Cybersecurity is the biggest need of the present time, and understanding the role of mathematics in its development is very important. One thing that all computer engineers know very well is that programming algorithms cannot be created without the application of mathematics. Now, in cybersecurity, the work must also be done through algorithms, but to determine what actions these algorithms will take, many mathematical concepts are used. To understand this in depth, we need to understand the different specifications of the complete need.
The applications of mathematics in Cybersecurity are according to our needs. For example, if our need is 'security of transferred data', then encryption and decryption are used for this. For this, modular arithmetic is used. Next, if we talk about password protection, i.e., 'security of authentication', then the concepts of hash cryptography are applied there. Speaking of a hacker's attack, here the attack is directly on the firewall, and for its protection, the concepts of Boolean algebra are used. But the current era is of artificial intelligence, and hackers have also become very expert now. In such a situation, there is a need for very advanced cybersecurity, and this will only be achieved with the help of advanced math. That is why probability, statistics, and calculus are used extensively to design artificial intelligence-based cybersecurity algorithms.
Let’s understand it with an example,
We will discuss the innovation of an antivirus software. Stuxnet, discovered in 2010, was a game-changing piece of malware that targeted Iran's nuclear enrichment facilities. Its complexity forced the antivirus industry to evolve. While it used many of the techniques like cryptography, data analytics, etc., as discussed above, its most fascinating mathematical component was its use of a real, cryptographic hash collision to subvert the system it was attacking. Let’s understand it in detail.
Stuxnet was made to sabotage the centrifuges by making them spin at destructive speeds while reporting to the plant operators that everything was normal. It was done by modifying the code on specific Programmable Logic Controllers (PLCs).
However, these PLCs had integrity checks. Before loading any new program, the system would verify its digital signature to ensure it came from a legitimate source and hadn't been tampered with. Now, forging a legitimate digital signature is mathematically infeasible (based on the difficulty of factoring large prime numbers in RSA cryptography).
So, the Stuxnet attackers found a different mathematical solution for it. They discovered that two different PLC projects could be made to produce the same cryptographic hash. This is known as a hash collision. Using advanced mathematics, the attackers were able to create a malicious project that, when passed through the MD5 hash function, produced the same hash value as the legitimate, signed project.
Now the cyber attack started in the following manner,
Stuxnet infiltrated the plant's network and located the computer used to program the PLCs. It intercepted the communication. When the operator sent the legitimate, signed project to the PLC, Stuxnet swapped it with its own malicious project in transit. The PLC received the malicious project and performed its integrity check. It calculated the MD5 hash of the project it just received. Because of the mathematical collision, the hash of the malicious code was identical to the hash it expected from the legitimate code. The PLC, trusting the hash, verified the code as authentic and loaded it. The malicious code was then executed, causing the centrifuges to tear themselves apart while simultaneously sending "all clear" signals back to the control room.
The role of Mathematics for Antivirus:
Stuxnet was a watershed moment. It demonstrated that a purely hash-based, signature-based approach to security is fundamentally vulnerable if the underlying mathematics of the hash function can be broken. It didn't attack the antivirus directly; it targeted a system that used hashing for trust, and it succeeded.
This event accelerated the antivirus industry's shift away from relying solely on simple signatures and towards the more robust, mathematically complex methods mentioned earlier (heuristics, behavioral analysis, and machine learning), which would have a better chance of detecting Stuxnet's anomalous behavior, even if its code passed a simple hash check.
0 Comments