Myth or mythos: Is the AI cyber threat real?

0:00This BBC podcast is supported by ads outside the UK.

0:30That only checks a few things. When I used Evie, I finally saw patterns that had never been explained to me before. Then a licensed clinician reviewed my results and created a personalized prescription care plan based on my actual microbiome. And for the first time, I wasn't just reacting. I had direction. Evie also isn't just data. It connects you to real clinical next steps based on your results. If you're tired of repeating the same cycle, this is where that changes. Visit evi.com and take the Evi test at home today. This episode sponsored by We Feed Raw. Have you ever actually looked at the label on your dog's food?

1:10Most dog food labels are a long list of things that don't look like food. Powders, starches, additives used to hold ultra-processed kibble together. At We Feed Raw, the label looks very different. High-quality meat, nutrient-rich organs, complete and balanced nutrition formulated by Ph.D. nutrition experts. No fillers, no artificial preservatives, just real ingredients that support your dog's whole body health. That's why many pet parents see real changes after switching to We Feed Raw's fresh meals. If you want to feed your dog one of the healthiest diets possible, We Feed Raw makes it simple.

1:47Right now, new customers can get 40 % off their starter box, plus free shipping. Visit We Feed Raw at wefeedraw.com to get started today. Hello, I'm Chris Vallance and welcome to Tech Life on the BBC World Service, the programme that's all about technology and how it affects all our lives. This week, we're looking at the latest cyber security threats that governments and big companies are facing. A former FBI cyber crime fighter gives us the inside scoop. And later on, a Tech Life listener is using dermatology tech to educate teenagers in Australia about the dangers of the sun's UV rays. This is making a difference with kids.

2:29It's changing attitude and it's really, for the first time ever, giving us an insight underneath the skin, which is quite incredible.

2:55Now have you had money or data taken by hackers? Lots of us have. In the UK, major retailers, hospitals and car manufacturers have all been disrupted by cyber attacks. It's worrying, and there's a new threat to chew your fingernails over. The possibility that a powerful new AI system could fall into the wrong hands and supercharge hacking. Anthropix says its newest AI model named Claude Mythos Preview is too powerful and dangerous to be released to public. So Mythos excels at identifying weaknesses and security flaws in software which hackers could use in cyber attacks. CBS News reporting there.

3:36In official UK tests of its cyber capabilities, the new model Mythos passed hacking challenges other models could not. The UK Government Minister for AI, Kanishka Narayan, told this programme, our independent testing shows that cyber capabilities in leading AI systems are advancing much faster than we expected. Like most AI systems, Mythos is a double-edged sword. It's great at spotting security flaws in code, a useful skill for defenders, but also a vital skill for attackers. Anthropic is for now restricting its release, but it's reasonable to think other equally capable AIs will appear. So how safe are the systems we all depend on?

4:22We turn to a veteran cyber crime fighter to find out. Cynthia Kaiser spent eight years at the FBI in the US, where she was the deputy assistant director of their cyber division. Now she's working at the Halcyon Ransomware Research Center in the US. And we started by discussing mythos. The risk is real, but it's not something that you can't necessarily defend against with current tools if you position them in the right way. Let me kind of detail out what that means. So Mythos is very good at identifying vulnerabilities. I think from over in the UK, the government did a great study kind of looking at that saying like, we don't even know how to quantify this risk because it's able to do this so well.

5:13And like, even among the organizations that have had access to Mythos that I've talked to, they've indicated it's been able to find a large quantity of vulnerabilities across their systems. But I'll pause there because the greatest kind of use case and if say criminals or other nation states got access to mythos, how they would do that is initially to try to get onto a network. Some of your listeners may have heard this as zero day vulnerabilities, which means they're just undiscovered vulnerabilities. No one knows about them. There's no patches yet. And so if that got out, if actors were able to find a whole lot of these undiscovered vulnerabilities, then there's no kind of security around organizations to stop them from getting in.

6:02And that's really serious and scary. But the one area I'd note is security doesn't just stop at the borders of organizations, at the borders of networks. There's a lot of great security tools that are for internal in your network. There's what we call defense in depth. You have multiple tools able to identify things. Now with AI, we can really baseline what does behavior look like on networks where this user account doesn't normally act like that. Why is it acting odd? Let's go check that out further. And then there's ways to segment across networks, which means to put up kind of dividing lines, additional security so that you just can't move across an entire network or have access to everything once you get on.

6:49And so those types of activities that organizations can do for that internal defense is really important in the age of there being tools and mythos is one, but there's going to be others where they're able to get onto a network and you don't know it. A UK minister, the minister responsible for AI, when we asked him about Mythos, the reply we got back was that the thing that they were observing was that the cyber capabilities in leading AI systems are advancing much faster than we expected. I mean, if you were in government or if you were advising a government, would you be sort of warning them, this is just the beginning?

7:36I don't know if the government bureaucracy can actually keep up with the speed of tools and how they're being developed. And by that, I mean, let's say that organizations have access to mythos. They're identifying a thousand vulnerabilities and they send all that into the U.S. or the U.K. government to say that there should be a patch on this. Something should go out on it. Well, our governments aren't necessarily staffed, positioned. I'm not sure anybody is, to deal with a thousand at once coming in at them. And so the systems that we have in place right now for being able to address those types of vulnerabilities are going to be challenged, even just with the technology as it is today.

8:18You mentioned the use of AI and sort of getting into systems and getting into businesses. I mean, that is something that I now think is quite a common feature of cyber attacks, deep faking people's colleagues or deep faking the boss of the company. You know, it seems to be a first step. And we've seen it as a first step in some quite serious attacks like, you know, attacks on basic bits of software that are used by millions of other companies, businesses, websites. You know, it's a real threat now, isn't it? it absolutely is i i think about some of the attacks i hear about where it's like but they pretend to be your ceo and they call you on whatsapp and they say hey i need you on this urgent call here's the link and when you're looking it looks like your ceo it's like the where they've been at on vacation before like all the things match and i think to myself like i do this every day day and day out and i'd probably be fooled by some of these the tools to create deep fakes or do other AI-enabled types of operations.

9:25They're available for purchase on the dark web. And I'm actually going to be talking even more about a lot of those AI tools that are available on the dark web at InfoSecurity Europe and London at the beginning of June. So if I went shopping, what kind of tools would I be able to get? Well, you could get tools that enable you to create deepfakes on your own that are a little more realistic than just, you know, might be able to do in an open source way. There are tools that help connect those usernames and passwords that are been stolen from all of us many times again and are for sale on the dark web.

10:05Now we see a lot of integrations to be able to take all that data and then use it at scale for conducting their outreach and trying to send these malicious messages out that have you try to click on a link, et cetera. And some purport to having, you know, saying, oh, I can go across the entire ecosystem. I can do an entire operation. We don't see full AI operations being all that successful, but it's never stopped criminals in the past from advertising, falsely. Like it's part of this whole cyber criminal underground of developers, attackers, money launderers, infrastructure providers, people kind of think of somebody in a hoodie in the basement doing these attacks, but it's incredibly sophisticated economy behind all of these moving forward.

10:56Though I do wonder if there are criminals out there that are worried AI is going to take their job too. When we talk about who is doing the hacking, I mean, we live in a time of great geopolitical uncertainty. We have a hot war in Europe, a hot conflict in the Middle East. How does that feed into the world of hacking? The Iran conflict now is the first one that I can remember where really both sides had integrated cyber operational capabilities. One of the first major kinetic targets that Iran hit were data centers, because we rely on them to do all of our work, all of our business. And that impacted businesses across the world.

11:45And there was a lot of pivoting that had to be done. And so kind of understanding that data centers are now a target for these types of attacks. Second is that nation states are increasingly using cyber criminal tactics to conduct more destructive operations. Iran's done that for several years. We had an Iran attack Albania a few years back where they were upset that Albania was hosting what they saw as a dissident group. And so they conducted this incredibly destructive attack. They wiped data. They used ransomware. So locking up the network, they had taken information that they'd stolen and put it out there for information operations.

12:30But what's important about that one to know is the Iranians had actually been conducting an espionage operation against those networks for 14 months. Then they turned it over for attack and they made it look like a fake cyber criminal group. And they did it when something happened. You mentioned ransomware. I mean, this has been a huge story in the UK with, you know, car manufacturers and top high street brands hit by ransomware attackers. What's the picture there? Is this a problem we're getting to grips with or is it still sort of outpacing the response? So, you know, I've likened to the amazing work that my colleagues at the FBI and in the UK, the NCA, all of them have been able to do.

13:20It's almost akin to mowing your lawn, right, where you go out there and you're able to stop the explosive growth of some of it. But it's not gone. There are more ransom attacks than there were just a few years ago. It's incredibly fast. That means we used to see attacks maybe take a few weeks from the time an actor got on the network. They had to look around, find the right accounts, find the right data, et cetera. Now we see an average of about four hours from that initial access to that full locking up of a network. We've even seen it in under an hour. And then these attacks, no red lines. There used to be some types of honor among thieves, and they wouldn't target things like hospitals.

14:10But last year, hospitals and healthcare in the US were the most attacked sector. So how do we stop it? I mean, there are lots of different ideas and theories that people have about how we can deal with the ransomware menace. A lot of it focuses around whether or not we should allow people to pay ransoms. But what do you think are the best things we can do at the moment? I think there are certain aspects like labeling ransomware actors who actually endanger people's lives as terrorists. My team at the Ransom Research Center has done analysis across U.S. laws for that and noted that we believe they meet the legal definition of terrorists if they're targeting a hospital, if they know they could kill somebody and they've just decided it's somebody else's problem.

15:00being able to identify it and really label them in that way because it loosens up a lot of funding, enhanced intelligence capabilities, but also international collaboration because in the end, we need tools to be able to go to the countries that are hosting these criminals and hold those countries accountable for allowing their citizens to try to harm the people within our countries. And thanks there for that fascinating insight to Cynthia Kaiser, a former Deputy Assistant Director of the FBI Cyber Division. Could ending the war in Lebanon hold the key for a deal between the United States and Iran?

15:47I'm Tristan Redman. And I'm Asma Khaled. And together we host the Global Story podcast from the BBC. Talks to end the war have stalled with Iran's insistence on an end to the war in Lebanon a sticking point. Why is the war in Lebanon so hard to stop? For more, listen to The Global Story on bbc.com or wherever you get your pods.

16:22This is Tech Life on the BBC World Service with me, Chris Vallance, and with you, our listeners. Tech Life regular Nukombe in Cameroon heard our recent addition on tech to help solve sleep apnea. He messaged us on WhatsApp to say he learned a lot about the condition from the show. Well, thank you, Nukombe. Meanwhile, Robert Oliver, who lives in the UK, emailed after listening to our most recent program, which looked at using AI and cameras to hunt out potholes on our roads. And he thought my introduction didn't measure up. Listening to last week's episode, I was surprised you used kilometres for the total distance of the roads in Britain.

17:00I thought we used miles as a measure of the distance. Well, we do. You're right, Robert. But I was thinking of our listeners in places where they don't. A kilometre isn't too far to go for our friends around the world, I hope. If there's anything you'd like to tell us about this edition, perhaps on cyber security after hearing my interview with Cynthia Kaiser, we really would like you to get in touch. Our email address is techlife at bbc.co.uk or you can send us a WhatsApp text message or voice note. The number is plus 44 330 1230 320.

17:43Now we're going to stick with you, our listeners. A little while ago we asked you to tell us about the tech you're using in your life. Well, Simon Board, who listens to Tech Life from Sydney in Australia, got in touch. Simon has a background in physical education as a teacher and now as a lecturer doing a PhD. But he also runs workshops to help educate school pupils about the damage the sun's ultraviolet rays can do to their skin. And as you'll hear, he uses tech to help persuade kids to stay safe. So without further ado, this is Simon's story, beginning with why he decided to get in touch with us.

18:23Yeah, Chris, look, listening in the mornings to BBC, Tech Life in particular, it's really inspired me listening to all the different stories from around the world. And it certainly drove me and sort of inspired me to get in touch. And tell us what you got in touch with us about. It sounds really worthwhile. Yeah, look, I thought it'd be worth mentioning the concept of making change for our adolescents, our young people in high school and the way they look at preventative skin cancer education. It's quite a significant problem with the melanoma rates extremely high in Australia. And we have more young people dying from melanoma than car accidents.

19:07So it's quite a significant issue and it's something that as a school teacher and now as a lecturer, I'm engaged with students and have been for the last number of years. And, you know, being fair-skinned myself, I'm very sensitive to, you know, some of the potential issues in this space. And what you're doing is essentially helping to raise awareness of the risks and you're doing that using technology. Tell us about that. Yeah, look, we've been very fortunate. For the last few years, I've worked with a dermatologist, and that's given us access to what we call the Vizia imaging machine. And it's a clinical-grade skin imaging technology that we've bought into the classrooms.

19:49So we have this technology which essentially will scan the surface and the underlayers of the skin and give you readings and insights that you otherwise would have no idea about. So talk through that technology. Talk through it from a sort of, if you like, a user's perspective. When you're in a classroom, what happens? Your user would sit down and there would be three flashes and they don't feel anything. Then they would sit back and then the images would appear. And what they get to see in each of the slides is an analysis of the spots that they have on their face, the wrinkles. And this is, I've seen 15-year-olds with some significant wrinkles that are not able to be changed.

20:32the texture of the skin so how smooth the pores how deep how wide are the pores that can lead to issues with acne brown spots which are the really deep spots that I've had for example an indigenous student beautiful surface skin a very dark skin and underneath they've got this damage and they said look I never wear sunscreen because I never thought I had to but the brown spots really deep underneath, showing that there is damage as a melanin tries to come through. Also, there's red areas. So it looks at the blood vessels. And the thing that happens when we get UV damage is the blood vessels go closer to the surface.

21:13And you can see a lot of the breakdown of the blood vessels through it as well. And also porphyrins. We look at, these are amazing things, Chris, because what happens is that as you get bacteria, these porphyrins actually eat the bacteria and they glow fluorescent. So underneath the visia, the kids see this lighting up of their face. It's basically showing how much bacteria is happening, which obviously for adolescents is quite high. But from a dermatology point of view, we can actually look at the health of the skin and make a diagnosis from there. And the last thing we do with this imaging is we hit a button and it will actually age them from 15 through AI all the way to 80.

21:59So this is where we get the screams and the, oh my God, I look like my grandmother. It's absolutely amazing, but a really good opportunity for us to see the future. And this is making a difference with kids. It's changing attitude and it's really, for the first time ever, giving us an insight underneath the skin, which is quite incredible. Is there other tech that you might want to bring into the classroom? Yeah, well, look, we have a Proviso portable UV camera, which you essentially plug into your phone. Students will look straight into it. The screen can be split into two, so you'll see your normal face at the top, and then you'll see your face under UV conditions.

22:40Now, what that means is we get students to try a physical sunscreen, like a zinc, and they'll put that on and say, oh, wow, that's really thick, and it comes up as really jet black, and then they'll put a chemical sunscreen on and then they'll put the spray. And what they realize is that the spray, no matter how hard you try, you just don't get the coverage that you get with the chemical or the physical. So that is another amazing opportunity where we've got the Visio, it goes under the layers, and now we actually balance that quite nicely with the providers, which gives them a strategy to manage that skin so they don't actually end up with issues.

23:20I guess there may be schools that aren't fortunate enough to have access to this kind of kit. How do we get this kind of technology, which you found has this amazing persuasive power, if you like, into the hands of more students? Yeah, that's a great question, Chris, because it's something we're working on at the moment. We're applying for lots of grants. We're looking for government support. And it'll come. We're reaching out to a lot of schools. And we've set up a program whereby if we have a school that is lesser means, we've got a system whereby we're able to support them. And that's been fantastic.

23:56So we're doing the best we can to make sure that we provide equity with everyone because we want everyone to have access to this product. Is there a scope for expanding this internationally? I mean, Australia is not the only country to have a lot of sunshine. Absolutely. Yeah, Chris, look, this is ready to go. And, you know, my PhD study at the moment is really focusing on international study, looking at sun protection. And it's looking at a number of countries that are very, very high UV and very high melanoma rates. So, you know, looking at UK itself, you know, in the next decade, you're looking at a 50 % increase in melanomas in your country.

24:36And I'm sure you're feeling those summers more than you probably have before. So we're certainly getting a 10 % increase every year in UV here with climate change. So there's a number of factors that are coming together, not only in Australia, but throughout the world. Simon, you mentioned the PhD that you're doing. What kind of technologies and issues are you looking into there? Yeah, no, absolutely. There's some really amazing advancements out there at the moment. And interestingly enough, a couple of them come from the UK. So one we're looking at at the moment is a colour-changing silicon. And as I was watching the Australians beat the English in the cricket, the ashes there, I was thinking, Jesus, warming.

25:23No, you're rubbing salt in the weeds, but carry on. But as I was watching our opening bowls run in, I thought, look, what a great message for all our young cricketers and all our young people. if they had this change of this silicon that would go on the front of their shirts and what it does at uv level three and above it gets darker and darker red color now it's quite an amazing bit of technology that's been developed by a group in the uk there and it's actually been used on worksite vests so it's that whole idea of trying to make a worksite a safer in in changing uv condition. So they've also modeled it and put it on a football shirt.

26:08And so from my perspective, I'm looking at that. I'm looking at companies such as Surf Life Saving. I think it'd be wonderful for them to be able to remind their young people, look, it's UV three and above. It's changing color. Let's just make sure we reapply our sunscreen. We're also looking at technologies that can detect real-time UV. And there's some interesting developments with that, that we're quite excited about from a ring on your finger that could actually detect UV and send all that data. If you imagine throughout the world, if we could collect all the UV, real-time UV data throughout the whole world, we could actually do a whole lot of work with that in terms of working out areas of shade that are required or is there genuine climate change happening and here's some evidence why.

26:57There's a number of things we could do there. And so from that perspective, the real-time UV, the silicon badge, there's so much going on that is really exciting. And I look to, particularly from my perspective, I come from the country, from a rural area. I'm really interested in the inequities and some of the challenges that our rural and remote regions and our Aboriginal and Torres Strait Islander peoples have. And I'll just mention, I mentioned before the young lady that had the darkest skin. And what we find in those with darker skin, with skin cancer, is that they're actually having much more severe skin cancers because they're not revealing themselves as quickly.

27:36And when they do reveal themselves, they're quite significant and they're well, not well beyond, but they're certainly well down the track in terms of doing damage to the skin. And they also find them in their nails, both on their toenails and their fingernails and underneath their feet, interestingly enough. So while a darker skin is protective, it actually brings more genetic challenges that maybe we didn't realise. And that's Simon Board, a Tech Life listener in Sydney, Australia, shining light on an important issue.

28:10Well, if you've been inspired by that conversation with Simon, perhaps you'd like to tell us about the tech that you're using in your life. Maybe like Simon, you're putting it to good use to help others. maybe UV is a problem where you live you can contact us by email our address is techlife at bbc.co.uk or you can WhatsApp us on plus 44 330 1230 320 you can send a text or a voice message but do please remember to include your name and where you live today's Tech Life was produced by Tom Quinn and presented by me, Chris Fallons