Tis the season for cyberattacks. With more online shopping, prepping for new year’s resolutions, travel, and phone calls, attackers have more opportunities. Hacking, phishing, and ransomware get all the press because they usually result in big ramifications that are quickly discovered. In this blog, however, we’re focusing on the lesser known and much more insidious poison attack.

WHAT ARE POISON ATTACKS

Poison attacks damage a system’s ability to make smart decisions. Systems make intelligent decisions based on their “training” or to put it another way, the data that they receive. This data is used to hone the artificial intelligence (AI) of the system to help it make smart decisions. Poison attacks mess with that foundation–the training data set. Poison attacks basically skew the system’s data model in such a way that the output is no longer as intended. They create a new normal for everything. And since these attacks usually happen in slowly growing increments over time, they’re usually hard to detect until the output is radically different.

Poison attacks are primarily backdoor attacks. In a backdoor poison attack, the attacker creates a loophole in the core data rule and trains the system to adhere to that rule so it can be exploited later. To illustrate, let’s say the access control for a particular file will only allow employees beyond the VP level to view the data. If someone violates the main access parameter and opens it to include a manager level, then the system will not detect an intrusion by someone at that level, even if they log in with their credentials.

Unlike ransomware and other types of attacks, poison attacks don’t make much noise initially but cause far more damage because they can go undetected for a longer time. So make sure you stay alert for the signs.

TYPES OF POISON ATTACKS (WHAT TO WATCH OUT FOR)

Poison attack methodologies typically fall into one of the following 3 categories:

· Logic corruption

In logic corruption, the attacker changes the basic logic used to make the system arrive at the output. It essentially changes the way the system learns, applies new rules, and corrupts the system to do whatever the attacker wants.

· Data manipulation

In data manipulation (as the name suggests) the attacker manipulates the data to extend the data boundaries. This results in backdoor entries that can be exploited later. Unlike logic corruption, the attacker doesn’t have access to the logic, so they work with the existing rule and push data boundaries further with plans to adjust them later.

· Data injection

In data injection, the attacker inserts fake data into the actual data set to skew the data model and ultimately weaken the outcome. The weakened outcome then serves as an easy entryway for the attacker into the victim’s system.

GET THE PROTECTION YOU NEED

The best way to protect yourself from poison attacks (and really any other kind of attack) is to instate monitoring practices and be sure that you have data experts viewing your system outputs. While this might sound like a lot for a small business, Managed Service Providers like us have the technology, processes, and experts that handle this kind of oversight every day. If you’d like to learn more about how we can protect you, just contact us.