Are You the Target of Sophisticated, State-Sponsored Hackers? Follow DARPA’s Lead.
CISOs don’t usually need or want to be on the cutting edge of cyber capabilities. The attackers that target them are making purely economic calculations - what is the least amount of effort, time, and compute required for the highest payoff?
Cybersecurity is a cost center; CISOs just need to be in the middle of the pack in order for insurance to cover any major breaches.
But there is a subset of companies in high tech, telecommunications, critical infrastructure, finance, and healthcare that are targeted by sophisticated state-sponsored actors making strategic rather than economic calculations. Instead of looking at the direct value of the funds they can steal or ransomware from victims, these attackers have larger goals like:
Listening in to leadership communications
Stealing cutting edge research in key industries
Causing social breakdown through service disruptions of utilities and communications
The DARPA template
We just announced our new contract with the US Government’s Defense Advanced Research Projects Agency (DARPA) to research the use of autonomous AI for application security. DARPA will use Xint to find critical flaws in source code, runtime, and binaries across inhouse, open-source, and proprietary messaging applications used in military communications.
Military communications are a primary target for adversarial nation states. This is where the program managers aren’t looking to just check a box - they’re looking to find the reachable vulnerabilities with high impact so they can remediate them before attackers find them.
As a result, targeted organizations have high functional requirements, like:
Requirements for Organizations Targeted by State-Sponsored Attackers | ||
|---|---|---|
Depth and Breadth | Logic | Operability |
AI-enabled attackers can now probe every dark corner of an app using thousands of parallel agents. As a result, companies under attack need to be just as thorough in reviewing their own apps. They need the coverage of SAST/DAST (all lines of code and more scenarios tested) but with the depth of a human pentest going beyond insecure code patterns. | Traditional SAST and DAST have rigid, rules-based engines that are looking for well-documented insecure code patterns and CVEs. But logic bugs are different because they depend so much on unique context. Now both attackers and defenders can use AI to test for logic bugs dependent at machine scale, across thousands of agents. | The point of these scans isn’t to generate a report, but to generate actionable output for security engineers to address. Traditional tools generated so much noise as to be practically useless. Product security needs structured output, clear trigger conditions, understanding the impact, and suggested remediations to know what needs to be fixed and how to fix it. |
Let’s be clear: attackers are the one setting the pace.
Most companies in many ways can get away with waiting because the attackers they face are opportunistic and driven by looking for the easy way in.
But for companies at the frontier, reactionary security is an existential risk. They change how they approach application security from the ground up because AI has wrecked basic assumptions, like “even hackers need to eat and sleep.”
With messaging apps the basic security review revolved around encryption and authentication. But since these apps could potentially transmit the most sensitive military communications, DARPA needed to ensure total security. The code around these apps, everything touching the network and the operating system, rarely gets the same scrutiny, and that's where an attacker goes.
With AI and proper harnessing, we can now check that code cheaply and quickly enough to do it routinely, with source or with only a binary.
Despite being targeted, Woori avoided the most widespread attack on Korean financial services because it had already hacked (and hardened) its systems with Xint
Starting in late September, China-based, AI-enabled attackers were able to compromise the systems of several Korean banks. In the aftermath, Woori Financial Group was revealed as one of the banks targeted that had successfully avoided being breached in this attack, in part because of its use of Xint:
"Woori Financial Group, the parent company of Woori Bank, introduced Xint...to conduct 24-hour simulated hacking, discover vulnerabilities, and proactively remediate them. It is reported that the number of security vulnerabilities Xint discovers in one month is comparable to the amount found by human white-hat hackers in six months. Moving forward, it appears that defense strategies utilizing AI to detect vulnerabilities first in order to counter AI will rapidly spread within the financial sector."
In the wake of this incident, the Korean government and leadership of sensitive industries have taken a clear lesson: AI is a force multiplier for attackers and defenders. This incident has become a catalyst to embrace the use of quality AI platforms like Xint that don’t just find vulnerabilities, but accelerate the entire triage chain.