IT security: Expert: Software vulnerabilities remain a problem for longer

Attackers can now evaluate new security gaps for attacks in minutes or hours. But AI could also help to change that in the future, believes an expert from the federal cyber agency.

Thanks to AI, attackers can now use a published vulnerability to carry out attacks in minutes or hours. An expert from the federal cyber agency believes that the development will continue for a while. (Symbolic image= photo: Jens Büttner/dpa

Halle (Saale). According to an expert from the Federal Cyber Agency, the serious security gap in the widely used PHP programming language is an example of a development that is likely to continue for a longer period of time. “We are probably already in a small valley of tears at the moment,” said Daniel Gille, head of the key technologies department, to the German Press Agency.

It is conceivable that a plateau will be reached at some point, as software cannot have an infinite number of vulnerabilities. However, attackers currently have a clear advantage: They can evaluate a published security vulnerability and develop an attack within minutes or hours. In the past, this often took weeks or months.

IT expert: Attackers currently have an advantage

Fixing such security gaps, on the other hand, is done decentrally and takes significantly longer. This is currently evident in the PHP gap. Many operators only got their websites back online hours or more than a day after installing updates. The Federal Office for Information Security classifies the risk of the gap as extremely high. So far, authorities have not reported any successful attacks on the federal administration; The Digital Ministry is checking whether data has been leaked.

An evaluation by the US IT group IBM suggests that this is not an isolated case. Its security team, X-Force, observed a dramatic increase in the number of known security vulnerabilities at numerous large software providers such as Microsoft, Oracle and the Google Chrome browser. From January to September of this year there were at least 10,124, an increase of around 578 percent compared to the same period last year. More than half of these AI-discovered vulnerabilities were rated as high or critical risk according to a scoring system used in the industry.

Research deals with AI as an operating system

Cyber agency expert Daniel Gille believes that AI will help even more in the future to write program code so that it is less vulnerable. The cyber agency is preparing a research program that will be put out to tender soon. Considerations of using artificial intelligence itself as the basis of an operating system go even further.

According to Gilles, the cyber agency is tasked with carrying out experimental research. It is therefore conceivable that such a system would have a fundamentally different architecture and no longer have one fixed code. Software vulnerabilities would then no longer affect all systems that use it. However, the idea is controversial among operating system experts. "This is actually a completely open research question. No one can probably answer that at this point in time," said Gille.