As people seek more information on financial markets and news events from the Internet, the heightened risk of web defacement threatens to lead them to make ill-advised decisions, according to Thayer School of Engineering Professor George Cybenko.
"As a society we're not prepared to deal with it," said Cybenko, who recently published a study on "cognitive hacking." "The laws, regulations and machinery aren't mature."
Cybenko and his associates researched the nature of contemporary hacking that occurs on the Internet, and claimed that hackers have shifted away from the traditional strategy of breaking into individual computers.
Much more common today is the threat of an entire information system being attacked. Cognitive hacking "has to do with manipulating perception and waiting for altered reality to produce actions that would complete the attack," Cybenko wrote in the article.
According to Cybenko, cognitive hackers manipulate systems for various reasons. In his article he cited a number of cases wherein the hacker posted false or misleading information about stock prices for personal gain.
He noted that other hackers break into the systems of news agencies to distribute false information " usually creating links from reliable news sources such as CNN.com to spoof pages. Disseminating jokes as reality can lead to a chain reaction with far-reaching consequences.
Ph.D. candidate Annarita Giani gave an example of a cognitive hack into a company that specializes in information security.
"Sometimes the effort is to discredit the company," she said.
Cybenko said that no system can be completely secure, not even systems created by security experts, and new technology must be developed to detect cognitive hacks.
His suggested proposals for combating these attacks included linguistic analysis, in which patterns would be looked for to connect suspicious material and trace the hacker, and an increased personal awareness that information on the internet may not always be accurate.
Recently a resolution passed the House of Representatives that, if passed by the Senate and approved by President George W. Bush, would, according to Cybenko, "protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws."
Yet the passing of such a law would raise issues of privacy vs. security on the Internet. One way of overseeing networks to prevent and discover hacking would be the implementation of identification systems such as Public Key Infrastructures.
Many cognitive hacks are presently discovered and traced to individuals not due to electronic identification systems, but to the vastness of the schemes.
"The consequences of these cognitive hacks are significant enough that they catch attention," said Cybenko.
The article was co-written by Giani and Paul Thompson, a researcher at the Institute for Security Technology Studies, and was published in the August issue of Computer magazine.
