Brett Goldstein is a Vanderbilt University professor specializing in cybersecurity and artificial intelligence and a former Pentagon official.
On Oct. 29, hackers that FBI analysts link to North Korea stole nearly $6.4 billion from Binance, the world’s largest cryptocurrency exchange — roughly four times the previous record for a crypto theft.
About a week earlier, the National Security Agency told anyone running a website on PHP, the programming language behind roughly 7 in 10 websites, to install an emergency fix or take the site offline after vulnerabilities were discovered. In Japan, more than 20 major companies recently suffered cyberattacks, and a ruling-party official called it “a state of emergency in cyberspace.” My friends who run banks and keep the lights on in critical infrastructure are using the word “panic.” My friends at the artificial intelligence frontier labs are more blunt: The next couple of years are going to be brutal.
The rumblings shaking the internet are only the beginning. The systems we run our daily lives on are far more fragile than people realize, and the sins of our cyber past are coming due.
It’s uncertain whether AI was used in these attacks, but cyberattacks have multiplied and gotten better. Finding a serious software flaw used to be a needle-in-a-haystack hunt for a skilled hacker. Modern AI hands the haystack to a fast, easy-to-use machine and then hands the machine to both elite and amateur hackers.
Unfortunately, the haystack is enormous, because engineers and system architects constructed it that way. For decades, developers built software quickly and badly because the cost of getting it wrong was never high. I know; I was part of it. I was an early employee at OpenTable, a digital restaurant reservation system, and we asked whether our code worked, not whether it was safe. Speed was our sin. Later, as chief information officer for the city of Chicago, I saw a different sin: scarcity. With the budget stretched to breaking, an old system that still worked stayed up because we didn’t have the money to replace it.
For most of those years, few understood cybersecurity well enough to know what we were skipping. Those sins — speed, scarcity and ignorance — created a thousand shortcuts in a million systems. Every one of them is still out there, waiting to be found.
Look at the PHP flaws. Security researchers used AI to find them, in code written in 2012. Within 45 minutes of their official disclosure, the internet security company Cloudflare was seeing tens of thousands of break-in attempts. Within two hours, hundreds of thousands. Within 24 hours, millions. Then the security firm Bitsight found that nearly 60 percent of exposed PHP servers run versions so old that no official fix exists for them; a week after the fix came out, only about a third of the servers it tracked had installed the patch. Bad software is like asbestos. Asbestos was cheap and no one understood the health consequences, so it went everywhere. Bad software is now everywhere too, and we are starting to see how toxic it can be.
Now consider that two systems help hold up the internet: Border Gateway Protocol, which directs traffic across the internet, and Domain Name System, the internet’s phone book, which turns “washingtonpost.com” into the string of numbers machines actually use. Both date to the 1980s, and neither was built for the scrutiny they are about to face.
Here is where this goes. One day, someone finds a flaw in the software that puts the padlock on your browser, which nearly every website uses to keep your information private. A criminal gang or foreign government exploits the flaw to break into whatever it wants, and the rest of us learn about it only when things stop working. Hospitals look up patient records only to find they’re locked out. Paychecks do not go out.
Nobody can be sure which systems have been compromised and which remain secure, so the operators — hospitals, payroll companies, utilities — do the only safe thing: unplug. Thousands of them, all at once. Chinese state-sponsored hackers who have spent years hiding inside America’s power and water networks see every defender busy and choose that moment to strike. The disruption drags on because millions of old machines cannot be fixed and are picked off, one by one, for years.
The internet does not go dark. It flickers. A country built on the assumption that the internet would always be on learns what happens when it isn’t.
For you, it looks like this. Your bank’s app is down. The pharmacy cannot pull up your prescription. Your paycheck is late — not stolen, just late because the payroll company unplugged its system to be safe. None of it is a catastrophe on its own. All of it, every week, is a different country from the one we live in now.
Step one is acceptance. The fragility is real. The people uncovering it responsibly today will soon be joined by others with the same tools and no scruples. And there is no more time.
Then do three things. First, go after the foundations — the shared code everyone runs — and find the cracks before someone else does. AI companies built the machine that makes every old shortcut findable, and they can run it against the foundations of the internet at the scale this needs. That is not a favor to ask of them. It is an obligation, and the government should hold them to it.
Second, the AI tools being used to find these weaknesses must be applied to new code before it goes live as a standard practice. Third, nobody gets to sit this out. Universities, government and industry have to do it together, because none of them can do it alone.
We got away with writing sloppy software for so long that we never thought there would be a price. The penance has arrived, and it is not cheap. We can pay now, on our schedule, or later, on theirs.
The post The internet won’t necessarily go dark. It could simply stop working. appeared first on Washington Post.
