With this control, a cybercriminal could do any number of things, such as secretly spy on or record people within their home, drastically adjust their home’s temperature, or gain entrance to the home while the homeowners are on vacation or at work, without setting off any alarms.</p><h3><strong>3) Reading files on a protected MQTT server with a protected dashboard</strong></h3><p>But what if both the dashboard and the server are protected? There should be no way to gain access to the smart home, right? Well, maybe there is. How? It is as simple as checking other services.</p><p>In the case of the <code>Home Assistant</code> software “smart hub”, we found several instances of properly configured <code>MQTT</code> servers that were not exposed and a dashboard that was properly configured and password-protected. But, what was astonishing is that we found open and unsecure <code>SMB</code> shares. <code>SMB</code> is a protocol used for sharing files on internal networks, mainly on the Windows platform. We found publicly shared directories with all the <code>Home Assistant </code>files including configuration files. And that’s not all. Let’s see what else we found:</p>

<p>As you can see in the image, when we tried guessing the password, leaving it blank or using the default password (“welcome”), it didn’t work. So far, so good. The dashboard is protected.</p>

<p>We then decided to run a Shodan query on the same IP address. It turned out that there was an <code>SMB</code> (file sharing) service running without a security set. Note that <code>Home Assistant</code> shares all the files of installed software including configuration files.</p>

<p>When we were browsing through the exposed files, a particular one caught our eye. Did you notice the&nbsp;<code><em>secrets.yaml</em></code>&nbsp;file in the image above? When we opened it, we were astonished at the file’s content.</p>

<p>The&nbsp;<code><em>secrets.yaml</em></code>&nbsp;file contained usernames and passwords stored in plain text. There are also many other accounts for different cloud services or <code>API</code> keys that can be misused to gain control over them. What we were interested in was the&nbsp;<code><em>http_password</em></code>&nbsp;field. Using that field for a login screen, we got this:</p>

<p>As you can see, that’s complete control over someone’s house. You can even play audio via Spotify. We were trying to find a reason why there are so many poorly protected instances of Home Assistant.&nbsp;&nbsp;</p><p>We believe that the problem here is that users are not aware of the fact that once they install <code>HomeAssistant</code> on the server (in this case it’s probably <code>HASSBIAN</code> flavor of&nbsp;<code>HomeAssistant</code>&nbsp;intended as a ready made package for installation on various types of&nbsp;underlying&nbsp;hardware) and expose it to the internet to get access into the dashboard, they also often expose a Samba share that is used for accessing the configuration and installation files of <code>HomeAssistant</code>. By doing this, they unwillingly leave the whole system exposed to anyone and leak all the passwords and <code>API</code> keys stored there to the public. It has to be noted that even the tech savvy users sometimes lack basic knowledge of how to properly secure their open source systems.</p><h3><strong>4) Creating a UI on an unprotected MQTT server</strong></h3><p>Here are some interesting tools/apps out there that let you create a simple dashboard for an <code>MQTT-based</code> smart home. We found an application called&nbsp;<code>MQTT Dash</code>&nbsp;for Android and iOS that allows you to create your own dashboard and control panel for your home by placing various tiles on the screen and linking them with <code>MQTT</code> topics. What is most interesting is how the application stores the layout of the dashboard and configuration. Instead of creating a special file on your device, you can publish the whole setting to the topic of the <code>MQTT</code> server, and by doing so, can easily replicate the settings on as many devices as you wish.</p><p>That’s very convenient, but if the <code>MQTT</code> server is &nbsp;not secure, a cybercriminal can easily get the same UI as the user. This provides an easy way to hack someone’s home and even get their UI with just one connection to their <code>MQTT</code> server. Again, the default configuration makes it easier, and if there is a dashboard in use, such as one set up with the <code>MQTT Dash</code> app, you’ll most likely find a topic with the name <code>metrics/exchange</code>, a so-called <code>retained</code> topic. If you subscribe to a retained topic, you’ll receive the last stored payload/data, which basically means you can easily load the whole dashboard, as you can see in the following picture:</p>

<h3><strong>5) Tracking device location</strong></h3><p>What could be worse? <code>MQTT</code> servers typically concentrate on a lot of interesting and real time data. What we found is that many <code>MQTT</code> servers, some of which were not even connected to a smart home system, contain one very interesting topic beginning with <code>owntracks/…</code> &nbsp;If you do a short Google search, you can see that <code>OwnTracks</code> is an Android and iOS application that works as a personal <code>GPS</code> tracker. What is even more interesting is that it supports the <code>MQTT</code> protocol to share your location with your friends or family. Up until now, this sounds like an innocent function, right? Wrong! This feature is usually configured by connecting to an <code>MQTT</code> server without any encryption or authorization. Moreover, to be able to connect your phone to an <code>MQTT</code> server, you need to expose it to the internet and unfortunately, many users setup the configuration without considering any security measures. <code>OwnTracks</code> then sends a <code>JSON</code> message to the <code>MQTT</code> topic <code>owntracks/… </code>each time the phone changes location. Creepy right? Let’s see what the message looks like:</p>

<p>The&nbsp;<code>lon (longitude)</code>,&nbsp;<code>lat</code>&nbsp;(latitude) and&nbsp;<code>alt (altitude)</code>&nbsp;fields are self explanatory. You can even see the battery level of the phone is also sent to the server. The “tst” field is actually a timestamp for the position and is written in the UNIX epoch format and after decoding we found out the timestamp is from:&nbsp;<code>Tue 7 August 2018 11:26:48 UTC</code>.&nbsp;Using all this information you can easily reconstruct someone’s position during the day, month or year. And remember, all this information is available as real-time data.</p><p>Now you’re probably asking yourself, why share your location with the <code>MQTT</code> server? Well the answer is ….automation and convenience. Some of the “smart home” hubs or systems allow you to share your position with them to provide you with a better experience. Remember the scenario where your house automatically turns on the lights as you get close to home? Or, you could have your system turn off all the lights whenever nobody is at home. The sharing of <code>GPS</code> location information is exactly what the system needs to provide this functionality. The problem here again is security, more specifically, unsecured protocols and unencrypted <code>OwnTracks</code> messages. All because users rely on default configurations.</p><h2><strong>Conclusion</strong></h2><p>Because there are still many poorly secured protocols dating back to bygone technology eras when security was not a top concern, it is&nbsp;frighteningly&nbsp;easy to gain access and control of a person’s smart home. The convenience of IoT devices and smart home hubs connected to the internet is a double-edged sword, and there is a trade-off between ease-of-use and security.</p><p>Consumers need to&nbsp;be aware of the security concerns of connecting IoT devices&nbsp;that control personal parts of their home to services they don’t fully understand and the importance of properly configuring their devices.&nbsp;Industry-wide, we have called for better device-level security for IoT devices. In order to ensure users’ entire smart home ecosystem is secured, manufacturers need to develop IoT devices which are simple for consumers to set up with a high-level of security.&nbsp; Lastly,&nbsp;there is a need for more secure control solutions that allow consumers to confidently use technology in their homes with the knowledge that it is secure and their privacy protected.</p><p>IoT devices are slowly creeping their way into our homes—it is crucial to implement them correctly now, as we will only be adding more as time goes on.</p>

Avast expert Martin Hron tells you what you need to know about the strengths and weaknesses of IoT security and the MQTT protocol that connects and controls them.

Leadership Perspectives

Predictions 2025: Navigating the Future of Cybersecurity

Seeing Isn’t Believing – Tackling AI, Misinformation and Its Impact on an Election Year

The new frontier of cyberthreats: how nation-state groups are targeting consumers

The Scamverse: Navigating the New Frontiers of Cyberthreats

Helping to Keep Personal Data Safe

Cybersecurity predictions for 2024

Insights Into the AI-Based Cyberthreat Landscape

CyberSec & AI Prague 2019

The End of Coinhive; The end of cryptojacking?

2019 predictions: The internet of (vulnerable) things

Are smart homes vulnerable to hacking?

The new frontier of cyberthreats: how nation-state groups are targeting consumers 