Subex warns of increased cyberattacks bearing a geopolitical motive in 2020

The adoption of IoT is growing globally. Today, active sensors are monitoring and reporting on everything from weather conditions, traffic, power consumption, water pressure, among others. Smart technology is everywhere, enabling cities, people, and governments to do more.

It won't be an exaggeration to say that the IoT boom is already here. But as more and more sensors and devices are connected to the internet, cybercriminals gain more opportunities to leverage unattended vulnerabilities. IoT botnets can compromise and leverage thousands of such devices to wreak havoc on deployments.

2019 saw a range of attacks on IoT infrastructure. Wicked, OMG Mirai, Triton, Shamoon, ADB. Miner, DoubleDoor, Hide ‘N Seek, and Mirai-Variant IoT Botnets were widely seen in cyberattacks around the world.

2020 will see hackers go after data with increased zeal. This includes high jacking devices as part of Advanced Persistent Threat attacks and using them to gain access to sensitive data and IP, which could be held for ransom. The sectors that will attract maximum attacks in South America include oil and gas, infrastructure, utilities, defense, and retail. Attacks bearing a geopolitical motive are also expected to increase this year.

Regional hackers have figured out that businesses are more willing to pay ransoms to prevent such data from being published online or on the dark web. This they are working to target devices and networks to pilfer data and record conversations of value. Another tactic gaining currency is data poisoning wherein inaccurate information is fed into decision making systems to disrupt large systems.

Publishing zero-day vulnerabilities without taking the vendor into confidence or giving them reaction time to patch devices creates a unique advantage for hackers as they can take advantage of such vulnerabilities to create widespread damage. This trend will persist in 2020, albeit with vendors turning more cooperative, responsive, and with more information being made available, lesser instances will come to the fore.

With more businesses using bots to log data in CRMERP or other business management software, the data accessed by such bots are becoming more critical with each passing year. By spoofing identity, hackers can gain access to critical systems and then use such bots to exfiltrate data, and since most of these bots are today working with very little monitoring, an attack could theoretically last months or even years, if they go undetected.

As geopolitical faults expand, cyberwarfare has turned deadlier. Today actors sponsored by nation-states are investing in AI-based offenses to harass their adversaries. Geopolitical attacks are now targeting critical industrial systems, utilities, smart devices, renewable energy farms, offshore oil rigs, and more. With agencies finding it difficult to suppress information on such attacks from leaking out into the mass media, hackers are getting more aggressive as the impact of their work becomes more visible, monetarily rewarding, and discussed.

The global network of botnets will also grow and expand in terms of devices and countries in 2020. This is one trend that refuses to move into negative territory because of various reasons.

Sectors such as banking and financial services, healthcare, oil and gas, and retail will continue to attract attention from hackers in 2020. The attacks will get more sophisticated, and the attack signature will turn even paler as hackers use newer tactics and strategies to breach networks.

On the response front, as this article is being written, we are seeing cybersecurity being addressed through "codes of practice" and "guidelines." The government of California has openly come out with its resolve to make businesses do more towards securing their infrastructure, and others will follow in 2020. What is still missing is a coordinated effort to address the problem at hand. Cybersecurity will remain a half-hearted battle until all stakeholders join hands and launch a concerted effort to curb the menace.

Globally, cybercrimes cost over $600 bn in damages in 2018. No nation is rich enough to afford such a colossal loss individually or collectively. Instead, if this money were to be deployed for improving healthcare, generating employment, and improving civic infrastructure, the magnitude of the damage becomes more apparent. Hopefully, 2020 will be the year where we see more coordination between stakeholders. Such a collaboration is inevitable if we are to see lasting progress in the war on cybercrimes.

The author Kiran Zachariah is Vice President, IoT Business Solutions, Subex.