How Hackers Can Up Their Game by Using ChatGPT
Artificial intelligence, by mimicking the writing style of individuals, can make cyberattacks much harder to detect
3 min
Consumers, beware: AI chatbots like ChatGPT are likely to drive an increase in the use and effectiveness of online fraud tools such as phishing and spear-phishing messages.
In fact, it could already be happening. Phishing attacks around the world grew almost 50% in 2022 from a year earlier, according to Zscaler, a cloud-security provider. And, some experts say, artificial-intelligence software that makes phishing messages sound more believable are part of the problem. AI reduces or eliminates language barriers and grammatical mistakes, helping scammers impersonate a target’s colleagues, friends or relatives.
“This new era is going to be worse than what we had before,” says Meredith Broussard, research director at the New York University Alliance for Public Interest Technology. “And what we had before was really, really bad.”
High stakes
AI chatbots have exploded in popularity, with perhaps the best-known being ChatGPT, developed by the AI-research company OpenAI, a strategic partner of Microsoft. But dozens of chatbots, using what are referred to as large language models, are becoming more widely available and can closely mimic human communication based on data they amass. These models can be used for many purposes, such as helping office workers create routine memos more quickly. But they can also be used by criminals—to defraud victims, for instance, or to spread malicious viruses.
Telltale signs of a phishing attack have long included mistakes in grammar or spelling. But AI can give a phishing attack more credibility—and reach—not just because of its ability to generate fluent, grammatical messages in many languages, but also because of its ability to mimic the speaking or writing styles of individuals.
“The whole point with large language models is their ability to emulate what humans sound like,” says Etay Maor, senior director of security strategy at Cato Networks, a cloud networking and security provider.
Thus, given the opportunity to learn the style in which a certain person writes emails and texts, Maor says, an AI program can be used to mimic communications from a company executive.
“It’s all about trust, and if I can make you think I’m one of you, you’re going to begin to do things with more trust and less skepticism,” says Roger Grimes, a computer-security professional with KnowBe4, a security-awareness training and simulated-phishing platform.
Using AI, Grimes says, criminals can quickly determine industry-specific terms that give them more ability to target companies such as hospitals, banks and fintech.
Targeted campaigns
AI’s usefulness in phishing and spear-phishing attacks doesn’t stop with its ability to mimic authentic human communication. The analytic skills of machine learning can also be useful in determining who best to target in an organization and how exactly to attack them.
Sean McNee, vice president of research and data at DomainTools, an internet intelligence company, offers a hypothetical example. Say an accountant at a company innocently posts on social media about his frustrations with a recent audit. AI could determine the accountant’s peers, his company’s reporting structure and who else at the company might be most susceptible to an attack. The attacker then could create a spear-phishing email purporting to be from the chief financial officer referring to a discrepancy in the audit and asking the recipient to open an attached spreadsheet that contains a virus.
Ramayya Krishnan, dean of Carnegie Mellon University’s Heinz College, recommends being proactive to protect against such attacks.
First, before acting on something, he says, people should always verify the legitimacy of the request through independent means. This means before clicking on a link or sending money, the recipient should call the individual through a familiar phone number or walk into the person’s office to confirm the request, Krishnan says.
Maintain a healthy dose of skepticism for everything you receive, Maor says. Ask yourself, why is my bank emailing me? Why is there a sense of urgency? Why is there an attachment to click on? It’s also advisable to hover over a link before clicking to see if it leads to an expected URL. “If you have some reason to think something is amiss, don’t click on it,” Maor says.
Other guardrails
Strong regulation of AI could also help, says Broussard, who is also an associate professor at the Arthur L. Carter Journalism Institute of New York University.
AI itself should also be enlisted to help identify malicious content with its origins in AI, says Dave Ahn, chief architect at Centripetal, a cybersecurity company. But first the models for doing so will have to evolve and the data will have to improve. Data on successful AI-based attacks will help cybersecurity experts train new models to identify malicious activity better, says Ahn.
Other possible security measures include giving users a way to distinguish their content as authentic. The use of hidden patterns known as “watermarks,” for instance, can be buried in AI-generated texts to help identify whether the words are written by a human or computer, Krishnan says. But the applicability of these tools is limited.
Says Krishnan, “We’re not near deploying them at scale where it’s a solution to the bad-actor potential we have today.”
Copyright 2020, Dow Jones & Company, Inc. All Rights Reserved Worldwide. LEARN MORE
From bushland greens to valley reds, the country’s most awarded designers are proving that the best colour palette was never on a swatch card; it was outside the window all along.
The Australian leather house has opened an immersive four-day pop-up in Manhattan, unveiling its Bloom Collection and redefining what a product launch can look like.
The federal budget has rattled property investors. But the biggest mistake isn’t the tax changes, it’s the conclusion many are drawing from them.
2 min
The recent budget has forced a reckoning for property investors.
Negative gearing now restricted to new residential builds, the CGT discount gone and on paper, the numbers look different.
And many investors are responding by pivoting toward yield, prioritising cash flow over capital growth in a way that property strategists say misses the point entirely.
“The debate has shifted to yield versus growth as if they are opposing forces,” says Abdullah Nouh, founder of Melbourne-based buyers’ agency Mecca Property Group. “But that framing is itself the mistake.”
Nouh, who works with high-net-worth families and investors on long-term acquisition strategy, argues that capital growth remains the primary driver of genuine wealth creation and that the post-budget environment has made quality assets more important, not less.
The numbers make his case plainly. An additional $500 per week in rental income is welcome. A prestige asset appreciating by $1 million over a market cycle is transformative.
These are not equivalent outcomes, and portfolios built around yield at the expense of location and land value tend to generate income while wealth stands largely still.
The more nuanced shift Nouh is seeing among sophisticated investors is a move toward assets where both outcomes can be engineered simultaneously – established homes on substantial land in quality locations, where the existing dwelling can be repositioned, rental returns improved, and the underlying land value compounds independent of what sits on it.
For investors with existing equity, commercial property is also entering the conversation in a more serious way.
Prestige industrial assets, medical centres and long-leased essential retail offer income profiles that residential property in most capital city markets cannot currently match: longer lease terms, tenants covering outgoings, and greater predictability than the residential tenancy cycle.
“The investors who build lasting wealth are rarely the ones who chased yield or growth exclusively,” says Nouh.
“They are the ones who built a strategy they could sustain – one that generated enough income to hold quality assets through multiple cycles while those assets compounded in value.”
The budget has changed the settings. It has not changed the fundamentals.
A record-breaking $11 million sale at The Centennial Collection has set a new benchmark for luxury apartment living in Bondi Junction.
As interest rates, inflation and market sentiment fluctuate, investors are being urged to focus on data, not panic.
