We\u2019re in the middle of World War 01110111 01100101 01100010<\/p>\n
Most of us don\u2019t know it.<\/p>\n
Which is a problem, as we are expected to already be fighting on the front line.<\/p>\n
The Australian Signals Directorate (ASD) has warned that Russian hackers are actively targeting critical industries and infrastructure. This includes communications networks, energy suppliers, financial services and the defence industry. But especially local councils and hospitals.<\/p>\n
Think it\u2019s just fearmongering?<\/p>\n
Think again.<\/p>\n
In 2021, hackers apparently broke into the water treatment facility of Florida\u2019s Oldsmar district council via remote-access software. An employee said he saw his mouse suddenly start to move, open control panels and change settings.<\/p>\n
Before his eyes, the amount of sodium hydroxide being pumped into drinking water was increased to toxic levels.<\/p>\n
\u201cIt\u2019s not about fearmongering. It\u2019s about readiness,\u201d says Lincoln Goldsmith, the director of digital security firm Semperis<\/a>. <\/p>\n \u201cIt\u2019s not a case of if. It\u2019s a case of when. You almost have to assume your security has already been breached.\u201d<\/p>\n Royal Australian Navy sailors plough the seas in warships to protect our fuel and fertiliser imports.<\/p>\n Royal Australian Air Force pilots scour the skies for spies and intruders.<\/p>\n Australian Army soldiers practice fighting to defend the homes of our families and friends.<\/p>\n Customs watches our ports and airfields for unwanted intrusions.<\/p>\n But the World Wide Web (www) and Internet of Things (IoT) have no borders. Only doors.<\/p>\n That makes you and me Australia\u2019s new Home Guard.<\/p>\n It\u2019s up to us to defend our cyber sovereignty. <\/p>\n And therefore ourselves.<\/p>\n Unseen enemies<\/p>\n Car manufacturer Jaguar Land Rover was attacked by Russian hackers last year.<\/p>\n The complex attack<\/a> began through an employee\u2019s insecure personal device. <\/p>\n It contained a method for remotely accessing the company\u2019s secure servers.<\/p>\n Soon, they had the keys to all the car manufacturer\u2019s secrets and advanced systems.<\/p>\n \u201cThey had their smart factories taken offline for a significant amount of time,\u201d Mr Goldsmith says.<\/p>\n And the damage spread quickly.<\/p>\n \u201cIt\u2019s often not just the victim themselves that gets impacted. It\u2019s the entire supply chain,\u201d he adds.<\/p>\n Russia is deliberately targeting nations that support Ukraine\u2019s efforts to resist its invasion.<\/p>\n That includes Australia.<\/p>\n \u201cThey are so sophisticated. They are so crafty,\u201d Mr Goldsmith explains. <\/p>\n \u201cThese state-funded organisations now have huge amounts of resources and computing power at their disposal.\u201d<\/p>\n They\u2019re targeting civilians.<\/p>\n \u201cOne of the main industries being targeted is healthcare,\u201d Mr Goldsmith warns. <\/p>\n \u201cIf a healthcare organisation \u2013 a hospital, a clinic, a specialist \u2013 gets breached, you have human lives at risk \u2026\u201d<\/p>\n Such untrained civilian practitioners can panic.<\/p>\n \u201cThey think, \u2018We have to act, and we have to act now. Let\u2019s pay the ransom. Let\u2019s get our decryption keys, and hopefully we\u2019re good\u2019. They\u2019re not. They\u2019re making things worse.\u201d<\/p>\n The goal is to cause chaos, confusion and damage. The hope is this will prompt public pressure for governments to back down.\u201d<\/p>\n Australia has no protective digital wall.<\/p>\n Just millions of gates. <\/p>\n Most are in civilian hands. That means home users, academia, businesses, services and government agencies.<\/p>\n Each is individually responsible for defending them.<\/p>\n \u201cWhen we set something digital up, we\u2019ve built a castle. We\u2019ve built the stone walls, and we\u2019re good for now,\u201d Mr Goldsmith explains.<\/p>\n \u201cBut the threat actors are marauders, crusaders, pirates \u2026 whatever their motivation may be. So, now they\u2019ve got cannons. Our walls just became weak. And they got their cannons before we could adapt. So there\u2019s going to be a period of risk there.\u201d<\/p>\n It\u2019s a digital arms race.<\/p>\n \u201cOkay, we\u2019ve upgraded the walls, but now the attackers have got bombs. And they\u2019ve got them before we could upgrade \u2026 that seems to be a bit of a pattern.\u201d<\/p>\n Trojan gadgets <\/p>\n Kenyan contractors are suing Meta for being ordered to peep through their latest consumer gadget \u2013 online smart glasses.<\/p>\n They were supposed to be training AI. But in April, they blew the whistle that this involved watching Meta customers having sex, getting in and out of the shower, and in a multitude of other compromising situations.<\/p>\n So Meta fired them<\/a>. <\/p>\n But what if one of those 1108 contractors had an out-of-date router? An old operating system?<\/p>\n Hackers \u2013 be they hostile governments, corporate saboteurs, terrorists, or opportunists \u2013 could access the glasses through their back door.<\/p>\n \u201cWe are all heavily connected now. Everything is getting thrown onto a network,\u201d Mr Goldsmith explains. <\/p>\n \u201cAll of these things that we\u2019re buying, be it cars, be it refrigerators, be it televisions or farm machinery \u2013 we\u2019re putting it all on the network.\u201d<\/p>\n These are often connected directly to data centres in Beijing, Texas or Taiwan.<\/p>\n \u201cWith consumer products, there is no data sovereignty,\u201d Mr Goldsmith states.<\/p>\n \u201cEssentially, what we\u2019re doing is we are putting more and more and more of our daily lives outside our city walls. And that exposed attack surface has become scarily large.\u201d<\/p>\n Much of it is nice.<\/p>\n But unnecessary.<\/p>\n One of the first cyberattacks occurred during Operation Desert Storm against Iraq in 1990. French-made desktop printers destined for dictator Saddam Hussein\u2019s military were intercepted by US intelligence agents. Corrupted chips helped bring down the nation\u2019s air defence network.<\/p>\n That printer could now be your online kettle.<\/p>\n The secret agent may find a weakness in your Internet of Things to access it.<\/p>\n And it never needed to be online in the first place.<\/p>\n Gadgets, routers, laptops, phones, smart speakers, smart televisions, AI-enabled dolls and PCs are usually secure when first bought.<\/p>\n \u201cThe proliferation of security products on the market is making direct attacks much harder,\u201d Mr Goldsmith explains.<\/p>\n \u201cSo, where is the next easiest spot? Where is the next weakest link in the chain?<\/p>\n \u201cThat invariably sits with legacy technology.\u201d<\/p>\n The older a product gets, the more time hackers have to find exploits. And the less likely these are to be patched \u2013 even if the supplier still provides them. <\/p>\n Eventually, they\u2019re forgotten.<\/p>\n But they still work just fine.<\/p>\n Be alert, not alarmed <\/p>\n Famous Japanese beer brewing company Asahi fell victim to a cyberattack in September last year.<\/p>\n Hackers fed employees fake CAPTCHA (are you a human?) test pages.<\/p>\n This allowed them to cripple the company\u2019s digital stock distribution and supply infrastructure.<\/p>\n \u201cThey weren\u2019t able to ship out their beer,\u201d Mr Goldsmith explains. <\/p>\n \u201cRestaurants, convenience stores \u2026 they couldn\u2019t sell their beer to someone wanting to relax at the end of their working day. Such attacks can be far-reaching.\u201d<\/p>\n Digital vulnerability is a feature, not a bug.<\/p>\n Much of the technology behind the internet is half a century old.<\/p>\n Like your router.<\/p>\n It\u2019s mostly the software layer on top of the device that gets updated.<\/p>\n Then there\u2019s the core code upon which the entire internet is built.<\/p>\n \u201cWe protect Active Directory, which is a 25-year-old product, and yet 90 per cent of customers globally are still using it,\u201d says Mr Goldsmith.<\/p>\n Active Directory assigns internet users and devices their identities.<\/p>\n It serves as an invitation list. And guard at the door.<\/p>\n \u201cEssentially, it is the keys to the kingdom,\u201d he adds.<\/p>\n It works.<\/p>\n Users rarely see the difference between one update and the next.<\/p>\n \u201cWe see a shortage of legacy knowledge in organisations. That person who came in, implemented it, and set it up has moved on. The next person that comes in doesn\u2019t know it as well, so \u2026 \u2018Hey, if it ain\u2019t broke, why fix it?\u2019<\/p>\n \u201cIf something goes wrong, it can bring a whole company down. Going back to Active Directory, if that goes down \u2013 you won\u2019t even be able to enter the building because your security pass is linked to your Active Directory ID.\u201d<\/p>\n Now homes, businesses and essential services alike are inviting a new stranger into their homes.<\/p>\n Artificial intelligence assistants.<\/p>\n \u201cIt\u2019s super efficient. It\u2019s great. It can help me. I can put in a command, and it\u2019ll give me all the information I need because it\u2019s connected to all of this metadata and data warehousing,\u201d Mr Goldsmith says.<\/p>\n But how do you monitor a synthetic human?<\/p>\n All its electric \u201cthoughts\u201d come from proprietary digital \u201cbrains\u201d based overseas. Even if relayed through power-hungry local data centres.<\/p>\n Semperis research found 74 per cent of organisations believe AI will increase attacks on their identity infrastructure. Especially upon critical identity credentials. Only 32 per cent are very confident they could regain control if AI exposed administrator-level credentials.<\/p>\n \u201cBut they\u2019re still bringing AI in,\u201d he adds.<\/p>\n Making matters worse, only 65 per cent fully register, authenticate and authorise imported AI identities. The remaining 35 per cent install them out of the box.<\/p>\n \u201cAsk yourself: Is that convenience and efficiency worth the risk?\u201d Mr Goldsmith concludes.<\/p>\n Home guard <\/p>\n Russian intelligence service hackers launched a co-ordinated assault on the Polish electricity grid last year. <\/p>\n It wasn\u2019t hard.<\/p>\n They shook digital doorknobs. Poked at digital hinges. They eventually found online systems allowing remote control of more than 30 solar and wind farms that still had factory-setting usernames and passwords installed.<\/p>\n \u201cWhat that did was basically cut the power to around half a million customers during the peak of Poland\u2019s winter,\u201d Mr Goldsmith explains. <\/p>\n \u201cThey weren\u2019t able to heat their houses.\u201d<\/p>\n In this instance, it was the IT team employed by individual companies that was the first line of defence.<\/p>\n In Jaguar Land Rover\u2019s case, an individual employee was part of the breach.<\/p>\n Everyone has been conscripted to the defence of Australian infrastructure, data and lives.<\/p>\n Even if you don\u2019t know it.<\/p>\n \u201cYou may be a mechanic who is sitting in a noisy workshop running Windows 10 that\u2019s still connected to the network,\u201d Mr Goldsmith explains. <\/p>\n Microsoft no longer supports Windows 10. So every new exploit a hacker finds will go unpatched.<\/p>\n \u201cChances are you can access car manufacturer and supplier systems,\u201d Mr Goldsmith adds. <\/p>\n \u201cSo you can become the point through which hackers can reach these other companies.\u201d<\/p>\n Government has been pushing universities and defence-related businesses to tighten security for more than a decade. Banks have been burnt. Insurance, health and telecommunications providers breached. They\u2019ve belatedly upped their game. For now.<\/p>\n So attackers are looking for side entrances.<\/p>\n Such is the risk that the Five Eyes intelligence alliance (Australia, the United Kingdom, the United States, New Zealand and Canada) recently warned businesses, services and government agencies to audit everything<\/a> accessing their computer networks. <\/p>\n Is it up to date? Is it secure?<\/p>\n Does it all really need to be accessible online anyway?<\/p>\n Security checks don\u2019t need to be expensive. <\/p>\n Mr Goldsmith says Semperis offers its Forest Druid<\/a> (attack path analysis) and Purple Knight<\/a> (Active Directory security snapshot) tools for free.<\/p>\n But can Canberra really expect a crash repairer, a corner chemist or an employee\u2019s child to be Australia\u2019s frontline digital combatants?<\/p>\n Australia spends roughly $182 million each day to defend its sovereign territory.<\/p>\n