The software that everyone is talking about has so much potential but also so many risks. One is related to the possibilities offered to cybercriminals, even inexperienced
2023 will definitely be the year of artificial intelligences: somewhat suddenly, as early as the end of last year, we realised how AI can be useful for making better films, for boosting online search engines, for doing schoolwork and even for chatting (virtually) with Elon Musk, Barack Obama or even with Elizabeth II.
So many possibilities, and many more are sure to arise in the coming months, but also so many risks, as we have often written on Italian Tech. One is related to cybersecurity: according to what Check Point Software, an Israeli company active in the field of cybersecurity, LLMs (what’s that?) such as ChatGPT can be used to create computer attack tools from scratch. And in a relatively simple way, too.
Creating malware with ChatGPT: easy for (almost) everyone
Analysts from Check Point’s CPR division pointed out that they had observed ‘the first cases of cybercriminals and users using ChatGPT to develop malicious tools’ and that in underground hacking forums (image above), so-called infostealers (software that facilitates the theft of personal information), encryption tools and others to facilitate fraud activities are already being created.
In particular, at the very end of 2022, a thread appeared on a popular underground hacking forum entitled ChatGPT – Benefits of Malware, the author of which disclosed that he was in the midst of rehearsing how to recreate malware through the popular AI, also to ‘demonstrate to less technically adept cybercriminals how to use it for malicious purposes, with real examples to be applied immediately’.
Again: in another thread, one person showed a Python script, described as ‘the first script I ever created’, confirming that OpenAI’s tool gave him ‘a nice hand in finishing it’, demonstrating that potential cybercriminals with little or no development skills could exploit ChatGPT to develop malicious tools and engage in this activity. Which is already a lucrative business: always on the Dark Web, one can find discussions on How to make $1000 a day with ChatGPT or How to earn $600 with ChatGPT.
Creating phishing emails with ChatGPT: How it’s done
To demonstrate how simple it is, Check Point staff also tried using ChatGPT to create phishing mails and malicious code: through OpenAI’s AI, CPR’s people were able to create an email with an Excel document attached containing malicious code capable of triggering what is known as a reverse shell (simplifying, it is used to remotely take control of a computer).
A CPR analyst first asked ChatGPT to impersonate a hosting company; then he asked ChatGPT to repeat the procedure, but by creating a phishing e-mail with a malicious Excel attachment; finally, he asked ChatGPT to create malicious VBA code inside an Excel document. Which is then what the hypothetical criminal should attach to the hypothetical e-mail to send to potential victims.
Sergey Shykevich, head of Check Point’s Threat Intelligence team, recalled that “ChatGPT was designed for the purpose of assisting developers in writing code, but it can also be used for dangerous purposes” and that precisely “in recent weeks we are seeing criminals begin to use ChatGPT to write malicious code, giving them the potential to accelerate the attack process and a good starting point. Although the tools analysed are quite basic, it is only a matter of time before more technical criminals improve the way they use AI-based tools’.