How North Korean hackers turned Binance's own internal AI into a weapon in $6.3b heist - interview

Two weeks following the Binance cyberattack, in which North Korean hackers pilfered approximately $6.3 billion from the cryptocurrency exchange, detailed internal investigations unveiled the true nature of the breach. According to cyber expert Ori Segal, the most groundbreaking aspect of the assault was not the utilization of artificial intelligence (AI) by the attacker, but rather that the victim possessed its own AI tools.

Segal, CEO of Cybore, elaborated on Thursday in conversation with The Jerusalem Post that the attacker leveraged one of Binance's internal AI tools to infiltrate two engineers' computers.

Segal, whose firm developed a system for identifying suspicious activity during Zoom calls, clarified that, apart from this, all other stages of the attack followed conventional methods, such as employing a poisoned package manager, a fraudulent recruiter, a malevolent file, credential reuse, and an overly extensive deployment permission.

He emphasized that none of these actions necessitated the use of AI models. Segal further noted that, while most cybersecurity experts have been preoccupied with contemplating what hackers can achieve using AI models since their emergence in 2023, little attention has been given to the potential of hackers exploiting AI tools utilized by companies.

He highlighted that there is scarce guidance available for companies to prevent such attacks or instruct employees on how to prevent false interviews, as there is no clear protocol in place to safeguard against them. Segal described a critical element in averting these attacks as curtailing the pressure for results and verifying whether the tasks require execution on a specific device and whether there is any infection risk.

To enhance security, he advised that unvetted third-party code should never be executed on work computers, nor on machines handling personal projects. He also pointed out that a disposable virtual machine costs nothing and effectively neutralizes the entire attack, regardless of whether any signs of wrongdoing are detected.

Segal further investigated another significant vulnerability that had not garnered extensive attention following the Binance cyberattack: the lure of a job interview itself is a vulnerability due to the necessity for the employee to disclose that they are seeking new employment in order to undertake the investigation. He explained that an employee who begins to suspect an issue may have arisen now faces a personal incentive to remain silent, as reporting it would necessitate informing their employer about their job hunting endeavors, which could potentially reveal their presence on company premises.

While he did not claim that this occurred at Binance, Segal emphasized that the incentive is inherently present in every company susceptible to such attacks and that it benefits the attacker. He concluded by stating that the solution is relatively inexpensive and that few organizations have taken this step. He advised publicly declaring that an employee who was job hunting and executed something they should not have will not face punishment for reporting it.

Until a company makes such a declaration, Segal contended, they should anticipate delayed and incomplete disclosures.