Server vulnerabilities targeted at app entrances, automated with AI, fear of expanding damage - NICT analysis/unauthorized access

The threat intelligence analysis team at the National Institute of Information and Communications Technology (NICT) has discovered one of the attack methods in response to the growing problem of unauthorized access to companies. They used publicly available apps as an entry point to find vulnerabilities in servers, and varied the attack content for each server. It is believed that everything from analysis to attack is automated using artificial intelligence (AI).

We have grasped the sequence of events through our own research and analysis. The analysis team is calling for countermeasures, saying that more systems could be targeted by increasing the efficiency of vulnerability searches using AI.

According to the analysis team, the attacker first obtained the Android app, Google's basic software (OS) released in Japan, and analyzed the program. Behind the scenes of apps and websites, it collects information such as the connection destination of the "backend server" that manages login authentication and user information, and attacks targeting vulnerabilities depending on the server specifications.

The team pointed out that four main types of vulnerabilities are being exploited, such as causing backend servers to perform unintended communications or execute malicious programs. It is analyzed that similar problems may also occur with apps in Apple's iOS operating system.

As countermeasures, the government requires confirmation of suspicious access and checks for vulnerabilities, as well as temporarily restricting access from outside Japan and invalidating and reissuing authentication information.

Shingo Yasuda, head of NICT's CYNEX Research, Development and Operations Office, who leads the team, points out, ``The pattern of this attack and the way it spread suggests that automation may have been carried out using AI.''

He added, ``My concern is that AI will be able to continuously and efficiently assemble attacks tailored to individual systems.'' ``If the effort involved in analyzing apps, exploring vulnerabilities, and adjusting attack content is reduced, there is a possibility that similar attacks will spread even more,'' he warned.