AI Chatbots: A Double-Edged Sword in Cybersecurity
Artificial intelligence (AI) chatbots, traditionally celebrated for enhancing productivity, have now emerged as a significant concern in the realm of cybersecurity. Recent findings by HP Wolf Security researchers have highlighted a troubling trend where malicious actors are leveraging generative AI to write sophisticated malware, including remote access Trojans. This development signals a pivotal shift in cybersecurity, making the creation of advanced malware accessible to a broader range of individuals and potentially precipitating a surge in cybercrime.
Lou Steinberg, founder and managing partner at CTM Insights and former CTO of TD Ameritrade, noted the severity of this issue. “If your company is like many others, hackers have infiltrated a tool your software development teams are using to write code. Not a comfortable place to be,” Steinberg remarked.
The Growing Threat
Developers frequently utilise AI chatbots such as ChatGPT for tasks that include code generation and translating between programming languages. These chatbots have seamlessly integrated into development teams, significantly enhancing productivity. “These chatbots have become full-fledged members of your development teams. The productivity gains they offer are, quite simply, impressive,” Steinberg explained.
However, this dependency on AI chatbots introduces substantial risks. These AI tools are trained on vast repositories of open-source software which can contain design flaws, bugs, or even hidden malware. Steinberg highlighted the inherent danger, likening it to “letting a bank-robbing getaway driver teach high school driver’s ed.” With an estimated over a billion open-source contributions annually, the likelihood of malicious code infiltrating AI training data is considerable.
Exploitation by Cybercriminals
Morey Haber, chief security adviser at BeyondTrust, elaborated on how AI chatbots are being exploited by criminals to automate the creation of malware. “They are generating components for attacks with minimal technical expertise,” Haber explained. For instance, attackers can prompt chatbots to create specific scripts, such as a PowerShell script that disables email boxes, without needing to understand the underlying code.
This simplifies the process for less experienced attackers, often termed “script kiddies,” enabling them to develop sophisticated phishing emails, malware payloads, or ransomware. “These chatbots make it easier for attackers to innovate their techniques,” Haber added.
Strategies for Mitigation
In response to these emerging threats, experts suggest that security professionals must evolve their strategies to safeguard against AI-generated malware. Steinberg recommended that companies “carefully inspect and scan code written by generative AI.” Traditional malware detection methods may not be sufficient as AI-generated code varies with each iteration. “Use static behavioural scans and software composition analysis to detect design flaws or malicious behaviour in generated software,” he advised.
Haber emphasised the importance of educating users on recognising AI-enhanced attacks, such as AI-generated phishing emails and deepfake technologies. “Using anomaly detection, predictive analytics, and continuous monitoring tools can help identify and block AI-driven threats before they cause damage,” he stated.
Collaborative Efforts
AI developers and cybersecurity experts are collaboratively working to counter the risks posed by AI-generated malware. Elaborating on this collaborative effort, Haber mentioned that frameworks and detection systems are being built following guidelines like those from MITRE and NIST. Additionally, companies are being advised to form internal AI policies and guidelines to prevent the inadvertent disclosure or exploitation of sensitive data through AI systems.
Steinberg reiterated the importance of caution when integrating AI into software development processes. “If you are going to trust generated code, the old adage to ‘trust, but verify’ applies.”
Current Cybersecurity Landscape
Yashin Manraj, CEO of Pvotal Technologies, highlighted that even unsophisticated attackers have begun using AI to exploit vulnerabilities. “Launching a dozen new AI chatbots that leverage the vast wealth of indexed ransomware, malware, and other code snippets to exploit older infrastructure and unpatched vulnerabilities has helped increase the number of successful cyberattacks,” Manraj noted.
Despite the evolving capabilities of AI chatbots in malware development, Manraj pointed out that these tools have not yet outpaced advanced security professionals. However, he acknowledged an increase in the volume of attacks targeting outdated systems. In mitigating these risks, developers are increasingly using cryptographic tools, secure application signing, and AI-detection methods.
Manraj emphasised ongoing efforts to enhance security, including creating more sandboxed environments, reducing default application access, and preventing deprecated software from impacting entire systems.
As the landscape of cybersecurity continues to evolve with the advancement of AI technologies, the balance between productivity gains and the potential risks will remain a focal point for both developers and security professionals.
Source: Noah Wire Services