With the increasing rise in cyber attacks across all industry sectors, there are rising security concerns. The time to protect critical network systems from bleeding out valuable data is at a pivotal point. Nothing calls this into light more than the bold and egregious movement of China’s surveillance balloons traversing sovereign US airspace earlier this year. Nation states that are flexing their military and technological muscles are the same ones producing a plethora of organized cyber attacks across the globe. These calculated events are aimed at gathering information for the purposes of extortion, espionage, and creating system disruption.
The advanced and evolving sophistication of attack methods and techniques underscore a clear and present danger to critical infrastructures, public safety, local governments, higher education, research institutions and healthcare sectors. Cybercriminals are evolving their methodologies and becoming more sophisticated in their TTPs and code structure. It’s getting harder to detect an advanced persistent threat (APT) hiding in your network gathering intelligence. It’s reconnaissance at its finest because it could take months even years to detect their presence. Jen Easterly, CISA Director said, “For years, China has conducted aggressive cyber operations to steal intellectual property and sensitive data from organizations around the globe.”
How AI Facilitates Collection of Personal and Classified Data
Throwing AI into the mix complicates the cyber threat landscape even further. As fast as companies are trying to harness AI as a cybersecurity counter measure, cybercriminals are using it to create convincing phishing emails, steal personal information and writing malware code that avoids detection, skirts around security guardrails and aids in the exfiltration of sensitive and valuable data from mission critical network systems.
Concerns about data privacy are growing as tech giants develop their own AI chatbots. Experts are raising red flags about sharing personal data with these LLM (large language model) entities. Google has been collecting vast amounts of data on users for years. Google’s AI chatbot, Bard, has been collecting IP information and requesting exact geo-location information. In the wrong hands this information could have far-reaching public safety implications.
Because of little to no regulation surrounding artificial intelligence, companies are either limiting or banning the use of AI within their organization’s walls. The growing list of notables includes Apple, Amazon, JP Morgan Chase, Bank of America, Citigroup, Wells Fargo, Goldman Sachs, Samsung, Verizon, and Accenture. Just because a company limits the use of AI doesn’t mean they are cyber protected. Cybersecurity threat detection measures are still required in order to keep cybercriminals from infiltrating network systems.
Concerns Over TikTok and Other Chinese-Owned Apps
The FBI has raised privacy concerns about foreign owned apps with TikTok squarely at the center of attention. The focal point of the concern is that TikTok’s parent company is Beijing based ByteDance, controlled by the Chinese government, and TikTok gathers an incredible amount of personal data on its users including location data. What makes this an issue is that “Chinese law requires Chinese companies and citizens to assist with Chinese intelligence work.” In November 2022 at a House Homeland Security Committee Hearing, FBI Director Christopher Wray said, “China’s vast hacking program is the world’s largest, and they have stolen more Americans’ personal and business data than every other nation combined.”
At present it is estimated that more than 100 million Americans have downloaded
the TikTok app on their mobile devices.
A New York Times article published May 23, 2023, revealed that India had banned TikTok and 59 other Chinese-owned apps back in 2020 claiming that these apps were collecting data and sending it to servers outside of India. Taiwan, Pakistan and Afghanistan have all issued a country wide ban. Great Britain, Australia, France, New Zealand, and Canada have banned TikTok from government devices. Here in the US, the federal government and more than 30 states have banned the app on government devices. In addition, a few US colleges and universities have blocked the app from their campus WiFi networks.
Leveraging the Data
“Let China sleep, For When She Wakes, She will Shake the World.” - Napoleon
In addition to data breaches, individuals have unwittingly handed over billions of bits and pieces of personal information through social media apps, online surveys, and more. So, for what nefarious purposes can all this data be used?
- Combine collected data with data already available on the dark web to specifically target individuals or organizations
- Geo-target students studying abroad, companies doing business abroad
- Tracking government official and foreign national activities
- Utilizing relationship data to create highly targeted spear phishing campaigns to distribute malware and DoS events
- Aid in intellectual property or classified information theft
- Using apps to target population segments with false narratives/harmful information
- Financial market manipulation
- Using personal healthcare information to negatively impact vulnerable population segments or compromise life-saving digital devices
It’s not just about a balloon, or an app, or an AI chatbot, it’s about the unbridled data collection of personal information whether gathered illegitimately or handed over freely. The data privacy ship sails when that sensitive personal, company trade secret or classified intelligence information is posted to the dark web. Cyber attackers are all too eager to get their hands on data for purposes of extortion; it’s a big business. Cybersecurity protocols, policies, and procedures to protect public safety and critical infrastructures has never been more important or for that matter, a non-negotiable necessity.
Contact us about continuous network monitoring and threat detection to protect your critical network systems and data.
Additional Resources:
https://www.inc.com/jason-aten/the-fbi-has-a-warning-for-tiktok-users-why-it-says-you-should-be-extremely-concerned.html
https://www.nytimes.com/article/tiktok-ban.html
https://www.jdsupra.com/legalnews/growing-calls-to-ban-chinese-owned-3471833/
https://www.pbs.org/newshour/nation/why-a-ban-on-tiktok-wont-solve-all-data-privacy-concerns
https://cyberscoop.com/ai-chatbots-privacy-geolocation-data-google/
https://www.securityweek.com/cyber-insights-2023-artificial-intelligence/