Metaverse cyber security: What is the darkverse and what cyber threats can we see?

TrendMicro Researchers posit that a “dark verse” could quickly become a new space for cybercrime and threat actors in the booming metaverse!

The Dark Web is currently where threat actors meet and coordinate illegal activities with impunity. On the dark web, you can expect to find underground marketplaces, sellers, and illegal services for sale.

Udo Schneider, IoT Security Evangelist Europe at TrendMicro said: “The Metaverse is a multi-billion dollar high-tech vision that will define the next internet age. While we do not know exactly how it is evolving, we need to start thinking now about how it can be exploited by threat actors and how we can meaningfully protect our society. Given the high cost and legal challenges, law enforcement will struggle to monitor the Metaverse for the first few years. The IT security industry must intervene now or risk a new Wild West developing on our digital doorstep.”

As the metaverse grows and becomes a brand-new virtual landscape for digital surfers, threat actors will be hoping for the birth of a “darkverse” – a metaverse world that protects criminal communities and is a virtual haven for threat actors.

What is the darkverse?

As the dark web facilitates web-related crime, the darkverse will facilitate metaverse related crimes. This will extend to and beyond financial hacks, e-commerce fraud, NFT theft, bitcoin hacks, ransomware attacks and more.

TrendMicro researchers are highlighting the importance of darkverse focus because they believe that cybercriminals will be migrating from traditional dark web forums to darkverse spaces, as they will be inaccessible to law enforcement agencies and come with far more obstacles for law and order.

“Instead of meeting in underground forums, criminals will be able to virtually walk into metaverse dark web markets,” says TrendMicro.

What cyberthreats can you expect in the metaverse/darkverse?

• NFTs (Non-fungible Tokens) hacks: At first, NFTs were positioned as the unhackable solution to owning your own art and creations. We now know that this is not true. NFTs, much like any digital file, can be hacked and stolen, no matter how decentralised they purport to be. NFTs are becoming increasingly popular methods of defining property in the Metaverse and are therefore increasingly targeted by phishing, ransomware, fraud, and other attacks.
• Lack of law and order regulations: It is difficult to ascertain when law enforcement can get involved and monitor a potential darkverse. By the time police or regulatory bodies get their hands on metaverse security, will the darkverse already be too big a beast to wrangle? It could be years before the police can operate effectively in a metaverse. TrendNitro researchers claim that “even if law enforcement agencies (LEA) are aware of these spaces, they would be unable to infiltrate them without authentication tokens. Users of the darkverse could also implement location-based messages as well as proximity messages for metaverse spaces. This would make it extremely difficult for LEA to intercept exchanged communications."
• Manipulating metaverse markets: Another form of crime is money laundering using overpriced Metaverse virtual real estate and NFTs. We have seen, in recent months, popular NFTs be sold for ridiculous amounts only for the NFT brand to tank in value hours post-sale due to shorting and stock dumping. This is becoming an increasingly common market manipulation tactic.
• Immersive social engineering: Social engineering, propaganda and fake news have profound implications in a physical world. They have an even bigger impact in the digital world. Now, imagine how impactful social engineering and fake news tactics will be in a virtual world. Criminal and state actors will use influential narratives and even deepfake technology to reach and trick vulnerable and metaverse users.
• Privacy issues: Privacy in the metaverse is a whole new ballgame. Who holds your data? Is it decentralised like the Web 3.0 services is aims to mimic or do companies like Meta now hold user data such as the sound of your voice, your body language and even how your face expresses? The operators and providers of metaverses will get an unprecedented insight into the actions of the users. As a result, privacy regulations will need to be revisited and may never be the same again.
• Identity issues: Another problem lies in proving your identity and verifying the identity of others, as bots can easily mimic your style, data, personality, and whole identity. We will need verification methods like facial scans, retina scans, and voice recognition for authentication. This may also lead to innovations in identity verification services.

What the darkverse means for the future of the metaverse

Dr Moataz Bin Ali, Area Vice President and Managing Director, MEA for TrendMicro said: “We have witnessed an accelerated stage of evolution in technology, with the metaverse providing a new dynamic to how we see the world. Even though there has been a healthy progression, we are still in the early phases of incorporating the experiences of the metaverse into our daily lives. The unpredictability of the modern digital era has prompted us to take a proactive approach and prepare for malicious actors who are seeking to exploit vulnerabilities in the metaverse.”

A proactive approach is the only way individuals and organisations can stay savvy and safe in the face of such advanced technologies. With more business and commerce moving to the metaverse, your employees and colleagues need to be aware of the threats they face and how cybercriminals are operating on the platform.

The hope is that if you stay up to date and aware of the cyber risks and threats, as well as how they may be presented, you not only give employees the ability to spot them but also the knowledge and understanding on how to report and deal with cyberattacks in the metaverse.

There is also hope that as metaverse technology continues to advance, we will see a new protection layer or metaverse security software pop up to keep users safe from the threats of the darkverse. However, until such a day when preventative software is made, the onus of organisations and individuals to take proactive steps and measures to keep threat actors away from valuable virtual spaces and organisational data.

We at TSC are always hammering home the mantra that new cybersecurity threats are always emerging, innovating, and waiting to pounce. .

If you would like more information about how The Security Company can help deliver security awareness training, raise awareness, increase security skills, and establish a secure culture, or how we can run a behavioural research survey to pinpoint gaps in your security culture, please contact  Jenny Mandley.