As the number of online devices surges and superfast 5G connections are rolled out, record numbers of companies are offering handsome rewards to ethical hackers who successfully attack their cybersecurity systems.
The fast-expanding field of Internet-connected devices, known as the Internet of Things (IoT) and which includes smart televisions and home appliances, is set to become more widespread once 5G becomes more available — posing one of the most serious threats to digital security.
At a conference hosted by Nokia Corp last week, “friendly hacker” Keren Elazari said that co-opting hackers — many of whom are amateurs — to hunt for vulnerabilities “was looked at as a trendy Silicon Valley thing six to eight years ago.”
However, “bug bounty programs” are now offered by organizations ranging from the Pentagon and banks such as Goldman Sachs Group Inc to airlines, tech giants and thousands of smaller businesses.
The largest bug-bounty platform, HackerOne, has 800,000 hackers on its books and said that its organizations paid out a record US$44 million in cash rewards this year, up 87 percent on the previous 12 months.
“Employing just one full-time security engineer in London might cost a company ￡80,000 (US$106,287) a year, whereas we open companies up to this global community of hundreds of thousands of hackers with a huge diversity in skills,” said Prash Somaiya, security solutions architect at HackerOne.
“We’re starting to see an uptick in IoT providers taking hacking power seriously,” Somaiya said, adding that HackerOne now regularly ships Internet-connected toys, thermostats, scooters and cars out to its hackers for them to try to breach.
“We already know from what has happened in the past five years that the criminals find very clever ways to utilize digital devices,” Elazari said.
A sobering example was the 2016 “Mirai” cyberattack, during which attackers took control of 300,000 unsecured devices, including printers, Webcams and TV recorders, and directed them to flood and disable Web sites of media, companies and governments around the world.
“In the future of 5G we’re talking about every possible device having high-bandwidth connections, it’s not just your computer or your phone,” Elazari said.
In October Nokia announced that it had detected a 100 percent increase in malware infections on IoT devices in the previous year, saying in its threat report that each new application of 5G offers criminals “more opportunities for inflicting damage and extracting ransom.”
The rewards for hackers can be high: 200 of HackerOne’s bug-hunters have now claimed more than US$100,000 in prizes, while nine have breached the US$1 million earnings mark.
Apple, which advertises its own bug bounty program, increased its maximum reward to more than US$1 million at the end of last year, for a hacker able to demonstrate “zero click” weaknesses that would allow someone to access a device without any action by the user.
“A big driver is of course the financial incentive, but there’s this element of a breaker mindset, to figure out how something is built so you can break it and tear it apart,” Somaiya said. “Being one individual who’s able to hack multibillion-dollar companies is a real thrill, there’s a buzz to it.”
The rush of companies shifting to remote working during the pandemic has also led to “a surge in hacktivity,” HackerOne said, with a 59 percent increase in hackers signing up and a one-third increase in rewards paid out.
The French and UK governments are among those to have opened up COVID-19 tracing apps to friendly hackers, Somaiya said.
While 5G Internet systems would have new security features built into the network infrastructure — something absent before — the new technology is vastly more complex than its predecessors, leaving more potential for human error.
“I see a lot of risk for misconfiguration and improper access control; these glitches are one of the main risks,” said Silke Holtmanns, head of 5G security research for cybersecurity firm AdaptiveMobile Security.
Yet she said that she believes companies are being motivated to act as security moves up the agenda.
The EU, along with governments around the world, has begun tightening cybersecurity demands on organizations, and fines for data breaches have been increasing.
“Before now it’s been hard for companies to justify higher investment in security,” said Holtmanns, who sits on the European Union Agency for Cybersecurity.
However, “if they can say: ‘With that security level we can attract a higher level of customer, or lower insurance premiums,’ people start thinking in this direction, which is a good thing,” she said.
The Financial Supervisory Commission (FSC) yesterday fined Citibank Taiwan Ltd (花旗台灣) NT$10 million (US$357,194) and DBS Bank Taiwan (星展台灣) NT$6 million for breaches of the nation’s anti-money laundering (AML) regulations. The NT$10 million fine is the highest penalty that it has imposed on a domestic bank, the commission said. Citibank Taiwan failed to set up a sound mechanism for evaluating clients’ risk of money laundering and for detecting suspicious transactions, Banking Bureau Deputy Director-General Huang Kuang-hsi (黃光熙) told a news conference in New Taipei City. The bank based its AML policies on those of its US-based parent company, Citigroup Inc, but the policies
BETTING BIG: The world’s most advanced chipmaker might be eyeing an advanced 3-nanometer plant in the US after it finishes setting up its 5-nanometer fab there Taiwan Semiconductor Manufacturing Co (TSMC, 台積電) is weighing plans to pump tens of billions of dollars more into cutting-edge chip factories in Arizona than it had previously disclosed, but is cool on prospects for an advanced European plant, people familiar with the matter said. TSMC is the world’s most advanced chipmaker, and its investment plans are being closely watched amid a global chip shortage and new initiatives in the US and Europe to subsidize semiconductor production. TSMC last year announced that it would invest US$10 billion to US$12 billion to build a chip factory in Phoenix. The previously disclosed factory could be
COMPETITIVE: The chip designer is offering an annual compensation of NT$1.5 million to NT$2 million, in addition to cash and stock bonuses to attract workers MediaTek Inc (聯發科), the world’s biggest designer of 5G handset chips, is stepping up its recruitment drive this year, with plans to hire more than 2,000 engineers specializing in core technologies, including 5G, wireless communication and artificial intelligence (AI). That would be double from the more than 1,000 people it hired on average in the past few years, as the Hsinchu-based company looks to boost growth this year and beyond. It also comes as the company plans to launch a new 5G chip, Dimensity 2000 series, which supports mmWave technology and sub-6-gigahertz technology, at the end of this year. That would be
COMPONENTS ISSUE: Hon Hai’s Young Liu said that although prices for components and raw materials have increased, their influence on the company would be limited Hon Hai Precision Industry Co (鴻海精密), also known as Foxconn Technology Group (富士康科技集團), yesterday said that a global supply crunch that has hit the consumer electronics and automaking industries will worsen this quarter, after it weathered component shortages to post better-than-expected quarterly profit last quarter. The world’s largest contract electronics manufacturer and main assembler of iPhones reported net income of NT$28.2 billion (US$1 billion) in the first quarter, beating the average NT$24.4 billion of adjusted analyst estimates. Revenue in the second quarter will likely be steady from the previous quarter’s NT$1.35 trillion, as growth in its consumer electronics and components divisions is