Future cyber attacks could attack medical implants – or wage “psychological war” in virtual reality, Europol warns

New hi-tech cyber attacks could threaten energy supplies, “wearable” computers – and even medical implants, according to a study conducted by Europol’s European Cybercrime Centre (EC3) and the International Cyber Security Protection Alliance (ICSPA).

Attacks in “virtual reality” or “augmented reality” could even be tailored to cause “psychological harm to individuals”.
The white paper, which examines emerging threat scenarios for the year 2020, also envisages bio-hacks which could allow criminals to defeat biometric authentication systems such as fingerprint authentication.
Many of the paper’s predictions are based on trends emerging now. This year, the FDA issued an alert about security flaws in 300 common medical devices made by 40 vendors.
In a detailed blog post outlining the challenges facing health care IT security, ESET Senior Researcher Stephen Cobb says, “Healthcare is a sector that has seen rapid growth in the deployment of digital systems aimed at delivering better medical care at lower cost. Unfortunately, despite an explicit regimen of rules aimed at safeguarding the privacy and security of patient data in the U.S. the sector is currently rife with security breaches.”
Attempts to defeat biometric security have also been in the news courtesy of Apple’s fingerprint sensor in the new iPhone 5S - although, at present, those “hacking” such systems are using basic and laborious methods. “Bear in mind the effort required to defeat the biometric, and also to crack your iPhone password, then ask yourself how many people want your iPhone data that badly,” says ESET Senior Researcher Stephen Cobb.
The study’s authors warn that cybercriminals will attack not only corporations and governments – but individuals – and envisage a world where, “society and second-generation digital natives depend on the secure running of deeply embedded technologies,” and the distinction between physical and cyber crimes becomes blurred.

“We don’t just have to ask ourselves ‘how can we fight these threats’, but also ‘who will fight them?’,” said John Lyons, the Chief Executive of ICSPA. “To meet the challenges of cybercrime, we need to become more creative and flexible. We must make sure law enforcement, criminal justice, governments and business pull in the same direction, but they have to do so without trampling on their citizen’s expectations of privacy and anonymity.”

“The Internet delivers tremendous societal and economic advantages to nations that have learned how to harness the significant benefits that derive from ubiquitous online computing and communications systems.  With Project 2020 we don’t predict the future, but we ask the questions that need to be answered to keep us all safe,” Lyons said.

Other experts have predicted such attacks for decades. ESET Senior Research Fellow David Harley, in a paper presented at EICAR in 2002 with Andrew Lee, predicted that viruses would evolve to attack the body – or technologies implanted within it, ““There is no doubt at all that commercial interests will continue to drive technology forward. If, as at present, the security and integrity of those systems is not paramount, then we will inevitably see no reduction of the
amount of malware developed to exploit such systems,” Harley wrote. The full paper can be read here.
“It is also likely that the amount of damage, whether commercial or otherwise, will increase in parallel with this trend. There are already moves towards wearable computers ,and experimentation is underway with computers that function as an extension of thehuman body. It is conceivably possible that such systems will be the norm, even replacing today’s desktop PC’s. It seems a logical step to move from palmtop and laptop devices todevices integrated into the human body or mind, simply because it is not unreasonable to state that the slowest part of a computer is its human user.”
“ Bearing this in mind, it is interesting to speculate about the nature of malware that could exploit this technology. Perhaps the analogue with biological viruses proposed by Cohen will become an actuality,with no distinction between biological viruses and human viruses.
“For instance, Lucent Technologies have been able to create molecular scale transistors, atechnological breakthrough that will certainly have application in wearable or symbiotic computers.”
“Further speculation might lead one to wonder about the effects that such malware couldhave. Today we talk about business systems and corporate networks being ‘taken out’ bycomputer viruses. However, were the business systems to be flesh and blood humans, the effects could be far more devastating.”
“There is a perennial debate in the virus world that deals with the reality or otherwise of malware that can physically damage hardware. This debate is fairly interminable, and the evidence mainly anecdotal or received by methods comparable to the old party game of Chinese whispers.  In some future reality though, where computers are an integral part of the human body,whether as enhancements to human function, or a means by which business is transacted,the spectre of malware being able to do physical damage to its host becomes ever more corporeal.”

GCHQ and NSA outsourcing cyber security tasks to third-party vendors

Government agencies such as GCHQ and NSA are outsourcing their requirements to private security firms to boost their cyber capabilities, according to F-Secure.
F-Secure chief research officer Mikko Hypponen (pictured left) reported uncovering evidence that the NSA's Tailored Access Operations (TAO) unit and GCHQ are outsourcing missions to third-party security companies.
"One thing I've been doing for the past two years is finding where they get their expertise from. Do they recruit in house and train? Do they go to universities?" he said.
"I found these job posts listing experience with ‘the Forte Meade customer' as a necessary skill. The Forte Meade customer is the NSA."
Hypponen confirmed to V3 that he has seen similar job posts for roles with the UK GCHQ and several other government intelligence agencies. He added that the trend is unsurprising and is simply a sign that agencies are suffering the same effects of the ongoing cyber skills gap as private industry.
"It's no wonder they're outsourcing, because they can't build or find the skills inside. If you want to have a good cyber offensive capability you need a new arsenal of exploits. You need a fresh supply of weaponised exploits, which builds a demand in the market," he said.
A lack of skilled cyber security professionals is an ongoing concern within Europe. Within the UK the government has listed plugging the gap as a key goal of its ongoing Cyber Strategy. As part of the strategy, the government has launched several education-focused initiatives designed to increase the number of young people training to enter the information security industry.
Initiatives have included the creation of new higher education centres, apprenticeship schemes and open challenges. Most recently the UK GCHQ has launched a Can You Find It challenge to help find and recruit the next generation of cyber security code experts.
Hypponen said the outsourcing is troubling as it sheds further doubt on intelligence agencies' ethics, which have come into question since the PRISM scandal. The PRISM scandal broke when whistleblower Edward Snowden leaked confidential documents proving the NSA was gathering vast amounts of web user data from tech companies such as Google, Facebook, Microsoft and Apple.
Since word of the scandal broke the NSA has attempted to downplay its significance and justify its PRISM operations, claiming its agents looked at just 0.00004 percent of global web traffic. Hypponen dismissed the NSA's arguments, claiming there is no justification for PRISM.
"As the leaks came out they tried to explain ‘they're just monitoring the foreigners', which concerned me. I'm a foreigner. But then they said it's nothing to worry about as if it's not foreigners its part of the War on Terror. But then it emerged they'd targeted the EU. It's very difficult to list spying on an ally government department as being part of the War on Terror," he said.
"The next justification was ‘everyone's doing it' and this is no different. But it is different, as no country has the visibility the US does. How many businesses use US-based companies' systems? There used to be some people using Nokia, but that's been sold to the US. Skype used to be trusted but its been sold to the States. All the world is using a US-based cloud system that the US government has a legal right to. It's not the same."
The F-Secure chief added that the NSA's behaviour is doubly troubling as it has tarnished two of the most positive technology innovations of the age. "The two greatest tools of our time have been turned into government surveillance tools. I'm talking about the mobile phone and the internet. George Orwell was an optimist. This is what's happened."
Hypponen is one of many security experts to slam the NSA over PRISM. Renowned cryptographer Bruce Schneier attacked the NSA in August over its treatment of former anonymous email service provider Lavabit, claiming the agency has "commandeered the internet".
Lavabit was an anonymising mail tool used by Snowden. Lavabit owner Ladar Levison shut the service down earlier this year claiming unspecified requests from the NSA meant continuing the service would inevitably force him to commit crimes against the American people.