AI is exposing decades of software vulnerabilities that permeate the internet
On Oct. 29, hackers that FBI analysts link to North Korea stole nearly $6.4 billion from Binance, the world’s largest cryptocurrency exchange — roughly four times the previous record for a crypto theft.
About a week earlier, the National Security Agency told anyone running a website on PHP, the programming language behind roughly 7 in 10 websites, to install an emergency fix or take the site offline after vulnerabilities were discovered. In Japan, more than 20 major companies recently suffered cyberattacks, and a ruling-party official called it “a state of emergency in cyberspace.” My friends who run banks and keep the lights on in critical infrastructure are using the word “panic.” My friends at the artificial intelligence frontier labs are more blunt: The next couple of years are going to be brutal.
The rumblings shaking the internet are only the beginning. The systems we run our daily lives on are far more fragile than people realize, and the sins of our cyber past are coming due.
It’s uncertain whether AI was used in these attacks, but cyberattacks have multiplied and gotten better. Finding a serious software flaw used to be a needle-in-a-haystack hunt for a skilled hacker. Modern AI hands the haystack to a fast, easy-to-use machine and then hands the machine to both elite and amateur hackers.
Unfortunately, the haystack is enormous, because engineers and system architects constructed it that way. For decades, developers built software quickly and badly because the cost of getting it wrong was never high. I know; I was part of it. I was an early employee at OpenTable, a digital restaurant reservation system, and we asked whether our code worked, not whether it was safe. Speed was our sin. Later, as chief information officer for the city of Chicago, I saw a different sin: scarcity. With the budget stretched to breaking, an old system that still worked stayed up because we didn’t have the money to replace it.
For most of those years, few understood cybersecurity well enough to know what we were skipping. Those sins — speed, scarcity and ignorance — created a thousand shortcuts in a million systems. Every one of them is still out there, waiting to be found. [Continue reading…]