The Security Risks Of ChatGPT

ChatGPT, developed by the artificial intelligence lab OpenAI, is a humanoid chatbot causing a global sensation. It is now the fastest-growing app in history, hitting 100 million active users in just two months - way faster than the nine months it took previous record-holder TikTok to reach that mark.

This powerful, open-source tool can do whatever you ask, including writing school essays, drafting legal agreements and contracts, solving complex math problems, and passing the medical licensing exam. It also has the potential to revolutionise the way businesses operate.

With ChatGPT, you can generate reports quickly and handle customer service requests efficiently. The tool can even write code for your next product offering, conduct market analysis and help build your company website.
But while ChatGPT offers many benefits to businesses, it poses urgent security questions. One of the critical risks associated with this technology is the power it gives cyber criminals with no coding experience to create and deploy malicious software.

With ChatGPT, anyone with bad intentions can quickly develop and unleash malware that wreaks havoc on companies.

The research unit of security firm Check Point Software have reported that, within weeks of ChatGPT's release, individuals in cybercrime forums, including those with limited coding skills, utilized it to create software and emails for espionage, ransomware attack, and malicious spamming. Check Point said it's still too early to tell if ChatGPT will become the go-to tool among Dark Web dwellers. Still, the cybercriminal community has demonstrated a strong interest in ChatGPT and is already using it to develop malicious code.

In one example reported by Check Point, a malware creator revealed in a cybercriminal forum that they were using ChatGPT to replicate well-known malware strains and techniques. As evidence, the individual shared the code for a Python-based information stealer that they developed using ChatGPT. The stealer searches, copies, and transfers 12 common file types from a compromised system, including Office documents, PDFs, and images.

ChatGPT Increases Everyone's Exposure To Hacking

Bad actors can use ChatGPT and other AI writing tools to make phishing scams more effective. Traditional phishing messages are often easily recognizable because they are written in clumsy English. But ChatGPT can fix this. Mashable tested ChatGPT's ability by asking it to edit a phishing email. Not only did it quickly improve and refine the language, but it also went a step further and blackmailed the hypothetical recipient without being prompted to do so.

While OpenAI says it has strict policies and technical measures in place to protect user data and privacy, the truth is that these may not be enough.

ChatGPT scrapes data from the web—potentially data from your own company—which brings security risks. For instance, data scraping can result in sensitive information, such as trade secrets and financial data, being exposed to competitors. There can also be reputational damage if the information obtained through data scraping is inaccurate. Moreover, when data is scraped, it can open systems to vulnerabilities that malicious actors can exploit.

Given that the attack surface has dramatically expanded due to the advent of ChatGPT, what impact does this have on your security posture?

Previously, small and mid-sized businesses may have felt secure, thinking that they were not worth the trouble of hacking. However, with ChatGPT making it easier to create malicious code at scale, everyone's exposure to cybercrime has significantly increased.

ChatGPT demonstrates that while the number of security tools available to protect you may be increasing, these tools may not be able to keep pace with emerging AI technologies that could increase your vulnerability to security threats. Given the spiralling threat of cybercrime, every business needs to be aware of the potential risks posed by ChatGPT and other advanced AI systems—and take steps to minimise those risks.

Measures You Can Take To Protect Yourself

Your first step is to understand just how vulnerable you are. Penetration testing, also known as pen testing, can help protect your data by simulating a real-world attack on your company's systems, networks, or applications. This exercise aims to identify security vulnerabilities that malicious actors could exploit so you can close them. By exposing your weaknesses in a controlled environment, pen testing enables you to fix those weaknesses, improve your security posture and reduce the risk of a successful data breach or other cyberattacks.

In the new world of ChatGPT, penetration testing can play a crucial role in helping you safeguard your data and ensure its confidentiality, integrity, and availability.

Companies must also double down on their data resilience strategy and have a solid data protection plan. A data resilience plan outlines the steps a business should take to protect its critical data and systems and how it will restore normal operations as quickly and efficiently as possible if a data breach occurs. It also provides a roadmap for responding to cyber threats, including detailed instructions for securing systems, backing up data, and communicating with stakeholders during and after an incident.

By putting a data resilience plan in place, businesses can minimise the impact of cyber threats and reduce their risk of data loss, helping to ensure their organisation's ongoing success and survival.

Another way of stopping ChatGPT-enabled script kiddies and bad guys is through immutable data storage. Immutability means data is converted to a write-once, read many times format, and can't be deleted or altered. There isn't any way to reverse the immutability, which ensures that all your backups are secure, accessible, and recoverable. Even if attackers gain full access to your network, they will still not be able to delete the immutable copies of your data or alter the state of that data.

Final Takeaway

While ChatGPT offers benefits to businesses, it also poses significant security risks. Companies must be aware of these risks and take steps to minimise them. They should invest in solid cybersecurity measures and stay informed about the latest security trends.

By putting the proper protection in place, organisations can realise the many benefits of ChatGPT while defending themselves against those who use the tool for malicious purposes.

Richard Massey is Vice President Sales, EMEA at Arcserve

You Might Also Read: 

AI Will Be Disruptive - For Both Security & Jobs:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« AI Generated Images Shake The Stock Market
Vulnerable Networks & Advanced Persistent Threats »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Nmap Project

Nmap Project

Nmap Project is a Free and open source tool for network discovery, administration, and security auditing.

CDNetworks

CDNetworks

CDNetworks is a global content delivery network with a fully integrated cloud security solution, offering unparalleled speed, security and reliability for the almost instant delivery of web content.

PlaxidityX

PlaxidityX

PlaxidityX (formerly Argus Cyber Security) is a global leader in mobility cyber security, provides DevSecOps, vehicle protection and fleet protection technologies and services.

ThreatAdvice

ThreatAdvice

ThreatAdvice is a provider of cybersecurity education, awareness and threat intelligence.

Scientific Cyber Security Association (SCSA)

Scientific Cyber Security Association (SCSA)

The main goal of Scientific Cyber Security Association is the development of scientific and practical directions of cyber security.

Information Systems Security Partners (ISSP)

Information Systems Security Partners (ISSP)

ISSP is a specialized system integrator focused on the information security needs of its corporate clients and providing best in class products and services for securing organizational information.

BlueFiles

BlueFiles

BlueFiles enables users to send encrypted files securely while maintaining full control over recipients, access periods, downloads, and printing.

Sky Data Vault

Sky Data Vault

Sky Data Vault provide the simplest and most cost effective method of Disaster Recovery / Business Continuity for mission critical systems and applications.

Symmetry Systems

Symmetry Systems

Symmetry Systems is a provider of data store and object-level security (DSOS) solutions that give organizations visibility into, and unified access control of, their most valuable data assets.

Istari

Istari

ISTARI is a new kind of cyber risk management company. We’re an agile collective of best-in-class capabilities and experts, who build ongoing partnerships with clients.

Third Point Ventures

Third Point Ventures

Third Point brings deep technical expertise, a strong network of relationships, and decades of investing experience to add value to our partners throughout their journey from idea to IPO and beyond.

Resilience Cyber insurance

Resilience Cyber insurance

Resilience helps to improve cyber resilience by connecting cyber insurance coverage with advanced cybersecurity visibility and a shared plan to reinforce great cyber hygiene.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

LaScala

LaScala

LaScala is an IT Managed Services provider delivering technical, security, and compliance solutions with dedication, compassion, and agility.

Strata Information Group (SIG)

Strata Information Group (SIG)

Strata Information Group (SIG) is a trusted partner in IT solutions and consulting services.

Cybervergent

Cybervergent

Cybervergent (formerly Infoprive) are a leading cybersecurity technology company in Africa. We provide cybersecurity guidance and solutions that help protect your business.