Security risks that lurk deep inside the Metaverse

Soma Tah & Ashok Pandey

As the world of metaverse is still unfolding before us in layers, we don’t know about the potential risks or security loopholes yet. Although we can use existing techniques to protect ourselves in the metaverse, it may not be sufficient to thwart attacks that have never been seen before. 

The growing dependence on advanced digital technologies to transform work and leisure have expanded the cyber attack surfaces leaving individuals and organizations exposed to greater cyber risks and many expressed concerns that the situation is likely to get out of hand as people and businesses start discovering new ways to collaborate, interact, trade, buy, and work in the metaverse world. 

Digital world has internet-based applications to make our life easier and the metaverse has potential to become a transformative medium for human engagement. It can enhance our digital experience and engagement further by bringing virtual, 3D environments and immersive technologies together. Users can navigate this online world similar to the way we traverse the real world but with digital avatars. With the concept of metaverse becoming a reality, the lines between digital and physical spaces will become even more blurry. But what could be the downsides? 

Vulnerabilities and security loopholes that are likely to plague the metaverse

Because of its infrastructure, the metaverse is expected to bring totally new cybercrimes, in addition to the usual phishing, malware, and hacking. First, cybercriminals will have plenty of possibilities thanks to the metaverse’s personal nature and the data it generates. VR headsets and digital avatars provide a more intimate look into users’ real life than anything that could be shared on social media. Second, the AR/VR devices that power the metaverse collect a huge amount of personal user data such as biometric information, which opens a window for potential cyber hacks/attacks. As the metaverse evolves. the risks to the user data will also increase manifold. Third, technologies that are powering the metaverse will require robust IT devices and their firmware, and hence, these are the most critical areas for cybersecurity. 

Cryptocurrencies and non-fungible tokens (NFT) are widely used in the metaverse, and they might be appealing targets for cybercriminals for a variety of reasons. Pramod Sharda, CEO, IceWarp India & Middle East said, “Monitoring and defending attacks in the metaverse will not be simple. Cryptos/Virtual currencies and NFTs will be used largely leading up to crypto phishing attacks, crypto jacking for fraud, thefts, as attackers’ identity can no longer be traced for such transactions.” Vulnerable VR headsets causing privacy issues for metaverse users is another concern, he said. 

Vivek Sharma, MD- India, Lenovo Infrastructure Solutions Group (ISG) explained the issue in detail. “Metaverse relies on IT infrastructure along with external devices such as VR headsets to allow virtual access. While organizations are continuing to strengthen the end-point security, the challenge of securing IoT-based devices is an added pressure on the IT and requires a security best practices overhaul. Unprotected devices can compromise not just individual identity; but also lead to ransomware, business data breach, and in some cases physical threats.”  

Researchers have indicated some potential malicious cyber activity that’s only possible in an immersive virtual setting such as eavesdropping or complex social engineering attacks. “AI-based synthetic content such as Deepfake and social engineering threats are among the biggest risks posed by the digital world and metaverse as of now. Exploitation of Metaverse environments by hackers, companies and in some cases adversary states pose a big threat to individual privacy, corporate information and intellectual property espionage,” said Anand Naik, Co-founder and CEO, Sequretek. 

Experts even warned that disruption in digital security owing to innovations in the Metaverse could have far-reaching consequences due to the multisensory nature of the environment. According to Rahul Mahajan, CTO, Nagarro, “Metaverse experiences are designed to be immersive and close to reality, the digital security risks that occur in such an environment are a real threat as well. Security incidents in the metaverse hence are exacerbated, leading to extreme human responses.”   

How do you protect yourself in the relatively unknown world of metaverse? 

So, is there a way to keep cybercriminals out of the metaverse? Well, the answer is ‘No’. In fact, in a digital realm, it will be more difficult to identify bad actors, thus making the legal recourse even more difficult for victims.  

“For the Metaverse, the security challenges are heightened due to the level of valuable personal data that users might potentially share digitally. These can include biometrics and personal and financial data to create a ‘digital self’ within the Metaverse. At the same time, the data will be shared in real-time, making it difficult to determine exactly what personal data is shared, with whom, for what purpose and when it is destroyed. This makes it difficult for users to exercise control over their data,” explained Sidharth Pisharoti, Regional VP,  India, SEA & APJ Carrier, Akamai Technologies.   

Piyush Jha, SVP, Strategy & Technology APAC, GlobalLogic said, “The traditional approach towards security cannot work in the new digital world. Understanding the risks inherent in online activity and deploying the right cybersecurity resources to protect yourself and your organization is key to remaining cyber resilient in this new age. Security should be an integral part of the business requirements rather than technical and compliance requirements only.” Organizations must take a security-and-privacy-by-design approach when building products for the metaverse. 

Serge Gianchandani, CEO & CPO, MetaMall said, “We feel that metaverse can be made very secure with the right choice on tech and protocols. It is important to secure both platform and user data security. Following both privacy by design and privacy by default methodology are a must. Wherever it is not necessary, default is masking the user details and allowing the user to configure his privacy settings. Strictly maintaining protection and testing against all top 10 OWASP vulnerabilities, following encryption of all information at rest and transit, and strict data access and password policy between servers and for clients are some of the things businesses should keep in mind, while embracing the metaverse world.”   

Prof. Mohan Ram C, Adjunct faculty, IIIT Bangalore said, “As it stands currently, new technologies like VR, AR, etc., come with security as an afterthought, not built by design. This needs to change as security must be considered as part of the coding stage itself. Our application and software developers must also remain cognizant of the importance of cybersecurity measures as they create new applications in the Digital world and Metaverse. Companies developing the applications for Digital World and Metaverse must invest in training their staff in development, with a 360-degree cyber threat perspective as well as methods/tools to avoid the common pitfalls in the coding.”

“The metaverse heralds the beginning of a new era in technology. While the notion is laudable and has found applications in IT, gaming, and fashion, it is built on disputed AI technology, the authenticity of which is dependent on the designer. Consumers are silently voicing their concerns about cryptocurrency’s fragility, the insecurity of IoTs and wearables, and the transparency and ethics of AI,” cautioned Apu Pavithran, Founder & CEO, Hexnode and Mitsogo. Time will tell how far we have progressed in preparing for the metaverse, said he.  

Sooner or later, the need to construct a secure and trusted technology ecosystem for the metaverse is going to be a critical consideration for the metaverse early-movers, which will also help in building structures, algorithms, frameworks, regulations, and policies within hardware and software development cycles to address the elements of safety, privacy, and security within the DNA of the technology, suggested experts. Importantly, government, academia, industry, and civil society decision-makers all must collaborate and deliberate on the various issues concerned with security in this emerging technology. 

Also Read: 

https://www.pcquest.com/evolving-cyber-threat-tactics-keeping-businesses-individuals-alike-toes/