Beware the darkverse and its cyber-physical threats

Trend Micro has released a new report warning of a darkverse of criminality hidden from law enforcement, which could quickly evolve to fuel a new industry of metaverse-related cybercrime.

The top five metaverse threats outlined in the report are:

• NFTs will be hit by phishing, ransom, fraud and other attacks, which will be increasingly targeted as they become an important metaverse commodity to regulate ownership.
• The darkverse will become the go-to place for conducting illegal/criminal activities because it will be difficult to trace, monitor and infiltrate by law enforcement. In fact, it may be years before police catch up.
• Money laundering using overpriced metaverse real estate and NFTs will provide a new outlet for criminals to clean cash.
• Social engineering, propaganda and fake news will have a profound impact in a cyber-physical world. Influential narratives will be employed by criminals and state actors targeting vulnerable groups who are sensitive to certain topics.
• Privacy will be redefined, as metaverse-like space operators will have unprecedented visibility into user actions essentially when using their worlds, there will be zero privacy as we know it. 

"The metaverse is a multibillion-dollar hi-tech vision that will define the next internet era," says Mick McCluney, technical director at Trend Micro.

"Although we don't know exactly how it will develop, we need to start thinking now about how it will be exploited by threat actors. Given the high costs and jurisdictional challenges, law enforcement will struggle to police the metaverse in general in its early years," he says.

"The security community must step in now or risk a new Wild West to develop on our digital doorstep."

As imagined by Trend Micro, the darkverse will resemble a metaverse version of the dark web, enabling threat actors to coordinate and carry out illegal activities with impunity.

Underground marketplaces operating in the darkverse would be impossible for police to infiltrate without the correct authentication tokens. Because users can only access a darkverse world if they are inside a designated physical location, theres an additional level of protection for closed criminal communities.

This could provide a haven for multiple threats to flourish, from financial fraud and e-commerce scams to NFT theft, ransomware and more. The cyber-physical nature of the metaverse will also open new doors to threat actors.

Cybercriminals might look to compromise the digital twin spaces run by critical infrastructure operators, for sabotage or extortion of industrial systems. Or they could deploy malware to metaverse users full body actuator suits to cause physical harm. Assault of avatars has already been reported on several occasions.

Although a fully-fledged metaverse is still some years away, metaverse-like spaces will be commonplace much sooner. Trend Micro's report seeks to start an urgent dialogue about what cyber threats to expect and how they could be mitigated.

Questions to start asking include:

• How will we moderate user activity and speech in the metaverse? And who will be responsible?
• How will copyright infringements be policed and enforced?
• How will users know whether they are interacting with a real person or a bot? Will there be a Turing Test to validate AI/humans?
• Is there a way to safeguard privacy by preventing the metaverse from becoming dominated by a few large tech companies?
• How can law enforcement overcome the high costs of intercepting metaverse crimes at scale, and solve issues around jurisdiction?