AI 해킹, 일상까지 침범…‘쪽문 보안 강화’ 시급

Recent cyber breaches have affected various sectors, from industry and finance to universities, churches, and public institutions, putting national companies' and organizations' cybersecurity systems to the test. With the increasing use of artificial intelligence (AI) in cyber attacks, there is concern that the scale and scope of damage could be much greater. Experts stress the urgency of proactive responses, including rigorous checks and enhanced defense systems.

In October alone, simultaneous hacking and personal information leaks occurred in various financial and industrial sectors. The Financial Services Committee reported on October 14 that personal information of about 100,000 individuals was leaked from 16 banks and savings banks. The impact was not limited to the financial sector.

Airport operators, including Korean Airlines and Asiana Airlines, as well as companies like Ewha Womans University, Dongdaemun Grace Church, Korean Power, and the cafe chain Harlis, all experienced cyber intrusions. This widespread cyber intrusion featured AI-based autonomous intrusion testing tools like "ArteX," which automate vulnerability scanning, attack path design, and execution, drastically reducing the time, costs, and technical barriers to entry.

Recent arrests of a domestic hacking organization revealed that it had stolen personal information from 90-plus organizations over a 13-month period. Of these, 60 facilities were compromised within 40 days of deploying AI. The perpetrator, an information technology (IT) non-specialist, highlights the publicization of hacking by AI agents that can replicate human tasks, enabling widespread hacking without specialized knowledge.

The recent series of cyber intrusions also featured a unique characteristic: the attack targets were not limited to a company's core systems. A report by the ASEC Intelligence Center, released on the 29th, found that recent hacks often utilized external backup solutions or temporary files in the cloud as attack vectors. ASEC warns that autonomous attack agents tend to breach outer perimeters before breaching core systems, exploiting security controls that are comparatively lax in the outermost layers. They emphasize that seemingly smaller external points can serve as gateways to critical data.

While focusing solely on core network security may leave organizations vulnerable to AI attacks, the urgent findings of the Financial Services' emergency check underscore that 130 out of 555 financial institutions still have security gaps. Professor Hyuk Seong-jin from Dongguk University's International Information Protection College advises that a comprehensive approach, including multi-factor authentication, access control, and anomaly detection, is crucial for all industries to urgently bolster their AI-based defense capabilities.