cnn.com - AI cybersecurity explained

Why was one of the most severe threats to the foundation of the internet left unresolved for 22 years?

Because it would have taken mind-numbing work for a human to figure out how to take advantage of it: tedious, time-consuming, monotonous coding. That rendered the PHP vulnerability impractical to exploit.

AI just figured out how to do it in two days.

*************************************************

https://www3.nhk.or.jp/nhkworld/news/20261022de637...

Japan's IwaiCosmo Securities says the online-trade management system of its outsourcing company was compromised, sparking unauthorized trades.

The brokerage says it has confirmed that buy and sell orders not intended by clients were placed for seven accounts. Trades were completed in five of them.

But it says the incident was not caused by stolen personal information or a breach of customer authentication.

Trade Works, the system provider, puts the blame on flaws in its management functions.

IwaiCosmo says artificial intelligence apparently found vulnerabilities in the system and attacked it directly, resulting in the unauthorized trades.

The cyberattack also exposed personal information, such as names and email addresses, of about 4,900 clients. But the company says the data leak is not linked to the unauthorized orders.

**********************************************

I have accounts at three brokerage houses and a number of US and foreign banks. There are various linkages between these accounts to allow funds to move on an as-needed basis, which presumably involves both the domestic ACH and international SWIFT transfer mechanisms - an d therefore all sorts of third party entities.

I suspect there are few readers here who have not, at some point or another, had their personal information exposed during one hack or another and many who have already had some sort of active attempt at identity theft or credit card fraud.

Sure there are things we can do proactively; freezing your credit account with the three major credit bureaus, using different (random) passwords for each on-line account, using two fact authorization, minimizing direct connections between accounts and so on make sense. But none of these offer much protection if the software used by our financial counterparties (or even by our own router/operation system and our ISO's infrastructure could be compromised. We have also lived through decades of "bug-fixes" to software which was presented to us as functionally perfect when we bought its license (generally ignoring its multi-page EULA (End-User License Agreement) and only the most naive amongst us would fully trust the software we use, as well as those used by the counterparties we deal with daily (not to mention the data miners who have been siphoning off our information for years) not to have dangerous as-yet undiscovered flaws.

The adversaries has graduated from sending letters by post indicating that they are Nigerian princes with a fortune to bestow to sophisticated criminals using AI tools.

Not a pretty picture.

Jeff