Blog

No items found.

Securing the cities of tomorrow: Three takeaways from Black Hat 2019

Securing the cities of tomorrow: Three takeaways from Black Hat 2019Default blog imageDefault blog image
13
Aug 2019
13
Aug 2019

As thousands of hackers descended upon the desert for Las Vegas’ annual Black Hat conference, it quickly became clear that nothing was immune to cyber-attack. From hotel smart locks to ATM machines to emergency call centers, hackers and security experts alike showed how cyber-criminals can infiltrate a plethora of supposedly airtight systems. And when it comes to the latest exploit, what happens in Vegas won’t stay there for long.

Yet this state of perpetual vulnerability is, of course, unacceptable for online defenders — particularly for cities whose primary responsibility is the safety of their citizens. Whereas smart city technology like IoT traffic sensors, driverless vehicles, and connected energy grids promise to unlock new heights of efficiency, such innovations are replete with uncharted security flaws that put the world’s most critical infrastructure at risk. Ultimately, Black Hat demonstrated why, to safeguard the cities of tomorrow, we must go beyond looking for yesterday’s threats.

If it’s smart, it’s vulnerable

This phrase was a consistent theme for the researchers who discussed threats facing the Internet of Things — perhaps the defining feature of smart cities around the globe. Coinciding with an explosion in the number of connected devices, 2018 witnessed a 100% year-over-year increase in IoT attacks, and it seems criminals have been ramping up their efforts in 2019. Meanwhile, conventional cyber defenses, designed to protect standard IT from known threats, are often incompatible with these nontraditional machines.

More fundamentally, the race to produce even more IoT devices prevents experts from anticipating their weaknesses. Such was the case when two German hackers compromised high-end smart locks at a European hotel — whose name was not disclosed because the locks were still in use. Known as “mobile keys” due to their reliance on mobile phones rather than on access cards, the locks leveraged Bluetooth low energy (BLE), a technology that many IoT devices employ. The researchers explained how they easily intercepted the BLE traffic in order to develop their exploit, which could have been used for malicious ends to break into private rooms or even to shut down the hotel elevator.

A cautious host

Hosting a conference for hackers can be a nail-biting experience to say the least — one only exacerbated for local governments with highly bespoke smart infrastructure. Thus, among the entities that garnered the most attention at Black Hat was none other than the City of Las Vegas itself.

A town made famous by bold wagers and grand ambitions, Las Vegas is betting big that it knows what the city of tomorrow looks like. As riders glide down the Strip aboard the first completely autonomous shuttle ever deployed on a public roadway, they can rest assured that a network of IoT sensors are helping officials anticipate gridlock at busy intersections, while AI-powered surveillance cameras monitor for litter on the sidewalks around them. In the near future, everything from The Venetian to Mandalay Bay may well be integrated into a single vast, municipal network — a digital labyrinth far too complex for traditional security tools to make sense of, much less defend.

“For all the benefit the IoT brings, it also brings with it that side of security,” Michael Sherwood, Las Vegas’ Director of IT and Innovation and a Darktrace customer, told Reuters. “These things are carrying people across the street, they’re controlling our traffic signals, [so] a lot could go wrong if someone could get into that system.”

Breaching the ballot

In addition to threats imperiling physical infrastructure, the cities of tomorrow cannot disregard trust-eroding attacks against a more abstract target: the democratic process. The subject of election hacking in particular received top billing at the conference, in light of the blind spots posed by not only voting machines themselves, but also voter registration databases and the distribution process. Many experts feared that all three areas remained susceptible to compromise ahead of the 2020 US elections.

These revelations are not without precedent. Until 2015, Virginia used the infamous WINVote machine, which lacked any security controls whatsoever. And although future digital voting technologies may have better safeguards, cyber-criminals have proven undeterred by even the most impressive perimeter defenses. With the conflict surrounding Russian interference in the last national election and worries that similar attacks on the American election systems will happen again, researchers emphasized the need to rethink our approach to election security altogether.

The takeaways from Black Hat all share a common theme: the legacy approach to cyber security is no longer keeping pace with an ever-evolving threat landscape. As a result, for smart cities like Las Vegas, the path forward looks little like the road already traveled. Innovative, AI-powered security platforms have become an imperative to catch novel threats against novel devices — before the black hats’ work is done.

Like this and want more?

Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Max Heinemeyer
Chief Product Officer

Max is a cyber security expert with over a decade of experience in the field, specializing in a wide range of areas such as Penetration Testing, Red-Teaming, SIEM and SOC consulting and hunting Advanced Persistent Threat (APT) groups. At Darktrace, Max oversees global threat hunting efforts, working with strategic customers to investigate and respond to cyber-threats. He works closely with the R&D team at Darktrace’s Cambridge UK headquarters, leading research into new AI innovations and their various defensive and offensive applications. Max’s insights are regularly featured in international media outlets such as the BBC, Forbes and WIRED. When living in Germany, he was an active member of the Chaos Computer Club. Max holds an MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.

USE CASES
No items found.
PRODUCT SPOTLIGHT
No items found.
COre coverage
No items found.
This Article
Securing the cities of tomorrow: Three takeaways from Black Hat 2019
Share
Twitter logoLinkedIn logo

Related Articles

No items found.

Good news for your business.
Bad news for the bad guys.

Start your free trial

Start your free trial

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get a demo

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.