<\/p>\n\n\n\n
Artificial intelligence has existed for a while now, but it has been the preserve of large organizations using it primarily for data analytics. However, the launch of OpenAI\u2019s ChatGPT in November 2022 changed the dynamics. ChatGPT put the power of AI language models into the hands of anyone with access to the internet.<\/p>\n\n\n\n
Since the release, people have quickly explored how to use AI for everyday tasks. From writing web copy and emails to composing music, creating graphics, and even writing computer code, it seems there\u2019s nothing beyond the realm of possibilities for AI. However, little attention has been given to the possibility of using AI models like ChatGPT for malicious purposes \u2013 such as creating computer malware. <\/p>\n\n\n\n
Like any other tool developed by humans, ChatGPT and other AI models can be used for good and bad. While OpenAI has put in place safeguards to prevent its exploitation, the potential for its abuse cannot be understated. Already, a report by Webroot shows that over 90% of cybersecurity professionals<\/a> are worried about the use of AI to execute more sophisticated cyberattacks.<\/p>\n\n\n\n As ChatGPT and other AI models become more powerful and widespread, here are a few ways cyber criminals might use them to create super malware.<\/p>\n\n\n\n Writing the code for an effective malware script isn\u2019t a simple task \u2014 even for a proficient hacker, it could take an hour or more. ChatGPT<\/a> allows hackers to generate such code in seconds. <\/p>\n\n\n\n For instance, in December 2021, someone announced on a popular hacking forum that they had used ChatGPT to create an encryption tool<\/a> that could easily be converted into ransomware. The scary part is that it was this user\u2019s first ever script, which they easily created with ChatGPT\u2019s helping hand.<\/p>\n\n\n\n Such examples show that AI will lower the barrier of entry for new hackers to build effective malware while making attacks more effortless and efficient for seasoned cybercriminals. <\/p>\n\n\n\n AI makes it easier for threat actors to perform reconnaissance on their targets before launching an attack. For instance, hackers can train AI to analyze large network traffic datasets, system logs, and other relevant data to identify weaknesses they can exploit. Hackers can even use AI to automatically generate malware that exploits those vulnerabilities.<\/p>\n\n\n\n It\u2019s also possible for hackers to use AI to gather and analyze information such as email addresses, job titles, and even personal details from social media profiles or other public sources. Hackers can then use this info to launch highly effective social engineering attacks<\/a> against high-profile targets.<\/p>\n\n\n\n One common tell-tale for phishing<\/a> emails is their poor English, mainly because many originate from hackers who aren\u2019t very good at English. However, with AI models like ChatGPT, hackers from anywhere can create legitimate-looking phishing emails within a few seconds.<\/p>\n\n\n\n Researchers from Singapore’s Government Technology Agency found that AI is better at writing phishing emails<\/a> compared to humans. In the tests, the AI-generated phishing emails had a significantly more significant number of clicks than the human-written ones. This shows it\u2019s possible for hackers to use language models to make phishing campaigns more effective.<\/p>\n\n\n\n Besides phishing emails, it\u2019s also possible to use ChatGPT to build clone websites to dupe people into sharing important information, such as usernames, passwords, and financial information.<\/p>\n\n\n\n Imagine malware that is situationally aware. It can analyze the system on which it is deployed, then adjust its activity based on the target system\u2019s defense mechanisms. Such malware would be very effective and almost impossible to detect and stop. While this sounds like an imaginative stretch, it\u2019s a very real possibility with AI-boosted malware.<\/p>\n\n\n\n IBM proved this possibility with DeepLocker, a futuristic AI-powered ransomware it developed as a proof-of-concept. DeepLocker uses AI algorithms to hide its malicious payload<\/a> in benign software, making it difficult for security systems to detect. It only activates its payload only when it identifies specific criteria.<\/p>\n\n\n\n For instance, it can be programmed to remain hidden until it identifies a target. This can be done through machine learning technologies like facial recognition, which has also become quite advanced. For example, Facebook uses machine learning models to verify faces with 97% accuracy<\/a>. With such a model, DeepLocker can remain dormant in a system and only unleash its malicious payload once it\u2019s sure that it has found the correct target.<\/p>\n\n\n\n It\u2019s also possible to program AI-powered malware with algorithms that allow it to evolve and adapt over time. For instance, such AI-powered malware could learn the actions that trigger its detection, then change its behavior to avoid detection.<\/p>\n\n\n\n As AI becomes more powerful, it\u2019s not inconceivable that threat actors will find more ways to equip malware with these algorithms and make them more evasive and dangerous.<\/p>\n\n\n\n Despite the potential for AI models like ChatGPT to be used to create super malware, all is not lost. Just like a good guy with a gun can protect the masses against a bad guy with a gun, AI can also be used to fight against AI-powered super malware.<\/p>\n\n\n\n Here are a couple of ways in which AI can make the fight against malware more effective:<\/p>\n\n\n\n <\/p>\n\n\n\nMalware Creation<\/h2>\n\n\n\n
Reconnaissance<\/h2>\n\n\n\n
Phishing<\/h2>\n\n\n\n
AI-Powered Malware<\/h2>\n\n\n\n
All Is Not Lost: AI Will Enhance CyberSecurity<\/h2>\n\n\n\n
\n
\n