Xconomy: Cyber Trend: Hackers Love to Steal Data; Now They Might Weaponize It
For years, cyber attackers’ primary aim has been to pilfer sensitive information from businesses and individuals, either to sell it in the dark corners of the Internet, hold it for ransom, or use it themselves for material gain.
More recently, efforts to connect all manner of machines to the Internet has led to growing worries that hackers will gain control of critical infrastructure—such as the electrical grid or traffic lights—and wreak havoc.
One of the next frontiers in cyber threats, some security investors and technologists say, could be to manipulate data to use it against us in new ways.
“The obvious play today is to disrupt systems and steal data,” says Joseph Witt, vice president of engineering at data management software firm Hortonworks (NASDAQ: HDP) and a former National Security Agency software engineer. “But a much more nefarious and troubling problem is slow, persistent manipulation of systems and enterprises.”
Call this emerging threat the “weaponization of data,” says Bob Ackerman, founder and managing director of AllegisCyber, a bicoastal venture capital firm that backs startups in cybersecurity, data science, and connected devices.
“We see the beginnings of this in the Russian interference in elections by manipulating data,” Ackerman says.
By that he means adversaries creating fake online identities and distributing disinformation “designed to shape opinion” or to “sow confusion and undermine trust” in American institutions and leaders, Ackerman says.
The spread of disinformation is “something that we’ve practiced in warfare for eons—propaganda and electronic warfare,” Ackerman adds. “How do you make the planes [being tracked on the screen] appear some place other than where they are? That’s all disinformation.”
That concept could spread to commercial arenas. One threat Ackerman suggests would be to inject false data into automated financial trading systems, to drive certain stocks up or down. Or, in a worst-case scenario, feeding bad data to a high-frequency trading system could set off a chain reaction that could disrupt or melt down entire financial markets, Ackerman says. Still, that might be difficult for hackers to pull off because they’d have to get past financial firms’ security measures to insert the data. Plus, the stock markets have controls in place to halt trading to avoid such a disaster—although there is some debate about how well such “circuit breakers” work.
Nevertheless, Ackerman says any digital system that involves “data-driven automation” could be vulnerable to such an attack.
“Machine-learning systems are only as good as the data that they are trained with,” Ackerman says, meaning that if trained with disinformation, the systems could go haywire. “In a digital economy, everything we’re processing is ones and zeroes. How do we trust it?”
Witt thinks it’s possible hackers or a business’s competitors could try to infiltrate a company’s IT infrastructure to insert false data that could trip up their operations. In the case of an automaker, for example, perhaps the hacker would create erroneous data about supply chain activity that might cause the company to spend more on inventory.
“It’s one thing just to steal the data of your competitor so you know what they’re going to do,” Witt says. “It’s another to alter their systems in subtle ways that actually change what they do.” That’s a more sophisticated and “potentially more disruptive” kind of attack, Witt adds, although he says he hasn’t seen examples of it happening “in a commercial context yet.”
Greg Dracon, a partner with Boston-based venture capital firm .
