The dark web’s criminal minds see Internet of Things as next big hacking prize

Published

2 years ago

January 9, 2023

admin

Krisanapong Detraphiphat | Moment | Getty Images

John Hultquist, vice president of intelligence analysis at Google-owned cybersecurity firm Mandiant, likens his job to studying criminal minds through a soda straw. He monitors cyberthreat groups in real time on the dark web, watching what amounts to a free market of criminal innovation ebb and flow.

Groups buy and sell services, and one hot idea — a business model for a crime — can take off quickly when people realize that it works to do damage or to get people to pay. Last year, it was ransomware, as criminal hacking groups figured out how to shut down servers through what’s called directed denial of service attacks. But 2022, say experts, may have marked an inflection point due to the rapid proliferation of IoT (Internet of Things) devices.

Attacks are evolving from those that shut down computers or stole data, to include those that could more directly wreak havoc on everyday life. IoT devices can be the entry points for attacks on parts of countries’ critical infrastructure, like electrical grids or pipelines, or they can be the specific targets of criminals, as in the case of cars or medical devices that contain software.

“What I wish is that the vulnerabilities of cybersecurity could never negatively affect human life and infrastructure,” says Meredith Schnur, cyber brokerage leader for US & Canada at Marsh & McLennan, which insures large companies against cyberattacks. “Everything else is just business.”

For the past decade, manufacturers, software companies and consumers have been rushing to the promise of Internet of Things devices. Now there are an estimated 17 billion in the world, from printers to garage door openers, each one packed with software (some of it open-source software) that can be easily hacked. In a conversation Dec. 26 with The Financial Times, Mario Greco, the group CEO of giant insurer Zurich Insurance Group, said cyberattacks could pose a larger threat to insurers than pandemics and climate change, if hackers aim to disrupt lives, rather than merely spying or stealing data.

IoT devices are a key entry point for many attacks, according to Microsoft’s Digital Defense Report 2022. “While the security of IT hardware and software has strengthened in recent years, the security of Internet of Things (IoT) … has not kept pace,” according to the report.

A rash of attacks that reached the physical world through the cyber world in the past year show the rising stakes. Last February, Toyota stopped operations at one of its plants because of a cyberattack. In April, Ukraine’s power grid was targeted. In May, the Port of London was hit with a cyberattack. That followed up on a 2021 that included to major attacks on critical infrastructure in the U.S., taking down energy and food supply operations of Colonial Pipeline and the JBS meatpacking conglomerate.

What many experts are anticipating is the day enterprising criminals or hackers affiliated with a nation-state figure out an easy-to-replicate scheme using IoT devices at scale. A group of criminals, perhaps connected to a foreign government, could figure out how to take control of many things at once – like cars, or medical devices. “We have already seen large-scale attacks using IoT, in the form of IoT botnets. In that case, actors leveraging unpatched vulnerabilities in IoT devices used control of those devices to carry out denial of service attacks against many targets. Those vulnerabilities are found regularly in ubiquitous products that are rarely updated.”

In other words, the possibility already exists. It’s only a question of when a criminal or a nation decides to act in a way that targets the physical world at a large scale. “It’s not always the art of the possible. It’s a market-driven thing,” Hultquist said. “Somebody figures out a scheme that is successful at making money.”

Aside from responding rapidly to attacks, the only answer to the “cat-and-mouse game” is constant innovation, says Shlomo Kramer, an early investor in Palo Alto Networks and currently one of the top cyber security investors worldwide.

There are a handful of companies, new regulatory approaches, a growing focus on cars as a particularly important area, and a new movement within the software engineering world to do a better job of incorporating cybersecurity from the beginning.

Internet of Things has a big update problem

The cybersecurity industry is upping its game. Companies including ForeScout and Phosphorus focus on Internet of Things security, which has a heavy emphasis on constant inventory of “endpoints” – where new devices connect to a network.

But one of the key problems in Internet of Things security is that there isn’t a good process for updating devices with patches, as new vulnerabilities, hacks or attacks are discovered, says Greg Clark, former CEO of Symantec, currently the chairman of Forescout. Many users are accustomed to downloading updates and patches to computers and phones; and even in those cases, a significant number of users don’t bother to do the updates.

The problem is much worse in the IoT: For instance, who bothers to update their garage-door opener? “Not many of the IoT devices have a system to update the code,” says Clark. “It becomes a serious problem to remediate the vulnerabilities in the IoT.”

He said one focus for cybersecurity companies has become putting controls around the devices so they can only do a specific set of things. That way, the devices can’t be weaponized to launch attacks on other networks. “There are a lot of hammers swinging,” Clark said, on products that make the IoT more secure).

Medical devices, which are seen as particularly important and particularly vulnerable, are one focus. Last month, Palo Alto Networks announced a new product aimed at medical device makers.

IoT device makers are not regulated enough

Because the challenges are new, and cut across industries, the U.S. guidelines and regulations remain patchwork. That has left a lot of IoT cybersecurity up to consumers and companies across sectors, rather than the many manufacturers making IoT devices.

“I’m hopeful there will be some new standards, and newer regulations that will force the vendors to do more,” says Randy Trzeciak, director of the science information and security policy & management program at Carnegie Mellon University. “There should be a national discussion around insuring device security, and where the manufacturer needs to take some ownership and responsibility.”

Clark said CISA and the National Institutes of Standards and Technology are working together, issuing guidelines for the thousands of manufacturers that make IoT devices covering such things as ensuring that IoT devices identify themselves to networks as they are added to them. In 2020, the U.S. Congress turned the guidelines into a law, but only for companies that supply the U.S. government with IoT devices. A spokesman for the National Institutes of Standards and Technology says this is the only national law the agency knows of. Some state-specific and industry-specific laws also exist: For instance, data in medical devices would be covered by HIPAA, and the National Highway Traffic Safety Administration has some jurisdiction over cars.

Some investors and executives cautiously welcome the increasing involvement of regulators. “It’s simply too complex,” Kramer said. “There’s not enough qualified and experienced security people.”

How cars are being targeted

As more criminal hackers aim attacks at the physical sphere, cars are a target. That includes theft, with attackers exploiting the keyless entry systems, but also attacks on sensitive information now being stored in cars, such as maps and credit card data.

Led by the European Union, countries around the world are rapidly adopting cybersecurity regulations for cars, with the EU’s coming into effect in July of last year.

The transition to electric vehicles has created an opportunity for regulators to get ahead of the criminals. As the new technology lowered the barriers to entry, more car companies entered the market. In turn, that has created an opportunity for regulators to work with industry groups that want to protect their home-grown industries.

The concerns about cars are nothing new. In one landmark experiment in 2015, two hackers attacked a Jeep Cherokee. “They shut down the engine on the highway – the brakes didn’t respond. This is not a pleasant situation,” said David Barzilai, CEO of a six-year-old Israeli company called Karamba Security, which helps car companies make their IoT devices more secure.

Barzilai says that in the past 12 months, there were dozens of attacks, both by serious criminal gangs and teen-agers. “When we started six years ago, the attacks were by states, mostly China,” he says. “Within the last 12 months, there’s a democratization” in car attacks, he said, pointing to the case in January 2022 of the teen who figured out how to access the control systems of a few dozen Teslas at once, last January — have already done.

Connected cars usually have SIM cards, that hackers can attack via cellular networks, he said. “All cars of the same vehicle model use the same software,” he said. “Once hackers identify a vulnerability, and a way to exploit it remotely, they can replicate the attack on other vehicles.”

Cybersecurity grew as an industry mostly as an after-the-fact attempt to fix software and hardware that was long since on the market, as criminals and foreign governments discovered vulnerabilities in the systems that they could exploit. One study by IBM‘s System Science’s Institute found it costs six times more to fix a cybersecurity vulnerability while software is being implemented than when it is under development. The IoT is still relatively new as an industry, giving security-minded developers a chance to get ahead of the cat-and-mouse game, says Trzeciak, and there’s a growing movement of researchers and developers working on this, including Carnegie Mellon’s Software Engineering Institute’s DevSecOps initiative, which aims to add security into earlier phases of software development. That process-based innovation could make all kinds of software, including that in cars and medical devices, more secure — and therefore, the devices safer.

Technology

World’s biggest chipmaker TSMC posts record 2024 revenue as AI boost continues

Published

3 hours ago

January 10, 2025

admin

World's biggest chipmaker TSMC posts record 2024 revenue as AI boost continues

The logo for Taiwan Semiconductor Manufacturing Company is displayed on a screen on the floor of the New York Stock Exchange on Sept. 26, 2023.

Brendan Mcdermid | Reuters

Taiwan Semiconductor Manufacturing Co. posted December quarter revenue that topped analyst estimates, as the company continues to get a boost from the AI boom.

The world’s largest chip manufacturer reported fourth-quarter revenue of 868.5 billion New Taiwan dollars ($26.3 billion), according to CNBC calculations, up 38.8% year-on-year.

That beat Refinitiv consensus estimates of 850.1 billion New Taiwan dollars.

For 2024, TSMC’s revenue totaled 2.9 trillion New Taiwan Dollars, its highest annual sales since going public in 1994.

TSMC manufacturers semiconductors for some of the world’s biggest companies, including Apple and Nvidia.

TSMC is seen as the most advanced chipmaker in the world, given its ability to manufacture leading-edge semiconductors. The company has been helped along by the strong demand for AI chips, particularly from Nvidia, as well as ever-improving smartphone semiconductors.

“TSMC has benefited significantly from the strong demand for AI,” Brady Wang, associate director at Counterpoint Research told CNBC.

Wang said “capacity utilization” for TSMC’s 3 nanometer and 5 nanometer processes — the most advanced chips — “has consistently exceeded 100%.”

AI graphics processing units (GPUs), such as those designed by Nvidia, and other artificial intelligence chips are driving this demand, Wang said.

Taiwan-listed shares of TSMC have risen 88% over the last 12 months.

TSMC’s latest sales figures may also give hope to investors that the the demand for artificial intelligence chips and services may continue into 2025.

Foxconn, which assembles Apple’s iPhones, reported its highest-ever fourth quarter revenue this week, as it notched strong demand for AI servers.

Meanwhile, Microsoft this month said that it plans to spend $80 billion in its fiscal year to June on the construction of data centers that can handle artificial intelligence workloads.

CNBC’s Jordan Novet contributed to this report.

Technology

Supreme Court set to hear oral arguments on challenge to TikTok ban

Published

10 hours ago

January 10, 2025

admin

Supreme Court set to hear oral arguments on challenge to TikTok ban

Tik Tok creators gather before a press conference to voice their opposition to the “Protecting Americans from Foreign Adversary Controlled Applications Act,” pending crackdown legislation on TikTok in the House of Representatives, on Capitol Hill in Washington, U.S., March 12, 2024.

Craig Hudson | Reuters

The Supreme Court on Friday will hear oral arguments in the case involving the future of TikTok in the U.S., which could ban the popular app as soon as next week.

The justices will consider whether the Protecting Americans from Foreign Adversary Controlled Applications Act, the law that targets TikTok’s ban and imposes harsh civil penalties for app “entities” that continue to carry the service after Jan.19, violates the U.S. Constitution’s free speech protections.

It’s unclear when the court will hand down a decision, and if China’s ByteDance continues to refuse to divest TikTok to an American company, it faces a complete ban nationwide.

What will change about the user experience?

The roughly 115 million U.S. TikTok monthly active users could face a range of scenarios depending on when the Supreme Court hands down a decision.

If no word comes before the law takes effect on Jan. 19 and the ban goes through, it’s possible that users would still be able to post or engage with the app if they already have it downloaded. However, those users would likely be unable to update or redownload the app after that date, multiple legal experts said.

Thousands of short-form video creators who generate income from TikTok through ad revenue, paid partnerships, merchandise and more will likely need to transition their businesses to other platforms, like YouTube or Instagram.

“Shutting down TikTok, even for a single day, would be a big deal, not just for people who create content on TikTok, but everyone who shares or views content,” said George Wang, a staff attorney at the Knight First Amendment Institute who helped write the institute’s amicus briefs on the case.

“It sets a really dangerous precedent for how we regulate speech online,” Wang said.

Who supports and opposes the ban?

Dozens of high-profile amicus briefs from organizations, members of Congress and President-elect Donald Trump were filed supporting both the government and ByteDance.

The government, led by Attorney General Merrick Garland, alleges that until ByteDance divests TikTok, the app remains a “powerful tool for espionage” and a “potent weapon for covert influence operations.”

Trump’s brief did not voice support for either side, but it did ask the court to oppose banning the platform and allow him to find a political resolution that allows the service to continue while addressing national security concerns.

The short-form video app played a notable role in both Trump and Democratic nominee Kamala Harris’ presidential campaigns in 2024, and it’s one of the most common news sources for younger voters.

In a September Truth Social post, Trump wrote in all caps Americans who want to save TikTok should vote for him. The post was quoted in his amicus brief.

What comes next?

It’s unclear when the Supreme Court will issue its ruling, but the case’s expedited hearing has some predicting that the court could issue a quick ruling.

The case will have “enormous implications” since TikTok’s user base in the U.S. is so large, said Erwin Chemerinsky, dean of Berkeley Law.

“It’s unprecedented for the government to prohibit platforms for speech, especially one so many people use,” Chemerinsky said. “Ultimately, this is a tension between free speech issues on the one hand and claims of national security on the other.”

WATCH: It appears TikTok could really get shut down, says Jim Cramer

Technology

Nvidia’s tiny $3,000 computer steals the show at CES

Published

11 hours ago

January 9, 2025

admin

Nvidia's tiny ,000 computer steals the show at CES

Nvidia CEO Jensen Huang speaks about Project Digits personal AI supercomputer for researchers and students during a keynote address at the Consumer Electronics Show (CES) in Las Vegas, Nevada on January 6, 2025. Gadgets, robots and vehicles imbued with artificial intelligence will once again vie for attention at the Consumer Electronics Show, as vendors behind the scenes will seek ways to deal with tariffs threatened by US President-elect Donald Trump. The annual Consumer Electronics Show (CES) opens formally in Las Vegas on January 7, 2025, but preceding days are packed with product announcements. (Photo by Patrick T. Fallon / AFP) (Photo by PATRICK T. FALLON/AFP via Getty Images)

Patrick T. Fallon | Afp | Getty Images

Nvidia CEO Jensen Huang was greeted as a rock star this week CES in Las Vegas, following an artificial intelligence boom that’s made the chipmaker the second most-valuable company in the world.

At his nearly two-hour keynote on Monday kicking off the annual conference, Huang packed a 12,000-seat arena, drawing comparisons to the way Steve Jobs would reveal products at Apple events.

Huang concluded with an Apple-like trick: a surprise product reveal. He presented one of Nvidia’s server racks and, using some stage magic, held up a much smaller version, which looked like a tiny cube of a computer.

“This is an AI supercomputer,” Huang said, while donning an alligator skin leather jacket. “It runs the entire Nvidia AI stack. All of Nvidia’s software runs on this.”

Huang said the computer is called Project Digits and runs off a relative of the Grace Blackwell graphics processing units (GPUs) that are currently powering the most advanced AI server clusters. The GPU is paired with an ARM-based Grace central processing unit (CPU). Nvidia worked with Chinese semiconductor company MediaTek to create the system-on-a chip called GB10.

Formerly known as the Consumer Electronics Show, CES is typically the spot to launch flashy and futuristic consumer gadgets. At this year’s show, which started on Tuesday and wraps up on Friday, several companies announced AI integrations with appliances, laptops and even grills. Other major announcements included a laptop from Lenovo which has a rollable screen that can expand vertically. There were also new robots, including a Roomba competitor with a robotic arm.

Unlike Nvidia’s traditional GPUs for gaming, Project Digits isn’t targeting consumers. instead, it’s aimed at machine learning researchers, smaller companies, and universities that want to developed advanced AI but don’t have the billions of dollars to build massive data centers or buy enough cloud credits.

“There’s a gaping hole for data scientists and ML researchers and who are actively working, who are actively building something,” Huang said. “Maybe you don’t need a giant cluster. You’re just developing the early versions of the model, and you’re iterating constantly. You could do it in the cloud, but it just costs a lot more money.”

The supercomputer will cost about $3,000 when it becomes available in May, Nvidia said, and will be available from the company itself as well as some of its manufacturing partners. Huang said Project Digits is a placeholder name, indicating it may change by the time the computer goes on sale.

“If you have a good name for it, reach out to us,” Huang said.

Diversifying its business

It’s a dramatically different kind of product from the GPUs that have driven Nvidia’s historic boom in the past two years. OpenAI, which launched ChatGPT in late 2022, and other AI model creators like Anthropic have joined with large cloud providers in snapping up Nvidia’s data center GPUs because of their ability to power the most intensive models and computing workloads.

Data center sales accounted for 88% of Nvidia’s $35 billion in revenue in the most recent quarter.

Wall Street is focused on Nvidia’s ability to diversify its business so that it’s less reliant on a handful of customers buying massive AI systems.

The Nvidia Project Digits supercomputer during the 2025 CES event in Las Vegas, Nevada, US, on Wednesday, Jan. 8, 2025.

Bridget Bennett | Bloomberg | Getty Images

“It was a little scary to see Nvidia come out with something so good for so little in price,” Melius Research analyst Ben Reitzes wrote in a note this week. He said Nvidia may have “stolen the show,” due to Project Digits as well other announcements including graphics cards for gaming, new robot chips and a deal with Toyota.

Project Digits, which runs Linux and the same Nvidia software used on the company’s GPU server clusters, represents a huge increase in capabilities for researchers and universities, said David Bader, director of the Institute for Data Science at New Jersey Institute of Technology.

Bader, who has worked on research projects with Nvidia in the past, said the computer appears to be able to handle enough data and information to train the biggest and most cutting-edge models. He told CNBC Anthropic, Google, Amazon and others “would pay $100 million to build a super computer for training” to get a system with these sorts of capabilities.

For $3,000, users can soon get a product they can plug into a standard electrical outlet in their home or office, Bader said. It’s particularly exciting for academics, who have often left for private industry in order to access bigger and more powerful computers, he said.

“Any student who is able to have one of these systems that cost roughly the same as a high-end laptop or gaming laptop, they’ll be able to do the same research and build the same models,” Bader said.

Reitzes said the computer may be Nvidia’s first move into the $50 billion market for PC and laptop chips.

“It’s not too hard to imagine it would be easy to just do it all themselves and allow the system to run Windows someday,” Reitzes wrote. “But I guess they don’t want to step on too many toes.”

Huang didn’t rule out that possibility when asked about it by Wall Street analysts on Tuesday.

He said that MediaTek may be able to sell the GB10 chip to other computer makers in the market. He made sure to leave some mystery in the air.

“Obviously, we have plans,” Huang said.

WATCH: Nvidia pullback due to CES expectations