There are those who say a “cyber pandemic” is inevitable. And there are those who say we’re in it right now.
Gil Schwed, founder and director of Israel’s cybersecurity pioneer, Check Point Software Technologies, belongs to the latter camp.
Cybercriminals already have the sophisticated tools to infect the websites of government organizations and major companies, Schwed argues. And we can’t rely on offense. Rather, he says, “We have to defend against [attacks] from day zero,” like a vaccination against illness.
A recent Allianz Risk Barometer survey revealed that companies in 89 countries are more concerned about ransomware attacks, data breaches or major IT outages than they are about supply chain disruption, natural disasters or the COVID-19 pandemic.
And no wonder: In the fast-changing online landscape, tantalizing opportunities for bad actors pop up like mushrooms overnight.
“It’s not a question of whether the hackers are going to get through. They will. It’s just a matter of how,” says Edo Yahav, VP R&D and general manager of SafeBreach Israel in Tel Aviv.
Israel’s approximately 450 cybersecurity companies play a significant role in predicting and protecting against cybercrime, in large part because the Israel military serves as a unique incubator for talent and innovation in this sector.
“I don’t think anyone else in the world has this type of advantage,” says Liel Strauch, director of cybersecurity research at PerimeterX of Tel Aviv and Silicon Valley.
Within the emerging metaverse, what are the biggest cyber risks experts expect to be battling in the coming years?
Beware of bots
PerimeterX secures ecommerce, media and travel websites against automated fraud and client-side attacks, detecting and proactively managing risks to web applications, says Strauch.
For example, the company’s Bot Defender deflects attacks by bots — bits of software programmed to do anything from taking over an account to snatching up and scalping limited-edition items like sneakers. (Read more about sneaker bots here.)
The increasing popularity and value of limited-edition items and unique NFTs (non-fungible tokens) is attractive to attackers, says Strauch.
“We can assume we’ll see bots attacking NFT sales and the metaverse in general in order to gain profit in cryptocurrency or converted to actual money,” she tells ISRAEL21c.
“Another thing we have seen gaining traction with attackers … is supply chain attacks,” she adds.
A supply chain attack is when a hacker infiltrates a website through the “blind spot” of software vulnerabilities in third-party vendors running on that site with access to its data. Google Analytics is an example of a third-party vendor.
“This will be one of the main ways for attackers to gain access to data of different enterprises,” says Strauch.
Through the third party, attackers inject a piece of code to different JavaScripts that run on a website, collecting users’ personal information such as credit card numbers.
“Since this creates a lot of profit for cybercriminals, we can assume supply chain attacks will increase in coming years,” she says.
The unfolding metaverse will drive a lot more traffic to the digital world, providing more opportunities for bad actors to profit — and therefore more opportunities for cybersecurity companies to profit, Strauch predicts.
What is the metaverse? Also called “Web 3.0,” it’s a collection of technologies that adds an immersive 3D dimension to our digital interactions.
On the bright side, the shift to the metaverse means that “everything happens in the same world, similar to how it was easier to deal with physical ‘skimming’ when it happened on ATMs and you knew exactly where it was going to happen and what to do,” says Strauch.
“Now that everything will be transferred to digital assets it will help companies invest more in technologies to protect those digital assets.”
Avoiding account takeovers
“One of the main trends we see is account takeovers,” says Elad Cohen, VP Data Science for Riskified, one of four cybersecurity firms we featured in our recent report on anti-fraud technologies.
“We ran a survey showing that at least 17 percent of consumers had one of their accounts taken over. We believe there’s been a five-fold increase in attempts over the last three years. In 2021, one in 140 logins was an account takeover attempt. We anticipate this will continue increasing.”
Ecommerce companies face a dilemma: Customers prefer a purchasing process that’s as easy (“frictionless”) as possible, for example when their password and credit card number are saved on the website. Using password-free authentication (such as SMS messages with a temporary code to type in) adds friction and leads to lost sales.
However, the more frictionless the process the easier it is for hackers to take over the account.
“There is always a balance between ease of use and difficulty for hackers to crack,” Cohen says.
Plus, loyalty points or discounts that lure return customers to use their stored account add value and vulnerability that further entice hackers.
“It makes the potential for account takeover much more lucrative. And once the fraudster has credentials for an account, it’s easier to monetize it,” says Cohen.
Ephraim Rinsky, who handles product marketing for account security at Riskified, adds that stealing credentials is only getting easier.
“Two years ago, to break into an account I’d have to go on the dark web and shop around for credentials. Today, you can buy credentials on Telegram groups or even on the normal web. A teenager sitting at home can get credentials to log into an ecommerce site within a minute.”
Merchants will need ever more sophisticated fraud-prevention technologies to block fraudsters, especially if the password-stealer uses bots that, as Riskified often sees, make up to 40,000 attempts per hour to break into accounts across many ecommerce sites.
“If you close one door in authentication fraud, fraudsters will open the next one,” says Rinsky. “It’s a cat-and-mouse game.”
While Riskified and others work behind the scenes to solve vulnerability problems across authentication methods, everyone can help protect their own accounts simply by never reusing a password, say Cohen and Rinsky.
Watch your digital wallet
Smart password management may also be the best protection against cybercrimes targeting digital assets, says Shy Datika, founder and president of INX, which offers regulated trading platforms for digital securities and cryptocurrencies.
The CB Insights report “12 Tech Trends to Watch Closely in 2022” reveals that although illicit activity affects less than 1% of crypto transactions, crypto crime reports are rising.
“These include hackers stealing coins from investors, individuals falling for crypto investing-related scams, and more. … in December 2021, cybercriminals stole $150M in cryptocurrency from exchange BitMart as a result of a security breach involving stolen private keys,” the report states.
Read that closely and you will understand why Datika says cybercrimes involving cryptocurrency are “just stupid, regular hacking.”
“If someone is hacking your phone or computer and stealing your password and using it to enter your hot wallet, that is not a cybercrime relating to crypto. It’s simply done by stealing passwords,” he says.
While a small percentage of crypto-related crimes (Datika estimates 10–20 percent) occur during the transfer of cryptocurrency between a “cold” (physical) wallet and a “hot” (Internet-connected) wallet, Datika points out it’s impossible to hack the blockchain directly.
As for scammers who fool people into sending cryptocurrency to the scammer’s digital wallet, it’s another old trick applied to a new form of money. And it’s likely to increase as cryptocurrency becomes more popular.
Ransomware, quantum computing
“In the upcoming years, large enterprises like financial and healthcare companies will see more of the same types of attacks but much more complex — for example, a lot more ransomware,” predicts Edo Yahav of SafeBreach, the most widely used continuous security validation platform.
“Why? Because it works and it’s lucrative. Companies usually pay the ransom because they don’t want to lose their data. As long as it pays off, it will continue and it will get more complex to stop it,” says Yahav.
“Due to the ability to work from home or from anywhere, the need to support a very dynamic workplace means more tools must be introduced into the mix. Additional tools and complexity lead to human errors and hackers can take advantage of that,” he adds. “This is why companies need to keep assessing and evaluating their arsenal.”
The rise of quantum computing in the next decade poses another big threat, Yahav says. Quantum computers can break the encryption algorithms that secure online commerce, communications and financial services.
“It will change the security industry by keeping large enterprises on their toes. They will need to identify and secure their most valuable assets with the right software instead of trying to secure everything,” says Yahav.
Israel will continue being a significant source of cybersecurity solutions for new and upcoming threats, he predicts.
“The security mindset is embedded within Israel,” he says. “Unless something dramatic changes in the Middle East, we’ll see more and more security mindset in Israeli youngsters and thought leaders.”
Produced in association with ISRAEL21c.
