Securing the cities of tomorrow: Three takeaways from Black Hat 2019
As thousands of hackers descended upon the desert for Las Vegas’ annual Black Hat conference, it quickly became clear that nothing was immune to cyber-attack. From hotel smart locks to ATM machines to emergency call centers, hackers and security experts alike showed how cyber-criminals can infiltrate a plethora of supposedly airtight systems. And when it comes to the latest exploit, what happens in Vegas won’t stay there for long.
Yet this state of perpetual vulnerability is, of course, unacceptable for online defenders — particularly for cities whose primary responsibility is the safety of their citizens. Whereas smart city technology like IoT traffic sensors, driverless vehicles, and connected energy grids promise to unlock new heights of efficiency, such innovations are replete with uncharted security flaws that put the world’s most critical infrastructure at risk. Ultimately, Black Hat demonstrated why, to safeguard the cities of tomorrow, we must go beyond looking for yesterday’s threats.
If it’s smart, it’s vulnerable
This phrase was a consistent theme for the researchers who discussed threats facing the Internet of Things — perhaps the defining feature of smart cities around the globe. Coinciding with an explosion in the number of connected devices, 2018 witnessed a 100% year-over-year increase in IoT attacks, and it seems criminals have been ramping up their efforts in 2019. Meanwhile, conventional cyber defenses, designed to protect standard IT from known threats, are often incompatible with these nontraditional machines.
More fundamentally, the race to produce even more IoT devices prevents experts from anticipating their weaknesses. Such was the case when two German hackers compromised high-end smart locks at a European hotel — whose name was not disclosed because the locks were still in use. Known as “mobile keys” due to their reliance on mobile phones rather than on access cards, the locks leveraged Bluetooth low energy (BLE), a technology that many IoT devices employ. The researchers explained how they easily intercepted the BLE traffic in order to develop their exploit, which could have been used for malicious ends to break into private rooms or even to shut down the hotel elevator.
A cautious host
Hosting a conference for hackers can be a nail-biting experience to say the least — one only exacerbated for local governments with highly bespoke smart infrastructure. Thus, among the entities that garnered the most attention at Black Hat was none other than the City of Las Vegas itself.
A town made famous by bold wagers and grand ambitions, Las Vegas is betting big that it knows what the city of tomorrow looks like. As riders glide down the Strip aboard the first completely autonomous shuttle ever deployed on a public roadway, they can rest assured that a network of IoT sensors are helping officials anticipate gridlock at busy intersections, while AI-powered surveillance cameras monitor for litter on the sidewalks around them. In the near future, everything from The Venetian to Mandalay Bay may well be integrated into a single vast, municipal network — a digital labyrinth far too complex for traditional security tools to make sense of, much less defend.
“For all the benefit the IoT brings, it also brings with it that side of security,” Michael Sherwood, Las Vegas’ Director of IT and Innovation and a Darktrace customer, told Reuters. “These things are carrying people across the street, they’re controlling our traffic signals, [so] a lot could go wrong if someone could get into that system.”
Breaching the ballot
In addition to threats imperiling physical infrastructure, the cities of tomorrow cannot disregard trust-eroding attacks against a more abstract target: the democratic process. The subject of election hacking in particular received top billing at the conference, in light of the blind spots posed by not only voting machines themselves, but also voter registration databases and the distribution process. Many experts feared that all three areas remained susceptible to compromise ahead of the 2020 US elections.
These revelations are not without precedent. Until 2015, Virginia used the infamous WINVote machine, which lacked any security controls whatsoever. And although future digital voting technologies may have better safeguards, cyber-criminals have proven undeterred by even the most impressive perimeter defenses. With the conflict surrounding Russian interference in the last national election and worries that similar attacks on the American election systems will happen again, researchers emphasized the need to rethink our approach to election security altogether.
The takeaways from Black Hat all share a common theme: the legacy approach to cyber security is no longer keeping pace with an ever-evolving threat landscape. As a result, for smart cities like Las Vegas, the path forward looks little like the road already traveled. Innovative, AI-powered security platforms have become an imperative to catch novel threats against novel devices — before the black hats’ work is done.
Max Heinemeyer
Max is a cyber security expert with over nine years’ experience in the field, specializing in network monitoring and offensive security. At Darktrace, Max works with strategic customers to help them investigate and respond to threats, as well as overseeing the cyber security analyst team in the Cambridge UK headquarters. Prior to his current role, Max led the Threat and Vulnerability Management department for Hewlett-Packard in Central Europe. In this role he worked as a white hat hacker, leading penetration tests and red team engagements. He was also part of the German Chaos Computer Club when he was still living in Germany. Max holds a MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.
Back to square one: The Capital One breach proved we must rethink cloud security
By all accounts, Capital One defended its customers’ data with the imposing array of cyber security tools that you’d expect from one of the largest banks in the United States. And yet a lone hacker managed to bypass those tools and obtain the sensitive personal information of more than one hundred million people, a breach that will likely cost the bank well over a hundred million dollars when all is said and done.
The hacker — a former employee of Amazon Web Services, which hosted the compromised database — gained access to the sensitive data by exploiting a misconfiguration in one of Capital One’s application firewalls. Such misconfigurations along the customer’s interface with the cloud have become a favorite target for cyber-criminals. In fact, according to Gartner, 99% of cloud security failures will be the customer's responsibility through 2023.
The fundamental flaw
At a time when virtually all enterprises have adopted cloud infrastructures that expand and evolve as needed, configuring firewalls and other endpoint protections to remain properly positioned can be a daunting challenge. These conventional security tools are designed to defend the digital perimeter — an antiquated strategy given today’s borderless networks. Moreover, modern developers now have the ability to spin up a cloud instance in minutes, often without having to consult their firm’s security team. As a consequence, the overwhelming majority of organizations lack visibility over their own cloud environments.
While nearly half of organizations don’t even bother looking for malware on the cloud, Capital One had a relatively mature cloud security posture — at least by traditional standards. It is therefore all the more alarming that the bank didn’t become aware of the breach until more than three months after the fact, when it received a tip from an outsider who’d stumbled upon the stolen data. That a major financial institution was blind to this level of compromise further demonstrates the urgency of rethinking cloud security.
Of course, there is no silver bullet when it comes to cyber defense — and that goes double for the cloud. Motivated attackers will inevitably find a way inside the nebulous perimeters of IaaS and SaaS environments, whether via insider knowledge, critical misconfigurations, personalized phishing emails, or mechanisms that have yet to be seen. The path forward, then, is to use artificial intelligence to understand how users behave within those perimeter walls, an understanding that shines a light on the subtle behavioral shifts indicative of a threat.
Demystifying the cloud
The latest cyber AI security tools aim to do just that: observing traffic activity on AWS and other CSPs to learn an evolving sense of ‘self’ for each unique cloud environment they protect. Indeed, this ability to distinguish between normal and abnormal behavior proved decisive when a financial services company faced an attack strikingly similar to the Capital One breach. The firm was hosting a number of critical servers on virtual machines — some of which were meant to be public-facing, some of which were not. When configuring its native cloud controls, however, the firm mistakenly left one of its private servers exposed to the internet, rather than isolated behind a firewall.
The exposed server was eventually discovered and targeted by cyber-criminals who were scanning the internet via Shodan, a search engine that locates internet-connected assets. Within seconds, Darktrace’s AI detected that the device was receiving an unusual amount of incoming connection attempts from a wide range of rare external sources and alerted the security team — which had been unaware of the misconfiguration. This “unusual” volume of “rare” connections might well have been normal for a different company or a different server, but the AI’s knowledge of ‘self’ revealed the activity to be anomalous in this exact case.
By employing such AI systems, we can gain the necessary knowledge of complex cloud environments to catch threats in their nascent stages — before they escalate into crises. Ultimately, the cloud promises to unlock new heights of efficiency and novel forms of collaboration, so long as we’re willing to adopt equally innovative security tools. Because while there may never be a silver bullet for safeguarding cloud services, AI does offer hope for a silver lining.
To learn more about how cyber AI security tools detect advanced attacks on the cloud, check out our Cloud Threat Report 2019.
Justin Fier
Justin is one of the US’s leading cyber intelligence experts, and holds the position of Director for Cyber Intelligence & Analytics at Darktrace. His insights on cyber security and artificial intelligence have been widely reported in leading media outlets, including the Wall Street Journal, CNN, The Washington Post, and VICELAND. With over 10 years of experience in cyber defense, Justin has supported various elements in the US intelligence community, holding mission-critical security roles with Lockheed Martin, Northrop Grumman Mission Systems and Abraxas. Justin is also a highly-skilled technical specialist, and works with Darktrace’s strategic global customers on threat analysis, defensive cyber operations, protecting IoT, and machine learning.
Recent posts
