ChatGPT & Cybersecurity: Does it pose a risk?

In modern times, we are witnessing a major shift in technology that now permeates many areas of life.

The market is currently glistening with shiny new tech that holds much promise and seeks to revolutionize the world even further. This is illustrated by monetary developments like cryptocurrency and how the shift from physical money has morphed into a new digital format.

Then, there’s the Metaverse. A place to explore a new 3D reality where learning, socializing, fun, and collaboration are possible. An entirely novel way to experience an alternative world.

It’s no surprise that artificial intelligence (AI), the long-held fantasy of sci-fi enthusiasts, is no longer just an abstract idea. While it’s still relatively early days, AI is very real and it’s here to reduce friction in many walks of life.

As many sectors have fully embraced a move to digital-based infrastructure, the next big advancement in the cyber landscape is in the form of AI — intelligent computer systems that can respond in anthropomorphic ways.

What is ChatGPT?

ChatGPT is the brainchild of OpenAI. It was created to provide a model that exhibits conversational behavior while displaying something resembling humility when it’s wrong and making judgment calls on inappropriate interactions.

Driven by AI, it’s a chatbot with a more human edge. The program’s intelligent feel stems from a natural language processing tool that colors interactions with character. It’s a world away from the stunted and predetermined answers that simpler technology used to generate.

As a result of this, you can request that ChatGPT performs higher-complexity tasks, such as writing essays, emails, and even code. To get to this point, ChatGPT will ask the user questions to refine its response and create a more competent end product.

In terms of accessibility, OpenAI has made ChatGPT free to use since it’s still in the developmental feedback stage. However, as of February, there’s an option to use ChatGPT Plus — their paid subscription model — which promises you access to faster response times and new features.

Does ChatGPT pose a cybersecurity risk?

In a nutshell, the answer is yes.

As mentioned, one of the benefits of ChatGPT is that it’s able to write code. Unfortunately, this accessibility has handed bad actors the means to write malicious code. Similarly, phishing emails have also been written with the help of ChatGPT. Even the fact that in doing so violates ChatGPT’s terms of service, bad actors have not been deterred from corrupting the program in this way.

One of the benefits of ChatGPT is that it facilitates more complex writing tasks — there’s no longer a barrier between you and your desired outcome. So it’s a tool that can be utilized with ease, whether you are a seasoned cybercriminal, or an unskilled actor that harbors bad intentions, your end goal is much more achievable with this tool. ChatGPT produces better quality output than a lot of phishers can write. Where poor spelling and grammar were often easy giveaways of scams, the ability of scammers to use ChatGPT will make their scams harder to detect.

Let’s look at a couple of case studies that highlight how ChatGPT has been used by threat actors.

Infostealing

Towards the end of 2022, a thread was found on the dark web that discloses how one threat actor found a way to create malware strains using ChatGPT. The thread openly shows others how to copy and carry out their actions.

They discussed how, using the Python programming language, they searched for common files such as Microsoft Office, images, and PDFs on networks and then set about infostealing. The malware makes duplicates of common files, stores them temporarily before zipping them, and finally distributes the copies across the web.

Dark Web markets

Another incidence of bad actors using ChatGPT on the dark web was found in December 2022. It details how the cybercriminal created a Dark Web marketplace by using code generated in ChatGPT. Using a third-party API, the criminal gained current cryptocurrency prices to help consolidate an underground payment system. Ultimately, ChatGPT was being used as a tool to facilitate payments and fund criminal activity.

The above examples were found in an illicit forum that lays out many different ways of using ChatGPT, so it’s clear to see the tactics that threat actors are using.

It’s difficult to tell how many current attacks are carried out with the help of ChatGPT. Yet, it’s clear from the case studies that it is a tool that cybercriminals are using.

It’s not all bad news though

AI and tools such as ChatGPT can outpace human output in terms of analyzing information and identifying trends. This is a major upside to the advent of computer learning systems.

With a backdrop of a talent gap in cybersecurity, the use of AI can help catch up on the ground that’s being lost by a lack of professionals in this environment.

It may mean an opportunity to sculpt cybersecurity roles for humans that are specific to a human skill set, while automation can carry out the time-consuming admin tasks, as well as deep analysis of reams of data.

It means that manual jobs, such as writing code, can be done in a fraction of the time that it used to take, creating a more efficient setup.

What can you do to protect yourself?

While there will always be new techniques and methods deployed by threat actors that seek to steal information or corrupt data, the best cure will always be prevention.

Regardless of the tactics used, hackers won’t be able to access your data if you have a comprehensive, up-to-date cybersecurity solution in place.

Trust SamuraiXDR to guard against attacks

Fight hackers with their own tactics - SamuraiXDR offers unbeatable around-the-clock protection that’s generated from AI and machine learning.

NTT has over 20 years of experience developing its threat detection capabilities and has extensive experience in the use of AI and ML in its cybersecurity capabilities. Samurai XDR is built on NTT’s top 5 Tier 1 IP backbone which allows for unique visibility into threat activity over the internet. So, what does that mean? We use AI to do good, it’s not only the bad guys who get to take advantage of AI. Both threats and threat detection will be leveraging AI both now and in the future.

Advanced threat-hunting technology leaves no stone unturned in the pursuit of compromising activity — with 9.5TB of data processed every day through NTT’s global detection infrastructure. Stay one step ahead with automated response mechanisms that immediately extinguish potential threats.

Check out SamuraiXDR for yourself and sign up for a 30 day free trial