Matrix vulnerabilities

The Matrix trilogy (The Matrix, The Matrix Reloaded, The Matrix Revolutions) told of the successful implementation of the metaverse before the idea went mainstream. The creator of this virtual world (or, rather, neural-interactive simulation), we learn, was an artificial intelligence that once defeated and enslaved humanity. The process was not without bugs, which brings us to today’s topic.

For starters, between the limited data human characters have and the constant misinformation from the AI, viewers never know precisely what’s true, or how realistic their view of the world is at any given moment.

But we are not interested in philosophical subtext here; our focus is on information security, so we will rely on what are considered the established facts at the end of the third movie. Spoiler alert for anyone who hasn’t watched the whole trilogy but intends to.

Fighting the Zion Resistance

At the trilogy’s finale, it becomes clear that the struggle with rebels infiltrating the Matrix is all staged. For the latest cycle of rebellion to succeed, the Matrix needs a certain number of external enemies, so we don’t know for sure whether the agents are really trying to catch Morpheus and his team, or if they’re just simulating a frenzy of activity. From a cybersecurity perspective, it’s not clear whether we’re seeing bugs or features — a design flaw or something deliberately introduced into the Matrix (perhaps as a sort of honeypot).

Pirate signal from Resistance ships

The Matrix’s population consists of avatars of enslaved humans who are wired to the system, and of programs that originally existed in the form of code. Why remote broadcasting of signals from outside the system was initially implemented, allowing third-party avatars to be uploaded, remains unclear.

Such anomalies are usually a result of some sort of debug access that someone forgot to close, but in this case the developers were not human, so that explanation doesn’t fit. Anyway, even if they implemented remote connection on purpose — if it was a feature, not a bug — why didn’t the auto-programmers implement a firewall to block any pirate signals?

Uncontrolled avatar transmission system

Inside the Matrix, pirate avatars can appear and disappear only through phone cables (although how mobile and landline phones differ inside a virtual reality framework is not explained). Moreover, Matrix agents are, in principle, able to deactivate the line — at least, they cut it when Morpheus was captured. But if it is so critical for Matrix infiltration and exfiltration, why don’t the agents ban it, or at least disable it throughout the operation zone?

Incomplete addressing system

Despite the objective need for such information, the Matrix lacks precise location data for each specific object inside virtual reality. We can assume that pirate avatars are able to hide their location in virtual space, but to stay on the tail of the still-connected Neo in the system, agents needed an additional tracking device. There’s obviously a fault in the addressing system.

That raises questions about Morpheus’ notorious red pill. In his words, it is a tracking program “designed to disrupt your input/output carrier signals, so we can pinpoint your location.” Why isn’t the Matrix monitoring for such anomalies? Being able to intercept the “rescue team” seems pretty important.

Artificial constraints on Matrix Agents

Matrix agents are AIs that can temporarily replace the avatar of any human connected to the system. They can violate the conventional laws of physics, but only up to a point. The twins from the second part of the trilogy are far less impeded by physics, so why can’t such conditional constraints be lifted, at least temporarily, during the operation to capture perpetrators?
Adding to the mounting errors in their code, for some reason agents have the ability to disconnect from the Matrix information system simply by removing their earpieces, a clear vulnerability if ever there was one.

Zion mainframe codes

The whole point of the machines’ hunt for Morpheus in the first movie was to gain the access codes to the Zion mainframe, which every captain knows. That raises a host of questions about why the person with the access codes to the rebels’ critical infrastructure would also be the one who goes into the Matrix.

That point is especially strange if one recalls that there are people on board without any interface for connecting to the Matrix. Entrusting valuable information to them would obviously be far safer. It’s a misstep by the liberated humans, plain and simple: equivalent in today’s real world to attaching a sticky note with passwords to your monitor and then giving a TV interview with it in the background.

Rogue software

For some reason, the Matrix is unable to effectively get rid of programs that are no longer required. Lurking deep inside are various smart apps from old versions of the Matrix: information smugglers, semiphysical militants, a program called Seraph that defines its function as “I protect that which matters most” (a predictable slogan for any information security company).

According to the Oracle, they should all have been removed, but instead they chose to disconnect from the system and live autonomously inside the virtual reality. The existence of uncontrolled obsolete software is a clear vulnerability, just as it is in real life. They literally help hackers attack the Matrix!

Software smuggling

Some programs exist exclusively in the “world of machines” yet can be smuggled in to the virtual world of the Matrix, which human avatars can inhabit. The ability to bring in such programs highlights some serious system segmentation issues. In particular, a direct communication channel should not exist between two segments designed to be isolated.

Backdoor corridor

Among the exiles is the Keymaker program, which creates keys for backdoors. We don’t know to what extent the Keymaker actually is an exile — perhaps he, like the Oracle, is part of the system to control the rebels through the Chosen One. Not only does the Keymaker cut access keys using a file and a lathe, but it also informs hackers of the existence of a whole corridor of backdoors granting access to different parts of the Matrix, from the Core Network to the Source, the heart of the system. Both the Keymaker and the corridor pose a fundamental security threat to the entire system, especially considering how it’s protected against outsiders.

The main problem with the corridor’s security is that for some reason it exists according to the notional laws of the virtual world, depending on emulated power plants (that do not actually produce power) and computers at these virtual stations. And these laws in the Matrix, as we know, are notoriously easy to break. Even putting an agent in the corridor would be more effective — so why didn’t they? No money to pay its salary?

Clones of Agent Smith

Matrix agents originally had a feature that let them replace the avatar code of any hardwired human. However, agents have always existed as individual copies. At the end of the first movie, Neo, having acquired anomalous abilities, infiltrates Agent Smith and tries to destroy him from the inside, with some part of the code of Neo’s avatar being transferred into the agent’s code. After that, Smith goes haywire and gains the ability to bypass artificial constraints, both the laws of the physical world and the ban on existing in one copy. In other words, he becomes a full-fledged virus.

By all appearances, Smith is the first virus in the Matrix; otherwise, there is no explanation for why the system has no antivirus solution for tracking software anomalies, isolating and removing dangerous applications that threaten the security of the system. Considering that most of the people freed from the Matrix are hackers, we find that very odd.

Be that as it may, the existence of Smith, now able to copy his code into any avatar or program, serves as an argument in Neo’s negotiations with the AI. In the end, Neo physically connects to the Matrix, allows Smith to “infect” his avatar, connects to the Smith-net, and destroys all of the Smiths.

As a result, the machines agree to a truce, to stop exterminating humans, and even to release those who don’t want to live in the Matrix. But they could have just built a secure operating system from the start, or at least used a reliable security solution in combination with an EDR system capable of tracking network anomalies!