Over a couple of days in February, hundreds of thousands of point-of-sale printers in restaurants around the world began behaving strangely. Some churned out bizarre pictures of computers and giant robots signed, "with love from the hacker God himself."
Some informed their owners that, "YOUR PRINTER HAS BEEN PWND'D". Some told them, "For the love of God, please close this port." When the hacker God gave an interview to Motherboard, a technology website, he claimed to be a British secondary-school pupil by the name of "Stackoverflowin." Annoyed by the parlous state of computer security, he had, he claimed, decided to perform a public service by demonstrating just how easy it was to seize control.
Not all hackers are so public-spirited, and 2016 was a bonanza for those who are not.
In February of that year, cyber-crooks stole $81 million directly from the central bank of Bangladesh — and would have gotten away with more were it not for a critical typo. In August, the U.S. National Security Agency saw its own hacking tools leaked all over the internet by a group calling themselves the Shadow Brokers.
In October, a piece of software called Mirai was used to flood Dyn, an internet infrastructure company, with so much meaningless traffic that websites such as Twitter and Reddit were made inaccessible to many users. And the hacking of the Democratic National Committee's e-mail servers and the subsequent leaking of embarrassing communications seems to have been part of an attempt to influence the outcome of the American elections.
Away from matters of great scale and grand strategy, most hacking is either showoff vandalism or simply criminal. It is also increasingly easy. Obscure forums oil the trade in stolen credit-card details, sold in batches of thousands at a time. Data-dealers hawk "exploits": flaws in code that allow malicious attackers to subvert systems.
You can also buy "ransomware," with which to encrypt photos and documents on victims' computers before charging them for the key that will unscramble the data. So sophisticated are these facilitating markets that coding skills are now entirely optional. Botnets — flocks of compromised computers created by software like Mirai, which can then be used to flood websites with traffic, knocking them offline until a ransom is paid — can be rented by the hour. Just like a legitimate business, the bot-herders will, for a few dollars extra, provide technical support if anything goes wrong.
The total cost of all this hacking is anyone's guess (most small attacks, and many big ones, go unreported). But all agree it is likely to rise, because the scope for malice is about to expand remarkably. "We are building a world-sized robot," said Bruce Schneier, a security analyst, in the shape of the "Internet of Things."
The IoT is a buzzphrase used to describe the computerization of everything from cars and electricity meters to children's toys, medical devices and light bulbs. In 2015, a group of computer-security researchers demonstrated that it was possible to take remote control of certain Jeep cars. When the Mirai malware is used to build a botnet it seeks out devices such as video recorders and webcams; the botnet for fridges is just around the corner.
"The default assumption is that everything is vulnerable," said Robert Watson, a computer scientist at the University of Cambridge.
The reasons for this run deep. The vulnerabilities of computers stem from the basics of information technology, the culture of software development, the breakneck pace of online business growth, the economic incentives faced by computer firms and the divided interests of governments. The rising damage caused by computer insecurity is, however, beginning to spur companies, academics and governments into action.
Modern computer chips are typically designed by one company, manufactured by another and then mounted on circuit boards built by third parties next to other chips from yet more firms. A further firm writes the lowest-level software necessary for the computer to function at all. The operating system that lets the machine run particular programs comes from someone else. The programs themselves from someone else again. A mistake at any stage, or in the links between any two stages, can leave the entire system faulty — or vulnerable to attack.
Most hackers lack the resources to mess around with chip design and manufacture. But they do not need them. Software offers opportunities for subversion in profusion. In 2015 Rachel Potvin, an engineer at Google, said that the company as a whole managed around 2 billion lines of code across its various products. Those programs, in turn, must run on operating systems that are themselves ever more complicated.
Getting each of those lines to interact properly with the rest of the program they are in, and with whatever other pieces of software and hardware that program might need to talk to, is a task that no one can get right first time.
Careful checking at big software companies, he said, can push that down to 0.5 per 1,000 or so. But even this error rate implies thousands of bugs in a modern program, any one of which could offer the possibility of exploitation. "The attackers only have to find one weakness," said Kathleen Fisher, a computer scientist at Tufts University in Massachusetts. "The defenders have to plug every single hole, including ones they don't know about."
