Bomb threats in Italian schools: prank or hybrid war? The real risk is cyber

About an hour ago the nursery called me: I had to go and pick up my son, the youngest. Apparently the bomb threat was sent to every school in Italy. Luckily I live close by. The older one is somewhere else and had no problems today.

Hybrid war or prank?

Everyone is talking about hybrid war: threatening emails from Russia, actors nobody can name. Honestly, I don’t know, and I can’t know.

To me it sounds more like something sent at random that nobody can afford to ignore. It reminds me of the school occupations back in high school, when the anonymous phone call came in: “there’s a bomb”. Very risky, by the way, because they catch you anyway.

So, if I had to bet, I’d say prank. Which may then get exploited politically. But that’s not the point of this post.

This is just the beginning

Saying “there’s a bomb in the school” is a stupid trick, but it works: fear, kids to take home, disruption, police who actually have to check. And yet, if this is where things are going, it’s the least of our worries. Other kinds of attacks will come, the real ones.

Italian cybersecurity is a one out of ten

The average cybersecurity of the companies I’ve worked at is very, very low. In the attacks on public and private companies I’ve seen, the security level was one out of ten. In the anonymous reports from the people who then sold the data on the black market, it said more or less: getting in was easy, like pushing a door open.

That doesn’t surprise me. I’ve seen unpatched software that lets you walk right in at several companies. And I’m talking about before AI.

The company server that became a spam mailer

I remember a company (the partners will remember too, if they’re reading) where the company server had turned into a spam mailer.

We noticed because our emails were landing in our customers’ spam folders. What’s going on? Someone had got in and installed a mail server on it. Phishing and other junk went out from there, and whoever sent it didn’t get caught, because the compromised server was ours. It’s a kind of botnet: to find the culprit you have to figure out who got into that machine. It can be done, if the traces weren’t wiped properly, but I don’t think it was done there.

That was about ten years ago.

With AI, attacking is even cheaper

Imagine now. GPT, security-specialised models, even the open ones that have been made a bit “nastier”: they find vulnerabilities and attack vectors by the dozen.

What does that mean? That the chance of being hit by a cyber attack right now is very high, because the effort needed to pull one off has collapsed. Just like software in general: writing it has become much faster and easier, so a lot more of it gets made. We’ve all seen the examples, like Photoshop rebuilt with AI. Quality isn’t the point: the point is that it gets done. And with a bit of skill it becomes good quality too.

The real attacks will be cyber

So: the bomb email to schools is, for me, a prank. But I think hybrid attacks will really come, and they’ll be much more worrying cyber attacks. From cryptolockers everywhere to compromised infrastructure.

We’ve already seen hackers defrosting freezers. That’s just a first example. There will be many more.

What I did: VPN and updates

I know, it sounds alarmist. What can you do? Not much.

I have a server at home. I took almost everything off the internet, apart from a few things, and put it behind a VPN. It’s a bit less convenient, I had to set up my phone and my wife’s, but it raises my security level by a step, and a pretty big one.

Sure, with AI someone could find holes in the VPN I use too. But maybe not. I keep everything up to date, and I’m not an exposed person: unless someone targets me specifically, right during an update, I have no reason to worry too much.

Learning to use AI

For the rest: watch, wait, stay informed. And learn to use AI.

Using it is like training a muscle in your brain: you train the ability to work with these systems and you get better at the things you usually do. That’s an asset worth having.

And let’s see where this goes. What do you think, prank or hybrid war? Tell me in the comments on the video (it’s in Italian).