UK Cyber Chief Warns of “Foothills” of New Hacking Era After 3 Attacks
The head of the UK's National Cyber Security Centre says the world is in the foothills of a new hacking era. Three attacks in days hit a crypto exchange, Ukraine's alert app and refrigerators across Europe, and officials expect more disruption.
Richard Horne, head of the UK's National Cyber Security Centre (NCSC), said this week the world is in the "foothills" of a new hacking era, after three attacks in days, including a record $6.3bn (£4.7bn) theft from the cryptocurrency exchange Binance on October 30. The latest cyber news also includes a fake nuclear alert in Kyiv and refrigerators overheating across Europe.
The official message after the fridge attacks is to expect more disruption.
Horne said flaws in IT systems, now being exposed by artificial intelligence, are a growing danger. "There are so many vulnerabilities out there that … you could say are waiting to be exploited," he said.
"The most serious risk we face in the short term is just a huge rise in the volume of incidents," he added. He said the last few months suggest that rise has started.
The three attacks
On November 1, hackers targeted Ukraine's emergency alert app and sent people in Kyiv a fake nuclear strike alert. Binance had been robbed two days earlier.
The refrigeration attack came on a Monday last week. Retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported similar problems. Some shops saw fridges and freezers climb as high as 50C (122F). French blood banks have also been affected.
Alex Pearce, who runs a fruit and vegetable wholesale business in London, spotted the fault on his morning rounds. The defrost lights were on and the panel on one unit read 150C. He pulled the internet cable from the box connecting the units.
"If it had happened on a Saturday morning, when I don't tend to be here, it could ultimately have led to a fire," Pearce said.
AI and geopolitics
The NCSC points to two forces: geopolitics and AI. At least one expert has said the fridge attacks bear Russian hallmarks. The Binance hack has been attributed to the North Korean state, and Russia is a natural suspect in the Ukraine incident.
The NCSC said last week that AI-powered malicious software was "highly likely" to be used against the UK's power stations, airports and hospitals by 2028. It said AI would help attackers scout targets, find weaknesses in networks and write malicious code.
There are caveats. Paul Chichester, the NCSC's director of operations, said the cold storage hackers "really didn't need" AI to find the fridge flaws. They were already out there, including default access passwords published in one fridge operating company's manuals.
Last month, websites around the world were briefly taken offline as a precaution after AI technology from OpenAI, the ChatGPT developer, helped discover a flaw in PHP, a computer language used to build much of the web. French supermarket fridges were also attacked last month, in what could have been a trial run for the wider assault.
Sophos, a cybersecurity firm, said it had not seen any major incidents among its clients linked to the PHP flaw. Like others in the industry, it had seen a significant number of attempts.
Azeem Azhar, a tech entrepreneur and commentator, called the way AI models find flaws that attackers can use a "Wuhan moment". He cited cybersecurity executive Matthew Prince, who said last month: "We're going to have a couple of years where every single week it's going to feel like the sky is falling."
