AI-Powered Hackers vs. You
Hackers and AI are the worst combination since hemorrhoids and blood thinners. Add in the class action lawsuits that often follow, and it’s a true bloodbath. Documentation of compliance is your only relieving balm.
Think you’re not a target? Have you ever received a phishing email? That means you’re in their database. How about a scary sounding, phishy text message? Yep, they know your cell number, too. If you have a website or an email domain (the part of your email after the @), you are a known entity. Your email and website are public information, and your cell phone has been out in the wild since you shared it with a shopping site that sold its customer database. Those lists are available, which is why you get so many spam calls.
The point is, you’re outclassed. The bad guys are national services in Russia, China, North Korea, and Iran, to name a few with beef against US targets. They are also professional hacker enterprises, running in places beyond extradition, and greedy individuals that subscribe to Ransomware as a Service (RaaS). The only barrier to entry into the hacker economy is ethics, and ethics are in short supply throughout much of the world.
All that was true before the AI revolution. Now, the internet is a literal battlefield, with armies of hackers who have automated all their workflows. And the lawyers are poised to run in and bayonet the wounded after the hackers get their piece.
Here are some of the ways the bad guys are using AI to stick it to us hard-working business owners:
AI-Enhanced Phishing Attacks: 91% of cyberattacks today start with a phishing link. Imagine you’re going to a football game this weekend. You get an email from a buddy who’s also a fan of your team. He’s going to the game, too, and has access to an elevated fan experience with free beer! You just have to register at the link he supplied.
What you don’t know is that it’s all fake. The hackers’ AI scraped your social profiles and those of your friends and connections. They saw your post about the game and your buddy’s post about being their biggest fan. Then they used this intel to craft the most compelling phishing email possible – all with zero human effort.
What can you do about it? Train yourself and your staff. All compliance frameworks like HIPAA, CMMC, and the FTC Safeguards Rule require routine security training. And a modern cybersecurity “stack” includes enhanced anti-phishing measures to prevent this message from even reaching your Inbox.
Deepfake Impersonation: In 2024 a finance worker at a large company was tricked into transferring $25 Million. How? He was on a video call with people he thought were colleagues, including the CFO! But every person on the call besides him was an AI generated deepfake. So, he did not think twice about following his boss’s orders, and the hackers got a $25 Million payday.
It’s not just mega corporations that are targeted for this sort of thing. My friend’s mother got a call from her “daughter,” who sounded distraught as she related that she’d caused a car wreck, and the pregnant lady in the other car had lost the baby. She had found a lawyer to take her case right away but needed several thousand dollars to pay his retainer before she ended up in jail. Similarly, it was an AI deepfake. The AI had copied her voice so well that even her own mother couldn’t tell.
Thankfully, a different daughter happened to call just as mom was headed to the bank to wire the money. Moments earlier, she had spoken with her sister, who had been working at home all morning. That luckily timed phone call saved mom thousands.
How do you prevent this one? Talk with your loved ones and/or coworkers, ideally in person, and establish a code word or phrase that can prove a caller’s authenticity. Don’t work it out by email, though, because if their email account gets compromised, the criminals will have the code word. Then, if you get a panicked call asking for money, hang up and call them back on their known phone number, or ask them for the code word.
AI-Accelerated Password Cracking: “Brute force” attacks are where hackers just try millions of password combinations until they get in. This is why your password should be long and complex. If it’s a dictionary word, it can be guessed easily with enough time. It used to take a lot of effort, so these attacks were more reserved for higher-value targets. AI has changed all that. Now it takes zero human effort to guess passwords, which allows them to operate at tremendous scale. And they are. 51% of passwords can be cracked in under a minute, 65% within an hour, and 71% within a day. That’s an easy lift for AI.
Your defense against this one is the same that it’s always been, only it’s even more vital now: only use long complex passwords or passphrases. Length is more important than complexity, but why not both? A password manager like Dashlane or Keeper will generate it for you, store it securely, and even let you share it safely with someone else. A 16+ character password is virtually uncrackable… today. Your compliance should have a minimum password requirement policy as a foundational item, and this is exactly why multi-factor authentication (MFA) exists.
Similarly, do not store your credentials in a web browser. Browsers are more interested in being convenient than in being secure. We run friendly hacks on our clients to find holes before the bad guys do, using similar tools and techniques, and we can decrypt passwords out of web browsers in a snap. Easy peasy.
AI Credential Stuffing: Here’s another one Hacker AI has revolutionized. They get a username / password combination from somewhere, usually the dark web, where they’re published or sold after a site breach such as LinkedIn or AT&T. Armed with legitimate credentials, and knowing that most people will reuse a password, they just need to figure out where the accounts are. Microsoft, Gmail, and 4,400 US banks are easy guesses. And now their “guesses” are automated and human free.
One Friday in March, two retirement systems noticed that their login attempts rose from 500 per day to over 300,000. Hackers were trying to log into real accounts through the front door by using credentials harvested from previous breaches. The good news: no accounts were compromised, because the companies had MFA integrated into the authentication process. So, even with correct passwords, the bad guys couldn’t get in — not into systems, not into user accounts.
Your defense here is the same as against password cracking. First, have a compliance policy forbidding credential reuse on multiple accounts, and train your staff. Next, deploy a password manager to make it simple and easy for them to generate and store unique passwords for every account. Lastly, enforce MFA on every account you can yourself, and encourage everyone to enable MFA on everything.
Compliance is still your best defense against all this AI evil — compliance to a regulatory framework that applies to you, or compliance to your cyber insurance policy. HIPAA, FTC Safeguards, CMMC, and insurance all require the same things, more or less:
1) A cybersecurity plan with routine assessments to compare the hypothetical to the real IT environment
2) Written policies that address requirements for passwords, cell phone access, working from home, and data protection standards
3) Technical controls that enforce the policies
4) Regular cybersecurity training for all users
If you follow the standards of your compliance framework, it accomplishes three very important things.
First, you’re less likely to get hacked in the first place. The requirements exist for a reason — they close the common gaps that the hackers use to get in. And they give you direction on how to go accomplish it.
Second, compliance makes it much more likely your insurance claim will be paid. The questions insurance companies ask on the cyber insurance applications mirror compliance requirements and for the same reasons. They don’t want risky policyholders.
Lastly, your compliance generates documentation that can defend you from negligence suits in court. If you get hacked, you’ll need all the evidence you can muster to prove you took the appropriate safeguards, because the lawyers will present the breach itself as proof of negligence. Courts run on evidence. Evidence means documents, and evidence lives in the past. Nobody is going to show up in your office today to see if you get an MFA push when you log in. You’ll have to produce documents to prove that it was enabled at the time of the breach. Compliance demands retention of these very documents. Unfortunately, the AI onslaught is here to stay, so you’d better be prepared. Compliance is your path. Compliance = cyber defense. Compliance = legal defense. Compliance = claim paid. Don’t fight it.
Ron Shoe
Ron Shoe is a CybertechnoLOLogist, putting the LOL in cybertechnology, because to laugh is to learn. He owns SIP Oasis, an IT & cybersecurity company located in Alabama. Learn more at www.sipoasis.com and www.youtube.com/@sipoasis. Make Every Day Safer From Cybercrime!