In Feb 2024, a finance manager Ravi (name anonymized) received a message from his CFO. The message said their company needed to make a secret payment, and asked Ravi to join a video call to discuss details. Ravi was initially suspicious. But, he put aside his early doubts when he joined the video call and saw his CFO and other colleagues on the call. He followed the CFO’s ask and authorized a payment of $25 million to the account provided.

It turns out that all the faces and voices on the video call were AI-generated deepfakes. This is a real incident from Hong Kong.

We live in interesting times. AI is having a wide-ranging impact on the planet, both good and bad. It enables amazing new use cases. It is displacing jobs. But most importantly it is challenging the foundational element that made society possible – trust. This article covers one slice of that topic, AI’s impact on cybersecurity

Artificial Intelligence 101

ChatGPT has caught the world’s fancy in the last two years. There is much more to AI than ChatGPT. Here is a quick flyby, enough to appear informed at a social event!

Artificial Intelligence refers to the ability of a computer to perform tasks “commonly associated” with humans. There are, broadly speaking, two ways in which AI may be applied.

• Predictive AI is used when the goal is to pick the best choice (according to a given scoring method) from a pre-determined range of choices. Examples: Deepblue from IBM beat then-champion Garry Kasparov, using predictive AI that could analyze 200 million moves in one second to pick the best move. A self-driving car picks which way and how much to steer based on what it senses in the environment. Netflix recommends the shows you are most likely to enjoy. Google, Meta, and Bing rank the ads most relevant to you.

• Generative AI is used when the goal is to generate new content. Large Language Models (LLMs) are the most popular cases for Generative AI. They are designed to generate text. ChatGPT is the most famous application for LLMs.

Your Processor Goes Brrrr… and Leaks Sensitive Data!!

Imagine you’re super careful about your data security. You only run trusted apps and software on your phone or computer, and you make sure they’re free of bugs. You’d think your data was completely safe, right? Well, not quite. Even if the software you use is flawless, modern processors, the brains of your devices—can still make mistakes. In order to run faster, they try to “guess” what might happen next (this is called speculative execution). Sometimes, they guess wrong, which might give them access to information they aren’t supposed to handle, like passwords or private. Even though this access is brief, it can still leak information through very sneaky side effects, which are called side-channels.

So, what is a side-channel? One simple example involves the time it takes your device to do things. Imagine you’re opening a locked box, and depending on how long it takes you, someone could guess whether the box was already unlocked or not. In computers, attackers can measure how long it takes the processor to retrieve data from its memory. By studying these tiny differences in time, they can figure out what kind of information is being accessed, even without directly touching it.

In this article we will look at the types of cyber frauds that scamsters perpetrate in banking and payments, and see how the variety, risks, numbers and sophistication of such frauds grew with the growth of computerisation of banking operations resulting in customer convenience. As the role of computerisation in banking grew and became more sophisticated, so did the variety and sophistication of cyber fraud. We will also see what banks do to minimise the risk of such frauds, and importantly, what we as customers of banks can do to avoid falling prey to such fraudsters. A caveat – this article talks only about cybersecurity in the context of banking as it relates to the handling and transfer of money. It does not deal with cyber fraud related to securities transactions and insurance – that will take another couple of articles.

Forgery 

In the 1970s, before computers came into banking operations, you had to go to a bank branch to do any kind of banking transaction, starting from opening a bank account, to depositing or withdrawing cash, or transferring money to another account. You could write a cheque and hand it over physically or by post to whoever you wanted to transfer money to. That person would have to go to his or her bank and deposit the cheque into their bank account by filling in a slip. The cheque would then travel to a local cheque clearing centre, from where it would go to the payer’s bank branch. If the cheque was from another city (an “outstation” cheque), then it would have to be sent by post to the bank branch where it was drawn. If there was sufficient balance in the account and the signature matched with the sample signature with the bank, then the cheque would be “cleared” and retained by the payer’s bank branch. Banks had a specific number of days to reject the cheque if there was insufficient balance or a signature mismatch, and the cheque would travel back to the payee’s bank branch, and the payee would be informed about the cheque being “returned”. This process would often take several days, until which time the payee had no idea if his/her account had been credited. If one wanted a guaranteed document, then the payer had to make out a bank draft by going to the branch, filling up a form and the branch would issue a bank draft payable to the payee.

In those days, the only way somebody could steal money from your account was to steal your chequebook and forge your signature.

The reason for explaining the process in so much detail is for younger readers who have not seen what banking was like in India before computerisation to understand the breathtaking transformation that has happened in banking in the last forty to fifty years.

To a gamer, the phrase “Capture The Flag” might bring into mind several first-person and third-person shooter games where the objective is to capture the opponent’s flag to establish dominance and win points to attain victory. I would be lying if I said that was not my first encounter with the phrase “Capture The Flag”, and even though I no longer frequently game, I have very fond (if not violent) memories of the genre. However, given that this article is in the cybersecurity section, one might be led to think “Capture The Flag” likely has to do with something else (unless it’s about hacking into shooter games, but that’s a topic for another day). In fact, one would be right!

Imagine a hacking competition where you have to break into systems and exploit vulnerabilities. To stress, I do not mean “hackathons”, which are albeit pretentious names for coding competitions or other generic tech competitions far removed from real hacking. These actual hacking competitions are called CTFs. What is the rationale behind such a name? After you have successfully compromised the system under interest in a challenge in this competition, you find a string of text called a “flag” which you then submit to the competition server as “proof of hack” to get credited for successfully completing the challenge. This attempt at capturing “flags” across challenges is what gives CTFs its name.

Kinds of CTFs

CTFs occur in a variety of flavours. They could be conducted as an offline event, or as a large-scale online event. They could be an individual CTF, a team-based CTF with teams capped by a maximum size limit, or a team-based CTF without an upper cap on the team size.

They are usually conducted for 24 hours or 48 hours and often spawn challenges from a variety of cybersecurity categories, the common ones being Cryptography, Digital Forensics, Reverse Engineering, Binary Exploitation, and Web Exploitation.

There are many other categories which one finds in CTFs nowadays which cover several new and important technologies in cyberspace, including but not limited to Cloud Security, Blockchain Security, Zero-Knowledge Proofs, Post-Quantum Cryptography, Game Hacking (and I shall now resist my temptation to connect cybersecurity CTFs with shooter CTFs), and many more.

A CTF style is more than the categories of challenges it provides; CTFs can also be in different formats. The most popular format is called “Jeopardy CTF”, named after the famous American game show. You are explicitly presented with various categories and several challenges in each category, and you can pick and choose which one you want to solve and when you want to solve it. There is no restriction on parallelism, you can work on several challenges simultaneously.

CyberSecurity has gained prominence in the past few years with the proliferation of the Internet and Mobile handset. The mobile handset has put the Capitalise internet in everyone’s palm. On the one hand the Internet changed the way we communicate, conduct business, engage with people and businesses, but on the other hand the Internet also enabled anonymous entities to access your always connected devices by exploiting weaknesses in your devices or by exploiting weak passwords. In more recent times exploits target weaknesses in human psychology.

The goal of all exploits is to compromise your device, gain control of your device or gain access to your privileges on some other device, a server on the Capitalise internet (your photos or work data on a google drive or on an Amazon S3 bucket). Increasingly it is to gain control or access of your data. Devices are less valuable than the data that reside in those devices.

Cybersecurity is the practice and application of tools, techniques and processes to secure your devices and privileges on third party devices. The tools can be broken down into multiple specialised sub domains. This image-pdf (from Optiv) provides a nice classification of the different cybersecurity solution providers.

Some solutions target the network pathways through which malicious activity is carried out or malicious content is planted/distributed. Some solutions ensure robust authentication is present in all pathways. Some solutions monitor device activity to watch for any anomalous behaviour (either via artefacts on the device or via artefacts on the network wire. Please note ether is the wire in wireless). Some other solutions prevent data export from devices by locking down all possible ways by which data can be sent out (block hardware interfaces such as USB, block email attachments etc). Many solutions target the device directly. They monitor the device health continuously ensuring the device is always healthy. In summary Cybersecurity is a not a single point solution, but involves practising and applying defence in depth.

In India, 63 million Micro, Small, and Medium Enterprises (MSMEs) contribute employment of 164 million, 30% of GDP, and around 40-50% exports. However, according to global reports, 43% of cyberattacks target small businesses, and one in two small and medium enterprises (SMEs) has a chance of a cyber breach. Without cyber security protection, these businesses could hamper the country’s economy, as they contribute significantly to the economy.

According to the latest research conducted on MSMEs in India, where 82 top management of these organizations shared their valuable inputs, Figure 1 shows an overview of the cybersecurity posture of these companies. More than 51% of these companies responded they have some kind of cybersecurity control in place. Few of these MSMEs had adopted some kind of standard or framework, such as ISO 27001 (more than 21%) and NIST CSF (around 6%). Around 63% of these organizations do not have any cybersecurity standard or framework adopted. Among those who had responded with some kind of cybersecurity adoption in place, around 29% of those are not having any security policies, guidelines, and guidelines. Closed-Circuit Television (CCTV) (around 17%), security guards (more than 11%), and fire suppression (around 11%) were mostly popular as physical controls among MSMEs. Also, antivirus software (around 30%), firewalls (more than 20%), and authentication solutions (around 14%) were the most popular technical controls for MSMEs.