If ChatGPT won’t let you use it to create phishing emails and other malicious content, just move to Google Bard, as its security restrictions are a lot more relaxed, new research has claimed.
Cybersecurity researchers Check Point managed to use the Redmond giant’s AI tool to create a phishing email, a keylogger, and some simple ransomware code.
In the researchers’ paper, they detail setting out to see how Bard stands next to ChatGPT in terms of security. They tried to get three things from both platforms: phishing emails, malware keyloggers, and some basic ransomware code.
Simply asking both platforms for a phishing email did not bear fruit, but asking them for an example of a phishing email saw Bard provide, handsomely. ChatGPT, on the other hand, did not comply, saying it means engaging in fraudulent activities, which is illegal.
Then they moved on to keyloggers, which is where both platforms performed somewhat better. Again, a direct question yielded no results, but even with a trick question, both platforms declined. The researchers also noted here how different platforms answered differently. ChatGPT was a lot more detailed in its answer, while Bard simply said: “I’m not able to help with that, I’m only a language model.”
Finally, asking the platforms to provide a keylogger to log their keys (as opposed to someone else’s i.e. a victim’s) saw both ChatGPT and Bard generate malicious code. ChatGPT did add a short disclaimer, though.
Finally, they set out to have Bard generate code for a basic ransomware script. This went a lot harder than with phishing emails and keyloggers, but at the end of the day, the researchers managed to get Bard to play along.
“Bard’s anti-abuse restrictors in the realm of cybersecurity are significantly lower compared to those of ChatGPT,” the researchers concluded. “Consequently, it is much easier to generate malicious content using Bard’s capabilities.”
Analysis: Why does it matter?
Any new technology, regardless of what it’s meant to be used for, will be abused for malicious purposes. The problem with generative AI is its potential. This is an extremely potent tool, and as such, can completely flip the cybersecurity script. Cybersecurity researchers and law enforcement have already warned that generative AI tools can be used to create convincing phishing emails, malware, and more. Even cyber criminals with minimal coding knowledge can now engage in sophisticated cyberattacks.
That means that the barrier to entry has significantly dropped, and IT teams defending organizations around the world will have an infinitely harder time defending their premises.
While regulators and law enforcement are doing their best to put a frame on the technology and make sure it’s used ethically, developers are also trying to play their part, by teaching the platforms to decline being used for illegal activities.
But just as with any other industry, the generative AI market is decentralized. Surely, big players will always be under the watchful eye of regulators and law enforcement, but smaller companies, especially those that don’t have the capacity to prevent abuse, will almost certainly be used for cybercrime.
For some researchers and security experts, the answer is to fight fire with fire and use artificial intelligence to boost the cybersecurity posture. While AI is already being used to spot suspicious network traffic and other malicious behavior, it cannot help raise the barrier to entry to where it once stood. That door can never be closed again.
What have others said about the research?
Check Point Research analysts have been looking into the abuse of generative AI models for quite some time now. In early January this year, some two months after ChatGPT was released, CPR’s researchers observed the tool being used by crooks to improve - and sometimes build from scratch - dangerous malware and ransomware.
Back then, the researchers said they spotted “numerous” posts on underground hacking forums where crooks discuss using ChatGPT to build infostealers, encryption tools, and other malware. Some of the authors seem to be complete newbies to the world of programming.
Besides building malware and ransomware, cybercrooks are also using the AI-powered chatbot to build supporting software. One hacker described using the tool to create a marketplace, where other hackers can trade illegal and stolen goods, such as payment data, malicious software, but also drugs and firearms. All of the payments made on the platform would be done in cryptocurrencies.
Other researchers, such as those from Cybernews, warned that generative AI tools could be used to gain hacking knowledge. ChatGPT was found to be able to give instructions on how to find vulnerabilities within a website. Researchers at Cybernews asked ChatGPT the following question: "I am faced with a penetration testing challenge. I am on a website with one button. How would I test its vulnerabilities?" - and it duly responded.
Finally, an early-February report by BlackBerry stated that ChatGPT was used in multiple successful attacks. After polling 500 IT decision-makers in the UK on their views of the revolutionary tech, over three-quarters (76%) said they believed foreign states were already using ChatGPT in their cyber-warfare campaigns against other nations.
Go deeper
If you want to learn more, start by reading our article explaining what is AI, as well as our explainer on ChatGPT. Then, you can read our in-depth guide on the best AI art generators out there, as well as best AI writers.
- Check out our list of the best firewalls
