"AI Hacking Just the Tip of the Iceberg...SW Asset Management and Fragmented Communication Channels Must Be Integrated"

Full Audit of Corporate Assets Needed to Assess Risks
Strengthening Security Ecosystem by Utilizing White-Hat Hackers

Following the recent breaches at domestic telecommunications companies, financial institutions have also been left vulnerable to hacking attacks, prompting calls for urgent, comprehensive countermeasures at the national level. The advancement of artificial intelligence (AI) means that simultaneous and continuous attacks are possible, with techniques becoming increasingly diverse. Thus, fragmented responses have now reached their limits. AI hacking experts have warned that "the attacks currently known are just the tip of the iceberg," and have advised, "The government should conduct a thorough inspection of corporate IT assets to assess risks and strengthen channels for actively sharing cyber threat intelligence."

Professor Lee Sangkeun of Korea University commented, "Many compromised companies neglected poorly managed external work systems, or failed to apply software (SW) patches to their websites even though such patches were already available." He emphasized that "strengthening the management of vulnerable assets through a complete audit of corporate IT assets must be a top priority." Since many software products are foreign-made and information is provided by third parties, companies often lack concrete knowledge of software vulnerabilities. Therefore, Professor Lee explained that organizations should establish an early warning system to flag SW vulnerabilities as they are discovered.

Professor Lee also stressed the need for an immediate sharing system in the event of a cyber incident. Although similar attack techniques may be used across different sectors, delayed information sharing results in a lag before companies even recognize that a breach has occurred. "Sharing cyber threat intelligence can help reduce the spread of damage," he said, emphasizing, "The government must also enhance the security of communication networks, which are key components of national infrastructure."

The Government Must Take the Lead in Bolstering National Communication Infrastructure Security

Park Sejoon, CEO of security company Theory, founded by the nation's top white-hat hacker, pointed out, "When a hacking incident occurs, the Ministry of Science and ICT, the National Intelligence Service, the Korea Internet & Security Agency (KISA), and financial institutions each respond individually. However, there is an urgent need to integrate information and communication channels at the national level for a swift response." He added, "Both public and private sectors have a greater advantage in defense if they possess more information about cyberattack trends and patterns, but KISA lacks sufficient manpower, and fragmented response channels working separately is causing delayed responses."

In the past, cyberattacks varied by industry, but now, due to the rapid development of AI tools and agents, attacks can be launched across industries and sectors simultaneously. Park warned, "Companies are reluctant to share breach information, fearing exposure of trade secrets, but authorities with proper authority must dispel these fears and coordinate so that public and private sectors can cooperate effectively." He continued, "With an AI hacking tsunami approaching, if we do not shift our defensive paradigm, we will inevitably face an uncontrollable situation."

Park also identified the cultivation of a white-hat hacker ecosystem as part of the solution. "Overseas, companies like Google Chrome offer rewards equivalent to a full-year salary for reporting vulnerabilities," he said. "In Korea, however, when white-hat hackers find and report security flaws, they often encounter a defensive attitude instead of incentives." He stressed the importance of fostering a culture and environment where white-hat hackers are developed and can contribute to strengthening national security ecosystems.

The evolution of hacking techniques using AI has also reached the limits of conventional detection methods. Traditional security frameworks stored known malicious codes or attack patterns in a database to block matching attacks. However, AI can pursue alternative routes in real time using reinforcement learning if an initial attack fails and can adapt its behavior to mimic humans, making detection much more difficult under current systems. According to Professor Kwak Jin of Ajou University’s Department of Cybersecurity, "AI enables much faster attack speeds, making brute-force attacks possible," and he cautioned, "It may be difficult to block attacks with current detection methods." The attack surface has expanded as well: not only core service systems and customer apps, but also employee and partner work support systems, temporary test servers, and even outdated, yet still externally accessible, websites have all become potential points of entry due to lax management.

AI Hacking Tsunami: A Shift in Defense Paradigm Is Needed

Experts highlight the growing threat of hacking through application programming interfaces (APIs), which serve as external connection points. If API authentication or access control is insufficient, attackers can exploit them as gateways to internal information. Professor Kwak pointed out that 'shadow APIs' unrecognized by a company's security team can represent major vulnerabilities. "APIs are typical attack points where external contacts link to internal systems," he said. "Applications and software installed by users within the organization, but not formally managed as assets, may also serve as attack pathways."

The classic web attack method known as SQL Injection can now be attempted en masse by AI systems. Without proper validation of external input values, attacker-inserted commands can be combined with internal database queries, letting the attacker retrieve or manipulate information as intended. Yang Bongyeol, CEO of Logpresso, warned, "Contrary to the developer's intent, commands inserted by attackers may execute unexpectedly, enabling attacks. Conventional web hacking techniques can be automated and carried out at scale with no human intervention."

As a solution, experts are emphasizing ‘zero trust’ approaches, such as granting access permissions in short time frames or on a one-time-only basis. This approach, based on the premise that anyone could be a hacker, reduces the convenience of authorization in exchange for the immediate detection and blocking of abnormal behaviors. There is also a call to apply the level of security usually reserved for core systems to non-essential systems. If an organization concentrates its security capabilities on key systems but neglects to collect and monitor logs from less critical work systems, attacks may go unnoticed. Yang explained, "Many organizations have yet to establish a system that collects and monitors logs for web API calls themselves. It's necessary to gather and store logs for the web servers or assets of non-essential systems as well."

To build ‘resilience’ and minimize damage even after a cyberattack, a security system designed to mitigate damage is necessary. Yang added, "Even if a specific security system is breached, ‘microsegmentation,’ which divides and patrols segments of the network to prevent more sensitive information from being compromised, is required. Organizations need to build a security architecture that can minimize losses when breaches do occur."

This content was produced with the assistance of AI translation services.