The Jakarta Post
Please Update your browser
Your browser is out of date, and may not be compatible with our website. A list of the most popular web browsers can be found below.
Just click on the icons to get to the download page.
Popular Reads
Top Results
No results found. Please check your search term and try again
Can't find what you're looking for?
View all search results
Popular Reads
Top Results
No results found. Please check your search term and try again
Can't find what you're looking for?
View all search resultsCyber resilience requires fixing Indonesia’s old tech
But a law that responds to cyber-attacks without addressing the governance conditions that made it so damaging will leave the country just as exposed.
Change text size
Gift Premium Articles
to Anyone
Share the best of The Jakarta Post with friends, family, or colleagues. As a subscriber, you can gift 3 to 5 articles each month that anyone can read—no subscription needed!
Set as preferred source
People walk near DayOne data center at Nongsa Digital Park (NDP) on July 20 in Batam city, Riau Islands. Batam has attracted at least 16 new data centers in various stages, despite limited utility infrastrucutre of clean water and electricity. (JP/Fadli)
L
ast week, security researchers at the United States cyber firm Calif disclosed that, using artificial intelligence tools, its team had built a worm capable of hijacking WeChat accounts. The victim did not need to answer the phone or tap their screen. Rather, simply receiving a call was enough. The researchers named it WeWorm and estimated that had it been released rather than responsibly disclosed, it could have reached hundreds of millions of devices within hours.
WeWorm was a proof of concept. Tencent patched the underlying flaw, and there is no evidence that real users were harmed. But the demonstration matters enormously, because it shows what the threat environment now looks like. A small team, working with commercially available AI tools, identified a critical vulnerability in one of the world’s most widely used applications in roughly two days. The complete, self-spreading weapon was ready within a week.
The speed matters as much as the technique. Not long ago, the typical window between a vulnerability being discovered and an attacker exploiting it was around 63 days. That window has now collapsed to roughly five days. Defenders who once had weeks to patch a system now have days.
For a system that is modern, supported and actively maintained, five days is painful but survivable. For a system that is end-of-life, unsupported or simply unrecorded in any asset register, five days is irrelevant because no patch is coming at all. Research by US cybersecurity threat intelligence firm Cisco Talos shows that around 40 per cent of the most actively exploited vulnerabilities in recent periods sit on exactly these kinds of end-of-life devices.
This is the legacy technology problem. At its core, legacy technologies are outdated computer systems, including hardware, that are no longer actively supported or updated by their vendors. Once support ends, security vulnerabilities accumulate and go unpatched, leaving systems exposed to threats their designers never anticipated. More than ageing desktop computers, these include the complex network infrastructure that fuels our very way of communication and daily life. Given the rapid advancement of AI and its incorporation into offensive cyber capabilities, hacking groups can now identify and exploit those vulnerabilities faster than ever before.
A July 2026 report from the Australian Strategic Policy Institute, titled “Past its use-by-date: Turning end-of-life technology risk into national advantage,” highlighted this problem in Australia’s critical infrastructure. Indonesia faces the same challenge and has already lived through the region’s most consequential demonstration. In June 2024, the Brain Cipher ransomware variant struck the Temporary National Data Centre (PDNS), disrupting over 200 public services including immigration processing and airport operations. The ransom demand was US$8 million. Rightfully, the government declined to pay. However, recovery took weeks.
Subsequent scrutiny exposed the governance conditions underneath the attack. Backup use by agencies was optional, and the National Cyber and Encryption Agency (BSSN) confirmed that only around 2 percent of the data at PDNS 2 had been backed up, with budget and procurement constraints cited as reasons most agencies had not established adequate backups. Forensic investigators found that the attackers had attempted to disable Windows Defender in the days before the ransomware was deployed. Later inquiries alleged that BSSN’s security assessment had not been included as a tender requirement for the data center at all.
