The days when massive firewalls protected us are over

Scientists Tibor Jager and Malte Mues on cyber-attacks, AI and the near-total dependence of digital Europe

“We always imagine a hacker to be someone wearing a ski mask, sitting in front of their computer and attacking other systems via the internet,” says Prof. Tibor Jager, Head of the Chair of IT Security and Cryptography at the Faculty of Electrical Engineering, Information Technology and Media Technology at the University of Wuppertal; yet it is not quite that simple, he explains, because first and foremost, these are always programmers who, even with good intentions, are capable of using technology creatively. As stated in the statutes of the Chaos Computer Club (CCC):“Europe’s largest hacker association(…) acts as a mediator in the tension between technical and social developments, (…) champions and promotes the joy of technology and lives by the principles of hacker ethics”. “Asa rule, malicious hackers exploit security vulnerabilities that they have either discovered themselves or purchased on the black market, ”says Jager, adding, “but there are also people within the intelligence services who buy into such vulnerabilities.” It is always difficult to predict where malicious attacks come from, as this cannot be deduced from the data alone. However, by analysing the timestamps or the tools used – from which it might even be possible to identify source code – it is often possible to identify the perpetrators through detective work. “These can be lone actors or state-sponsored groups.”

Social engineering – People as the starting point for cybercrime

Jager broadens the definition of a hacker and gives an example: “If you want to meet a previously unknown person for an interview and another person finds out about it, they could theoretically arrive 15 minutes early, pose as the person in question and, as their first question, ask the interviewee about the potentially secret research project. That’s what’s known as social engineering.” (Social engineering is the psychological manipulation of people to persuade them to disclose confidential data, bypass security measures or carry out financial transactions, editor’s note). As if that weren’t enough, there are also hackers who, for example, target smartcards or keys that can be used to unlock other people’s offices. Prof. Malte Mues, Assistant Professor of Reliable Software and Distributed Systems at the University of Wuppertal, confirms that this form of social engineering is increasingly coming under the spotlight in companies, as people are still the weakest link in the system. Changing passwords more frequently and recognising phishing emails are the first steps in tackling this. “In our research, we focus more on technical methods that genuinely secure systems against attacks where people try to make technical alterations.” Often, these involve old systems that are still in use or forgotten computers – for example, in a production hall – which are connected to the network via an outdated version of Windows and are tracked down by hackers. “That’s how hackers find their targets. There are always people who search out targets out of boredom, because it’s not just organised state actors, but very often people who are simply trying things out,” explains Mues.

Bypassing security barriers

“Programming errors are the most common reasons why a hacker gains access to a programme, and the possibilities are incredibly varied,” says Jager. Protective mechanisms such as passwords or digital signatures – where, immediately after they are entered, a piece of code checks that everything is in order – are logical mechanisms, but they too can contain programming errors that a hacker could exploit to gain access to the programme. Then it’s just a matter of time and using the right software to have a look around the target computer. “Passwords were a popular method for a long time, but they’re not so popular anymore because people usually have a strong password and use it across all other platforms,” says Mues, adding: “Spotify lost a lot of user accounts a few years ago due to a hack, and they all resurfaced on the dark web. And if I search through these accounts, I can also find out the password that was used back then, log in to other sites and cause damage. There’s a list of common passwords that’s publicly available. One password that’s extremely popular on these lists is ‘1-2-3’ – that offers no protection whatsoever.” Anyone who wants to check whether their email has already been hacked can do so. “There’s a website called https://haveibeenpwned.com/. I can enter my email address there and then see whether my login details are included in such leaks, and when and on which list my passwords have already appeared,” says Mues.
Another method is what’s known as voice cloning (voice cloning is a computer programme designed to mimic voices; it uses artificial intelligence to copy a human voice from audio samples so realistically that it’s almost indistinguishable from the real thing – Ed.). Jager comments: “There have already been cases where petrol stations were robbed because a hacker phoned new staff members, posing as the boss, and got them to reveal the codes for the Apple Pay cards.” Mues confirms that there is still a lot of work to be done in many places, as a great deal of information is still transmitted over the telephone.

Finding the loophole in systems… and slipping away undetected

Malware or Trojans are usually installed on third-party systems when hackers manage to find a vulnerability in an existing system. “You then exploit this vulnerability to gain the necessary permissions to carry out an action,” explains Mues, citing a recent example. “In May, the security vulnerability in Linux systems known as ‘Copy Fail (CVE-2026-31431)’ caused quite a stir, as it enabled local users to quickly gain elevated privileges. We call this privilege escalation. Users with restricted access rights were suddenly able to take control of systems or even steal data.” Normally, the Linux operating system has a rights management system in place, but with this piece of software – which had been lying around for 10 years – someone was suddenly able to gain arbitrary rights on a server to which several people had access and do whatever they wanted. “So even years later, you discover system content that can be used in ways other than originally intended.” The situation is similar when you send someone a PDF containing malware. If you open this PDF file, it can execute code that it wasn’t actually supposed to run. Often, a single faulty line is enough for a hacker to exploit. “An incredible amount happens on a computer,” emphasises Jager, “you simply can’t log it all. Systems have log files in certain places, such as authentication logs. If I, as an attacker, find them, I can delete them and nobody will be able to trace that I was in the system at all.” Mues adds: “Once I have full control over the computer, I also determine what’s on it, what the files look like and what the hard drives look like. Then I can put them in any state I like – including deleting them.”

Hacking methods are changing

When asked about the most common hacking methods, Mues explains that there has now been a shift in approach. “In the past, these were concentrated campaigns, where a company would be attacked for several days. Nowadays, these attacks are carried out over a longer period because monitoring has also improved. You create a log and can view it straight away, so you can spot anomalies or unusual user behaviour more quickly. So I no longer attack a company all day long, but wait for a while after an attack so that the monitoring systems might indicate that everything is back to normal, and then launch the next attack.” Thanks to AI systems, the time factor no longer plays a role. This means an attacker can trawl through the internet and see what happens.

The good and the bad hackers, and the complex legal landscape

Not every hacker is a criminal. The industry distinguishes between black-hat hackers, white-hat hackers and grey-hat hackers. Mues explains: “Black-hat hackers are, I think, the simplest category to understand here. These are people who have malicious intent and attack companies because they want to take them down. However, there are also people who try to protect the company and who test its defences. These are often people who are well-versed in social engineering and who use their knowledge for the benefit of the company. They’re called white-hat hackers.” “We even have a white-hat hacker team here at the department,” laughs Jager, “they’re students who enjoy getting creative with technology. They try to understand how hacker attacks work, purely to learn. Often, you only really understand what your own computer is doing when you ask yourself: ‘What would happen if I tried a different approach here? ’ It’s a voluntary hobby project; they network with one another, and we also adhere to hacker ethics – that is, no attacking other people’s systems without consent, only looking at what’s been agreed.” “Grey-hat hackers,” continues Mues, “are all the hackers in between.” And this grey area is quite narrow, he adds, as the legal situation in Germany is less than ideal. His colleague confirms this and explains: “What’s really unfortunate in Germany is that there is, for example, the so-called ‘hacker clause’ – Section 202c of the German Criminal Code (StGB). It states that no distinction is made between those who discover security vulnerabilities and report them in good faith, and those who discover them and exploit them maliciously.” The problem, Mues explains, is that if someone is searching the internet on behalf of a client, they might find something they weren’t even looking for, but would then unwittingly be committing a criminal offence. Merely scanning for information is already considered a criminal offence. “So even white-hat hackers who follow this process are living dangerously.” If, on top of that, the case is heard by a judge who isn’t tech-savvy, the situation can become critical.

No backup – no mercy

Secure systems are built differently today than they used to be, explains Jager, using the example of a house of cards. “If I imagine that the university’s entire network structure looks like a house of cards, my approach today is to use as many cards as possible and build as sturdily as possible, so that I can remove cards here and there without the house collapsing. That’s the modern approach; that’s how IT systems should be built today.” In the past, he explains, the house of cards was built with as few cards as possible, a large fence was erected around it, and people hoped that no one could get past it. If they did, however, removing even a single card would cause the house to collapse. Security is therefore the top priority, and there are always examples of how not to do it. In Romania, a hacker recently paralysed the entire property market. He broke into the land registry’s network and subsequently attempted to blackmail the authority with the data he’d stolen. When that failed, he deleted the country’s entire land registry database. Jager is ruthless on this point and, as an expert, says with a wink: “No backup, no mercy!” and then continues: “You have to consider that there was an important database there. Nowadays, you simply have to reckon with the possibility that at some point, someone will gain access to it and launch an attack. Completely securing such a large system is certainly a hopeless task. But of course you have to ask why there was no backup copy, and why this backup copy wasn’t stored somewhere out of the hacker’s reach.” For many decades now, it has been standard practice for important data to create very careful backup copies, disconnect them from the network and store the copies in a safe, for example. In the case of particularly important data – for example, at banks – copies are normally even stored at different locations, geographically far apart from one another. There is also the option of cleverly dividing data in such a way that part of it could fall into the hands of attackers without them being able to make any use of it. The technology for this is now available. “Our start-up utilacy, which grew out of my department, has also developed a technique for splitting data across three, four or five different systems,” says Jager. “Combined with the usual security measures, this is the strongest protection that can currently be achieved technically. And it’s also relatively straightforward.”

A centralised system for 80 million people?

There will always be cyber-attacks, but there are also ideas on how to better ensure protection. Mues is thinking, for example, of administrative structures. “I believe that administration in Germany is also organised in a very decentralised way. We’re only just beginning to centralise everything, but at the moment the situation is such that every district and every small local authority is paralysed for a long time if it comes under attack. If I were to centralise all of this now and pack it into a data structure stored in a database, then we’d finally have a unified system for 80 million people, where I could really make a difference. I don’t have to set up separate IT centres for 100 districts that I’d have to deal with; instead, I consolidate them into one large infrastructure. Then I’ll have one or two attractive targets, and they’re bound to come under a lot of attack. There’s this Telecom Security Monitor (https://sicherheitstacho.eu) and we’re detecting an average of two million attacks per hour.” As there is a baseline level of attack traffic anyway, it makes more sense to focus attention on one large, attractive target that can be defended. The same applies to cloud systems (a cloud system stores data and computing power not locally on a computer, but on external servers on the internet, editor’s note). “We need to become more aware of this and build up more expertise,” adds Jager, “and that has to be done properly and also costs money. But if you cut corners on security and then come under attack, it will end up being much more expensive.”

AI goes rogue

However, there are now also cyberattacks carried out directly by AI. The US company OpenAI has accepted responsibility for a cyberattack on the AI platform Hugging Face in July 2026. This extraordinary incident highlights the risk of potential cyberattacks carried out by artificial intelligence. During a test run of new AI models by OpenAI, the software independently infiltrated the computer systems of another AI firm. In effect, the AI left its protected environment of its own accord. Jager cannot understand the hype surrounding this news, because “AI is quite good at recognising patterns in complex data, and therefore also at identifying security vulnerabilities in complex data,” explains the expert. “The more powerful AI becomes, the better it gets. The fact that AI is so good at finding security vulnerabilities is also a major advantage, because now anyone can start identifying security vulnerabilities in their own systems and securing them. This also takes the pressure off existing areas of work where people previously had to deal with this intensively. There are experts who say that AI will make our systems more secure because we will no longer have to rely solely on a handful of specialists.” The problem, however, is that most providers – such as OpenAI and the like – are predominantly American or Chinese corporations, and there is no European equivalent. Jager therefore asks: “Why aren’t we putting more resources into this? Including in the field of IT security research! At the moment, we are very heavily dependent on others when it comes to such AI methods.” The technology itself, in any case, is an advantage.

Ending dependencies

Although there is constant talk of the need for sovereign solutions for a digital Europe, says Mues, all the chip labs (semiconductor design laboratories) are based elsewhere. “We buy hardware and software from abroad.” A controversial incident in the United States earlier this year further reinforced the desire for independence. Mues sums it up as follows: “The White House had imposed temporary export controls on advanced AI models such as Fable 5 and Mythos 5, forcing the company to restrict access for foreign users. At the time, this was the best AI available for exploiting security vulnerabilities.” Experts subsequently discussed the possibilities that AI could offer as a potential weapon in the software sector, as well as the question of what would happen if the further development of ChatGPT 6 were no longer accessible to Europe.

Opportunities in cyberspace

In cyberspace, many processes can be digitised, sparing citizens long waiting times at government agencies and businesses. Mues cites registering a car with the Vehicle Registration Authority or applying for and collecting an identity card. “Research works better because these networks exist. However, we must bear in mind that we are now also taking on other technical risks. These risks have been there ever since we’ve had the internet; we’re simply more aware of them today.”
Finally, Jager cites a very successful example of European digitalisation. “A good success story in digitalisation is the Corona Warning App. The first versions of it were very poorly designed, until a team from Lausanne said: ‘This isn’t working; let’s build it properly.’ They then invested time and resources and developed a sound protocol. Fortunately, Apple and Google subsequently adopted their protocol, and everyone else eventually adapted this programme.”

Both scientists are aware of the opportunities and possibilities offered by the sensible use of digitalisation and say: “If we don’t make use of the technologies that are available, we’ll be reading more and more often about cyber-attacks that render companies unable to operate for extended periods.”

Uwe Blass

Prof. Dr.-Ing. Tibor Jager heads the Department of IT Security and Cryptography within the Faculty of Electrical Engineering, Information Technology and Media Technology at the University of Wuppertal.
Jun.-Prof. Dr Malte Mues heads the Reliable Software and Distributed Systems section within the Faculty of Electrical Engineering, Information Technology and Media Technology at the University of Wuppertal