The future after AI: are we ready for the post-AI era?

We’ve just wrapped up our 10th annual APAC Cybersecurity Weekend in Negombo, Sri Lanka, from August 4-7, 2024. The media conference addressed the pressing question: “Are we prepared for the rise of offensive AI and the future of cyberthreats?”

From generative AI tools to supply chain vulnerabilities, the event highlighted strategies that every organization must consider to stay secure in a rapidly changing digital landscape.

Kaspersky’s use of AI

Kaspersky has been leveraging AI technologies for years to protect our customers. We employ various AI models to detect threats and continuously research AI vulnerabilities to ensure our technologies remain resilient. Our ongoing studies of harmful AI techniques aim to provide reliable protection against the evolving landscape of offensive AI.

Evolving threats, evolving defences

Adrian Hia, Managing Director for APAC

Our event kicked off with a keynote from Adrian Hia, Managing Director for APAC, who highlighted the increasing challenges posed by generative AI threats. He shared insights into advanced data protection strategies and stressed the need for organisations to stay ahead of evolving data regulations across the region.

Adrian emphasised that with the widespread availability of GenAI tools, cybercriminals now have easier access to powerful resources. AI is here to stay, and businesses must carefully assess what data they allow AI to access while aligning their compliance strategies.

Igor Kuznetsov, Director of the Global Research & Analysis Team (GReAT), highlighted the increasing sophistication and scale of cyberattacks across the APAC region.

Igor Kuznetsov, Director of the Global Research & Analysis Team (GReAT),

“Governments were the most frequent target of threat actors, followed a distant second by manufacturing and financial institutions, with ransomware and cybersabotage posing the greatest cyberthreat risk,” Igor explained.

Our security solutions protected over 220,000 businesses globally, preventing 6.1 billion attacks and detecting and stopping 437 million internet-borne threats. In addition, over 325,000 users were protected from financial loss through the detection of banking Trojans.

The session also shed light on Operation Triangulation, a zero-click iMessage attack that exploited four zero-day vulnerabilities, targeting iOS versions up to 16.2. Igor emphasised that organisations need a comprehensive strategy, skilled teams, advanced technology and strong threat intelligence to build a resilient security posture against evolving threats.

Threats of offensive AI

Alexey Antonov, Lead Data Scientist

The rise of advanced AI systems in the public domain has made them widely accessible for personal and business use. While these systems excel at tasks like content generation and code creation, this accessibility has opened the door for threat actors to launch sophisticated attacks.

Alexey Antonov, our Lead Data Scientist, highlighted some alarming ways cybercriminals are exploiting AI:

• ChatGPT can be used to write malicious software and automate attacks against multiple users
• AI can analyse smartphone acceleration sensor data to capture sensitive information such as messages, passwords and bank codes
• Swarm intelligence allows autonomous botnets to communicate with one another, restoring malicious networks after damage

In a striking example, Alexey stated, “We analysed a massive data leak and found that 32% of user passwords are not strong enough and can be reverted from encrypted hash form using a simple brute-force algorithm and a modern GPU in less than 60 minutes.” He added: “We also trained a language model on the password database and tried to check passwords using the resulting AI method. We found that 78% of passwords could be cracked this way, which is about three times faster than using a brute-force algorithm. Only 7% of the passwords analysed were strong enough to withstand a long-term attack”.

Future of supply chain attacks

Vitaly Kamluk, Head of GReAT APAC

Supply chain attacks are especially appealing to threat actors because of the inherent trust in software providers. By infiltrating a manufacturer’s infrastructure, attackers can inject malware into software updates, making this one of the most dangerous attack vectors.

Vitaly Kamluk, Head of GReAT APAC, addressed the future of supply chain attacks, citing notable incidents such as the global BSOD outage that impacted roughly 8.5 million systems and the complex compromise of the Linux XZ utility. The recent CrowdStrike incident underscored the vulnerabilities within supply chains and the significant impact they can have, highlighting the critical importance of securing these systems. Earlier in 2024, the Linux XZ Utils project – a set of data compression tools –was compromised in a sophisticated supply chain attack: this backdoor was cleverly obfuscated and manipulated the logic of OpenSSH to allow unauthorised access.

Vitaly stressed the need for proactive strategies to mitigate these growing threats. “In addition to cybersecurity best practices, organisations need to implement mitigation strategies to manage or minimise the potential impact of a supply chain attack on their infrastructure,” Vitaly said. Key strategies include rigorous testing before deployments, ensuring tool integrity, strict control of manufacturing processes, version tracking, continuous monitoring for anomalies, implementing digital signatures and conducting regular security audits.

Post-AI: building a safer tomorrow

The event wrapped up with a dynamic panel discussion titled “Post AI: Building a Safer Tomorrow.” Experts, including key figures from Kaspersky and the cybersecurity industry, engaged in a thought-provoking conversation about the transformative impact of AI on cybersecurity. They explored emerging strategies that can help shape a safer digital future, providing valuable insights into the evolving landscape of cyberthreats and AI-driven defences.

Leading the charge at CSW

APAC Cybersecurity Weekend 2024 was a huge success, providing crucial insights into the evolving cybersecurity landscape, particularly with the rise of AI-driven threats. With expert perspectives on generative AI, supply chain vulnerabilities and offensive AI, the event highlighted both the challenges and solutions shaping the digital future. As organisations navigate these complexities, Kaspersky remains at the forefront, committed to strengthening cybersecurity strategies and building a safer, more resilient digital world.