Coordinated attacks on electrical grids. Quantum computers making encryption technology useless. Deepfakes that are nearly impossible to discern from reality, or an army of AI agents hacking networks with once unthinkable-speed and efficiency. These are only a few of the threats that could be facing the United States in the very near future—if we aren’t already. Today WIRED takes a deep dive into how vulnerable our current systems and networks are to the future of cyber threats.
Category
🤖
TechTranscript
00:00Everybody knows how technology can make our lives better or a little easier, but it can
00:04go the other way too.
00:05Soon, it will actually be impossible for a human being to tell if the face that they're
00:09looking at is real.
00:10And that's a very scary new reality.
00:12Today, we're talking about future tech threats, including AI deepfakes, cyber attacks on electrical
00:17grids, quantum computers, and a lot more.
00:20This is Incognito Mode.
00:29One of the doomsday scenarios that experts have worried about for decades is a major
00:34cyber attack on the US electrical grid.
00:36Now, Andy, you've written in a literal book about cyber attacks on electrical grids and
00:41the hackers behind them.
00:42Tell us about that.
00:43As with so many of these different kind of future threats, we've already seen it play
00:46out in Ukraine, which is so often the canary in the coal mine because it is so targeted
00:51by Russian hackers.
00:52And in fact, we've seen one specific group of Russian hackers called Sandworm cause blackouts
00:56three times in Ukraine.
00:58They're the only hacker-induced blackouts in history.
01:01The first one of these was in 2015.
01:03These Russian state-sponsored hackers broke into a collection of electrical utilities in
01:06Western Ukraine and turned off the power for a quarter million Ukrainian civilians.
01:10Then they did it again the next year in the capital at this time, in Kyiv.
01:14In that case, they used this kind of automated tool known as crash override or in-destroyer.
01:19It was essentially a kind of blackout-inducing bots that could open circuit breakers with
01:24kind of automated speed.
01:25Now, in both of those first two blackouts in Ukraine, the power outage only lasted a
01:29few hours.
01:30But in the second of those two attacks, we did also see this troubling tactic, which
01:34was that the Sandworm hackers actually tried to disable a piece of safety equipment called
01:39the protective relay.
01:39They intended it that when the Ukrainian engineers tried to turn the power back on, they might
01:45have overloaded lines to cause them to burn or exploded the transformer.
01:50And that would have been a kind of physical destruction of grid equipment that could have
01:54led to outages of weeks or a month.
01:56And that only actually failed because of a tiny misconfiguration in the hackers' malware.
02:01And in the midst of Russia's full-scale invasion of Ukraine starting in 2022, they haven't
02:04stopped attacking the Ukrainian power grid, both physically and with cyber attacks.
02:08And in one case, they succeeded in causing a blackout in the midst of an airstrike, in the
02:12midst of missiles raining down on the city that was blacked out.
02:16So the U.S. grid, as I understand it, it's not just one centralized local grid.
02:20The United States is enormous.
02:21So we've got the east, we've got the west, and we've got Texas, which is its own thing
02:26for some reason.
02:27And then within those, we have all these utility companies that connect to these grids.
02:30So we're talking about a bunch of different entities.
02:33How complicated would it be to kind of target even one of these regions in the United States?
02:37Well, I think that causing like a massive blackout across the whole region in the U.S.
02:42would be quite difficult.
02:43The cyber attacks we've seen so far in Ukraine are relatively localized.
02:47You know, the idea of like this kind of nightmare scenario of blacking out the entire eastern
02:51seaboard for a month, I don't think we've ever seen a hacker group capable of doing that.
02:56Not to say that it's not technically possible somehow, but what we have seen that's very
03:01worrying is this one group of Chinese state-sponsored hackers called Volt Typhoon gaining access
03:06to electric utility networks in the U.S. across the entire country.
03:11And it seems that they're trying to pre-position to be ready for some date in the future when
03:16they might choose to pull the trigger and cause blackouts, perhaps in many simultaneous cyber
03:22attacks.
03:23And of course, the date that we have to guess that they're preparing to do that would be
03:26on the eve of the invasion of Taiwan.
03:28That Xi Jinping, the Chinese head of state, has said he wants the Chinese military to be
03:32ready for by 2027.
03:34That could be a kind of tactic in the Chinese playbook to delay an American response to
03:40that invasion, or perhaps more specifically to cut power to U.S. military bases that would
03:45hamper our military response to that actual invasion of Taiwan.
03:49I have sometimes thought like the threat of a power grid attack has become overblown because
03:54it's kind of like the quintessential cyber nightmare.
03:58So at one point I even did ask an NSA official, are you actually scared of a cyber attack on
04:02the grid?
04:03And he said that he absolutely was because of this notion that the electric grid underlies
04:06every system that we have come to rely on.
04:09GPS, internet, water, all of it depends on electricity.
04:13It is in some ways like the fundamental lowest layer of the tech stack of America.
04:19And this is one of the reasons why cyber attacks on electrical grids kind of loom large
04:23in the cybersecurity mind is that this is a hack that can potentially cause physical damage
04:29in the real world that then makes the attack much more consequential.
04:32Right.
04:33If the power turns off for a few hours, I think we have backup systems.
04:37We have natural disasters that cause that.
04:40We're ready to bounce back.
04:41If transformers are destroyed, however, these are custom pieces of equipment that are hard
04:45to replace.
04:46We may not be ready for a long timescale of outage against an actual malicious adversary
04:53that's still there in the network, still trying to cause more damage.
04:56We saw how difficult it was, for instance, for Spain and Portugal to turn the power back
05:01on across an entire country.
05:02Well, imagine if you're trying to perform that recovery while an active adversary is
05:08also trying to sabotage every step you take to recover.
05:12Terrifying.
05:13Hey, it's me.
05:17Don't recognize me?
05:18How about now?
05:19AI-generated deepfakes are everywhere on the internet.
05:22You've probably laughed at ones of politicians or celebrities.
05:25But did you know these tools can be used for nefarious purposes against you?
05:29What in your reporting have you seen deepfakes being used for?
05:31We've already seen deepfakes being used for two of the most lucrative form of cybercrime
05:37that we know about.
05:38One is what people call business email compromise, where hackers kind of impersonate someone inside
05:42a company and trick the executives into sending money where they shouldn't.
05:46We've seen one company tricked into sending $25 million to a hacker who impersonated an employee.
05:52The other is romance scams or other kinds of what people call pig butchering, where a victim
05:56is tricked into sending sometimes millions of dollars to a fake crypto investment.
06:00I've seen listings on black markets where crypto scammers are selling each other deepfake tools
06:06to be able to impersonate someone's face.
06:07And both of these are already making tens of billions of dollars in revenue a year.
06:12Truly two of the biggest categories of cybercrime in existence and both of them are going to
06:17be absolutely supercharged by deepfakes.
06:20Most of the nefarious uses of deepfakes involve scams, people trying to steal people's money.
06:25Deepfakes used by scammers can be put together quickly and they don't have a lot of resources
06:29to put into them sometimes.
06:30But they can also be used in geopolitical settings, fake news on steroids.
06:33The producers of fake news are able to put a lot of resources into making sure something
06:44looks reliable and it makes it really hard to detect when something's actually fake.
06:47Unless you're a digital forensics expert, detecting fake news can be really difficult.
06:50The technology is just rapidly improving.
06:53It's becoming pretty commonplace to be able to get access to these tools.
06:57You don't have to be a specialized hacker or anything to get them.
06:59You can just kind of download these tools and use them for whatever means you want to.
07:04Definitely.
07:05And I think the real time deepfake video tools that I've seen are not seamless.
07:10They're quite detectable for like a not super gullible human being today.
07:15But I think what we're talking about is a very near future where these tools are only going
07:18to improve and soon it will actually be impossible for a human being to tell if the face that
07:24they're looking at is real.
07:25And that's a very scary new reality.
07:27You know, one of the ways people protect themselves from traditional scams, even before deepfakes,
07:32is you're just familiar with what a phishing email looks like and you learn to look out for
07:37it.
07:38But at some point, the fakes become so good you can't tell what's real and what's fake.
07:42I think we're used to telling people too as a safeguard, yeah, if you can't tell if this
07:46text is fraudulent, then get somebody on a call.
07:50If that doesn't work, you get somebody on a video.
07:52When none of that works, then we have to come up with new protocols like, you know, do you
07:56have some sort of secret code word?
07:58Do you check if somebody can remember your last conversation?
08:00You know, all of these things, we'll have to kind of figure them out in this new deepfake
08:04future.
08:05AI has really taken all the headlines as this big emerging technology and all the potential
08:12threats around it.
08:13Another emerging technology is quantum computing that's continuing to evolve.
08:17One of the things that security experts kind of worry about with regards to quantum computing
08:21is that it could just break all encryption.
08:24What have you seen about this?
08:25Right.
08:26Well, this is what some people call Q-Day.
08:27Like this perhaps near future doomsday scenario where quantum computing becomes powerful enough
08:32to break these crypto systems that we have built an entire society on.
08:36It turns out that there are some kind of post-quantum crypto systems that can't be broken even
08:41by quantum computers. So Google, for instance, has been very vocal about switching to post-quantum
08:46crypto. Signal, the encrypted messaging app, has also switched to post-quantum crypto.
08:51And that ought to be reassuring. But the troubling thing is just how many systems out there may
08:55not be using post-quantum crypto. And when quantum computing suddenly appears, they can just
09:02all be broken and all of our secrets will be accessible. And it'll be like that moment in sneakers,
09:06when like suddenly the entire Internet is decryptable.
09:09Anybody want to shut down the Federal Reserve?
09:11For instance, Bitcoin, we know, doesn't use post-quantum crypto. If a quantum computer
09:17arrived today, it seems like somebody would be able to steal hundreds of billions of dollars.
09:21Bitcoin would probably go to zero immediately. And that's only going to be fixed when the entire
09:27Bitcoin community decides to adopt new crypto technologies and implement them across the network,
09:33which is a really big undertaking and may not happen in time.
09:36The issue with quantum computers is that they're just much faster at breaking encryption
09:40than a traditional computer. While a traditional computer can take over a hundred million years
09:45to break certain types of strong encryption, a quantum computer can do it in just a few hours.
09:50Wired's Amit Kotwala recently interviewed several experts about the coming quantum apocalypse.
09:56According to one survey, experts believe Q-Day is going to arrive by 2035, if not sooner.
10:01And some think there's a 15% chance it's already happened. Now, if Q-Day does actually arrive,
10:06that means everything from military intelligence secrets to access to critical infrastructure
10:11to your own private data and messages could all be exposed. It's not just the end of privacy
10:16as we know it. It's the end of any control over all the systems that we use every day.
10:20Experts kind of compare this to Y2K. When, if you don't remember, Y2K is when the computer systems
10:26use two digits to denote the date 00 and everybody was worried that everything would break because
10:31the computers would think it's 1900 instead of the year 2000. Now, Y2K has kind of become a joke
10:37because everybody pitched in and fixed the problem before it was actually a catastrophic issue.
10:42Midnight has come in Russia and there's no Y2K problem at all.
10:45And in this case, it's the same kind of situation where we need a bunch of different systems.
10:50Many thousands, I'm sure, is an understatement.
10:53Well, exactly. I think talking about it like Y2K is part of why I've always kind of dismissed this.
10:58Like, oh, it's some problem for the nerds. They'll deal with it in time.
11:02But the thing about Y2K was that we knew exactly when it was going to happen.
11:05This doomsday, we don't know when the deadline is.
11:08And in fact, there's some adversary out there building a quantum computer.
11:11They know perhaps when they're going to have one and we don't.
11:14And we also don't know if somebody may have actually even now built a quantum computer in secret
11:19and have the ability to crack all of these crypto systems and access secrets that we can't even imagine.
11:24There's basically two categories when we're talking about quantum computers breaking encryption.
11:28It's keeping of secrets and managing access to systems.
11:32If the encryption is broken, then you can't keep anything secret and you can't keep anyone out of any system.
11:39And to your point, they would also be able to mess with things, take control of all of the digital systems that control the power grid or air traffic control.
11:47It's really hard to imagine the level of actual havoc that they could wreak.
11:52And really, like some other countries could be storing all of this encrypted data that's traveling across the Internet and just keeping it and waiting for the day.
12:00When Q-Day arrives and they have this computer capable of cracking all of that.
12:04Yeah, absolutely. You make a great point that the data that's already been stolen is not going to be updated alongside those systems.
12:10And so all of those secrets could still be cracked.
12:12We really can't move to post-quantum crypto systems fast enough.
12:17One of the systems we don't really think about because it's just everywhere and we take it for granted is GPS.
12:24If it goes down, things get bad really quickly.
12:27And it's not just the navigation app on your phone.
12:30It's trains, airplanes, boats, all types of systems that people rely on.
12:34And it could really cause major disruptions.
12:37GPS is just one of several Global Navigation Satellite Systems, or GNSS, that are used around the world.
12:43Europe has Galileo, Russia has GLONASS, China has Bidao.
12:47But the U.S. is really reliant on GPS alone.
12:49The U.S.'s reliance on GPS makes it particularly vulnerable because the government hasn't created any backup systems like they have in other countries.
12:56It's used by transportation systems, emergency services, financial institutions, basically everything runs on GPS and you might not even know it.
13:05We've seen, for instance, in the war in Ukraine that Russian and Ukrainian soldiers have been using GPS jamming and spoofing to try to disrupt each other's drones and prevent drone attacks.
13:16But in those cases, we've also seen collateral damage.
13:19Those jamming devices are like very blunt instruments.
13:22They send out their radio jamming in all directions in a wide range.
13:27We've seen them affect civilian aircraft even.
13:29And I believe our colleague Matt Burgess has written about how civilian aircraft have had to be rerouted, sent back to the airport of their origin because of GPS jamming in the Ukraine war.
13:39Yeah, so this is something that's already happening on a small scale.
13:42But there's the potential if there's a major war between the U.S. and China where these systems could be disrupted on a much bigger scale.
13:49It's not just spoofing and jamming attacks that we have to worry about.
13:52There's also attacks on the actual satellites themselves.
13:55We know some countries have developed satellite technology to take out or disrupt satellites in orbit.
14:00The fact that countries are carrying out these kinds of attacks shows just how valuable GPS is and how vulnerable it can be.
14:06Yeah, I remember in this science fiction book from 10 years ago now called Ghost Fleet, they posit this future war with China where the first shot of that war would be China destroying all of the U.S.'s satellites.
14:17That is plausible.
14:18We've seen China and Russia demonstrate the ability to destroy satellites.
14:22China has shown that it can use a satellite to grapple onto another one and pull it out of orbit.
14:27They sound like science fictional threats, but they are practical.
14:30And we've never really thought about what our country would look like if all of GPS were suddenly disrupted.
14:39If you've used generative AI tools like ChatGPT, you know how powerful they are.
14:43They give you the ability to write an essay in seconds or create a business plan on something you might not even know anything about.
14:49The same goes for writing code.
14:51Programmers everywhere are already using generative AI to write code that they're deploying in the world.
14:56But the same goes for hackers.
14:58AI, for so many people, is a kind of glorified productivity tool.
15:02And it seems like it is that for now for hackers, too.
15:05Chinese hackers are using generative AI to write better phishing emails in perfect English now.
15:09They are almost certainly writing malicious code with AI, too, because all software developers are using AI to write code.
15:17But that's not like truly autonomous hacking bots out there somewhere on the Internet, which is the scary future thing we're talking about.
15:24But I think that's coming at some point.
15:26We will see fully autonomous hacking agents.
15:29And I think we may even see a future where AI is able to automatically find zero day secret vulnerabilities in code and exploit it immediately.
15:38And that's quite scary.
15:39These tools can be used by hackers in a couple of different ways.
15:42One, they can write code that somebody who isn't really skilled wouldn't have any ability to do.
15:47More and more people could become hackers.
15:49So you have these script kiddies writing tools in large language models and deploying that code with unknown consequences.
15:55Then we get to the professional level where both the good guys and the bad guys are using these tools.
16:00You have white hat hackers using them to find zero days or secret vulnerabilities in code nobody's been able to patch.
16:06AI can be really useful for protecting these systems.
16:09But you also have black hat hackers.
16:10They can use it to write malicious code that they might not otherwise be able to create and deploy that code in more sophisticated ways.
16:16We've talked for a long time about the problem of zero days.
16:19This idea of a secret vulnerability in a piece of software where the company that makes that software has had essentially zero days to fix it.
16:26AI is going to be able to find those zero days in an autonomous way at some point.
16:31As these technologies advance, you can imagine a future where there is an AI.
16:35You can point it at a certain system and say, go hack that system.
16:38And it'll go in and it'll analyze the code that it's seeing, find vulnerabilities in real time, write malicious code in real time,
16:45and then gain further access into those systems, be able to exfiltrate data and just kind of cause all the havoc that hackers can already,
16:53but much more efficiently, much quicker and maybe on a much bigger scale.
16:57I think the real issue though is that defenders definitely need to be using AI or they're going to be left behind.
17:03Things aren't necessarily going to become instantly more secure or less secure one way or the other.
17:08We report on systems getting hacked almost every day here at Wired.
17:12And so that reality is going to still be there.
17:14It's just the question of will the teams defending against this stuff be adopting it effectively,
17:19as well as the malicious hackers.
17:21And we just don't know how that's all going to play out.
17:25If you've ever been in a natural disaster and the cell networks go down,
17:28you know just how helpless and stranded you feel.
17:31Now imagine that's happening to everybody everywhere.
17:34We're just not ready for our cell networks to go down.
17:36In addition to natural disasters, there have been several cyber attacks on cell phone networks in various countries around the world.
17:42There's also been repressive regimes that have taken the cell phone networks down on purpose to quell protests.
17:47We've seen a cyber attack launched against Ukraine's cellular provider Kyivstar in December of 2023 turn off cellular service to millions of Ukrainians.
17:56This was the Russian hacker group Sandworm trying to disrupt the communication systems for the whole populace of the country.
18:03And we've also seen governments purposefully turn off cellular access in Myanmar and India and Iran,
18:09sometimes for a week at a time, just as a way to quell dissent.
18:12We've never seen this happen in the U.S.
18:14But I think we can easily imagine that it's possible either with insider access or from an external threat.
18:21And we've also seen it just happen because of natural disasters and terrorist attacks in the U.S.
18:26where there's a crisis and everyone overwhelms the network just trying to reach loved ones or emergency service providers.
18:32And one of the solutions that people have been talking about is like a kind of peer-to-peer mesh radio.
18:37I think you've been looking into this.
18:39Yeah, we've been looking into this type of technology that's called Meshtastic.
18:42So I actually have one of the devices here and looks like a little pager if you remember those.
18:47But it's basically just a radio, a circuit board, and an antenna.
18:50These devices come in a bunch of different forms.
18:52Some of them look like the old Blackberry devices.
18:54They have actual keyboards. Some of them have touch screens.
18:57Some of them are really simple with just like a 3D printed case like this one.
19:00Basically, all the devices work the same.
19:02Meshtastic is a radio-based mesh network that uses long-range radio
19:06to send encrypted messages between devices across distances of up to 200 miles.
19:11Meshtastic is an open source software project.
19:14It's not maintained by any one company and pretty much anybody can get involved with the Meshtastic community.
19:19Unlike cell phones that connect to a tower to communicate, Meshtastic is a peer-to-peer network,
19:24meaning that each device communicates with other devices in the area.
19:27You're able to use this without cellular service, without Wi-Fi.
19:31You can connect it to your phone so you can text straight from there,
19:34and the device itself is what's sending the message.
19:36And it's really low bandwidth, so you can't really send much information.
19:39But the good thing is that it's really not reliant on any centralized system like a cell network.
19:44And the cool thing about it is that you don't have to be within line of sight of the recipient of the message.
19:48You just have to be in line of sight of some other Meshtastic radio so that you can connect to the whole mesh.
19:54And then that message gets passed around among all these peers until it reaches the intended recipient.
19:58That's the cool thing about it, I guess, is that the more of these radios connect to the network, the more powerful it becomes.
20:03It's still really early days for this.
20:05There's not that many people who have a Meshtastic device compared to, say, a cell phone, of course.
20:10But if you live in a city, there's a good chance you're going to have some type of Meshtastic network already set up,
20:14and you're going to be able to communicate with each other.
20:16It does seem like this is maybe the first step in creating a system that would survive a larger disruption of centralized cellular service.
20:24Meshtastic is really useful during, say, natural disasters when the phone lines are down,
20:28but it can also be useful if you're just in an area with poor cell coverage, like out for a hike.
20:32Meshtastic can't replace your cell phone altogether, but it's going to work when a cell phone isn't.
20:37This has been Incognito Mode.