The number of cyber attacks is constantly increasing, and artificial intelligence is exacerbating the problem. But many companies are still not adequately protected. That would be entirely possible.
Hackers have attacked various critical facilities around the world, including wind and solar power plants in Poland and industrial plants in the US using Siemens control devices.
A study by PwC shows that eleven percent of medium-sized companies suffered cyber attacks this year, a third of which had production or service failures.
The digital association Bitkom estimates the damage caused by cybercrime to German companies at up to 200 billion euros annually; cyber attacks can threaten the existence of companies.
Experts point out that artificial intelligence increases the speed of cyber attacks, which is why many medium-sized companies are lagging behind in terms of security and basic security measures are often missing.
Dusseldorf. Hardly any area is safe from perpetrators. Last winter, wind and solar power plants in Poland were shut down, and a thermal power plant was also attacked. A blackout was only narrowly avoided. Then attackers targeted industrial plants in the USA; a control system from Siemens was intended as a gateway. A few days ago, hackers hijacked a blood storage facility.
It's no longer just about shutting down refrigeration systems in supermarkets. Wherever systems can be controlled via the network, hackers try to gain unauthorized access. “This can be completely transferred to other industries, to the smart home, to a wide variety of devices that are networked with the Internet,” explains Marc Dönges, project manager at the transfer office for cybersecurity in medium-sized companies. Because in many cases it is made easy for the perpetrators.
The target is often small and medium-sized companies because they are particularly vulnerable. “We have been clarifying this for years, but in many cases the basic measures for cybersecurity are still not being implemented, especially in small and medium-sized companies,” says Dönges.
According to a study by management consultancy PwC, eleven percent of all medium-sized companies have already experienced a cyber attack this year. A third of them suffered production or service failures as a result. “Your own cyber defense capabilities are systematically overestimated,” says PwC IT security expert Nial Moore. In many cases, the security budgets of medium-sized companies are too low.
The effects are threatening. The digital association Bitkom estimates the damage caused by cybercrime to German companies at up to 200 billion euros per year. “A successful cyber attack can mean the economic end for companies,” warns Bitkom President Ralf Wintergerst.
The recent attacks by hackers on thousands of refrigerators in European supermarkets have shown how drastic the consequences can be. Because the attackers had raised the temperature of the devices to up to 50 degrees Celsius overnight, tons of perishable food had to be thrown away.
Individual large supermarkets in France reported damage of more than 50,000 euros. This means that the total damage to several hundred affected stores in the two waves in ten European countries is likely to be in the millions. Numerous German supermarkets were affected, including Rewe and Edeka retailers, but also so-called CAP markets, which employ people with disabilities to fill a large proportion of their positions.
France blames Iran for the October hacker attack on its cooling systems. The French cybersecurity agency ANSSI said the destructive actions could be attributed to a unit of the Iranian Revolutionary Guard. At the same time, investigators also registered attacks on Schneider Electric systems used in small hydroelectric power plants, but with moderate effects.
In the USA, the FBI has already become involved in the incidents of the past few months. After the attempted attacks on Siemens control devices at waterworks and other critical infrastructure providers, a joint communication with the national security authorities provided detailed information and the warning: “This is not a theoretical risk, this is an active threat.”
Jannik Stuckstätte also believes it is unlikely “that it was a rather inexperienced attacker”. The cybercrime expert from Stoïk says: “What is striking about the current attacks is the temporal orchestration.” Someone took the trouble to first collect these systems and then bundle them and carry out the attack across different markets at different locations at a certain point in time.
Stoïk offers insurance against cyber risks - and is experiencing a significant increase in attacks among its customers. “Events that we used to see maybe once a year now occur every month,” says Stuckstätte, who leads the team that responds to IT security incidents at Stoïk. The insurer has observed an increase in claims frequency of more than 50 percent in its portfolio over the past few months.
In principle, the dangers posed by networked devices, the so-called Internet of Things (IoT), have been known for a long time. Ahmad-Reza Sadeghi has been researching vulnerabilities for more than 20 years - including in cyber-physical systems in which software directly controls physical processes: the temperature of a freezer, the position of a turbine, the electronics of a car.
Back in 2017, Sadeghi's team at the System Security Lab at TU Darmstadt and colleagues from the USA demonstrated malware for industrial controls that manipulated the control commands in a test network and at the same time presented false measurement values to the operating personnel. In 2019, researchers found a gap in a common vacuum robot that could be used to remotely control all of the model's devices and view the floor plans of the apartments.
What is new, however, is the pace, says Sadeghi: “The dynamics have accelerated enormously, there will be more and more attacks.” The computer science professor sees the reason for this in tools with artificial intelligence (AI). They accelerated every step of hackers' work: from identifying vulnerabilities to programming the malicious code. The search for incorrectly configured devices such as refrigerators can also be automated.
Experts observe that many medium-sized companies that use networked devices cannot keep up at this pace. “We are currently connecting our world much faster than we are securing it,” says expert Dönges. He organizes cybersecurity workshops for small companies and therefore knows the problems in practice very well.
“This is a very underestimated risk and unfortunately it is one of a whole series of underestimated risks,” he says. Necessary updates are often not installed and there are no data backups or backups. Management would also not recognize their responsibility for the issue and employees would not be sensitized.
Many of the cooling devices attacked were older models for which there were no longer any software updates. “If there are no security updates for a device, then you have to sort it out,” says Dönges. “If they continue to be used, you obviously have to ensure that remote access is only possible via a VPN channel, i.e. encrypted.” If not, the door is open to attackers.
Even if remote maintenance can be very useful in many cases, this does not apply to every digital function. “Maybe sometimes the digital function that you don’t activate at all is the safest,” says Dönges. In any case, it is important that this reaches the economy and society: cyber security must be taken into account, otherwise we will not only network, but also create new areas of attack.
Researcher Sadeghi therefore also holds the manufacturers responsible. He has observed improvements for several years, especially among the large technology companies. However, there are still many unsafely designed products. A simple example is hard-coded passwords: If they are known, attackers can access all devices affected by them.
The problem is particularly pronounced in operational technology, for example in industry, known in technical jargon as operational technology. Sadeghi warns: “Many of these systems were originally designed for isolated environments and later connected to the Internet without adapting their security architecture accordingly.”
