AI’s impact on Cyber Security: the good and the bad

It’s been over two years since the release of ChatGPT-3 and since then AI has taken the world by storm. The world’s largest companies are seemingly implementing AI-related features into all of their products and there is good reason as to why: AI is easy and effective. That’s not just for generating a picture of a hacking gorilla with a pink mohawk; AI can also help computer programmers create code quickly – sounds great, right?

Unfortunately, it’s not just the normal computer programmer using AI. It’s also hackers, scammers and cyber criminals.

Earlier this year, The New York Times published a story about a woman receiving a call from her mother-in-law in the middle of the night telling her something horrible had happened, they were being held at gunpoint and the gunman demanded they send money to an account to free them.

When they did, the call cut off and she called back to check if her mother-in-law was okay. She was fine. She said she was lying in bed, she hadn’t been held hostage. Her voice had been generated by AI without her knowledge and without ever alerting the woman or her husband that something seemed wrong.

Replicating someone’s voice is only scratching the surface of how AI is helping the criminal world. The National Cyber Security Centre say that AI will “almost certainly make cyber attacks against the UK more impactful.” So knowing what you’re up against is so important to making sure you and your organisation are protected.

AI’s existence has completely reshaped the barrier to entry required for a criminal to gain the skills necessary to carry out effective access and information-gathering operations. And because of this, we are seeing a significant and shocking increase in cyber crime. In 2023, 343 million people became victims of cyber attacks across the globe – that’s the equivalent of everyone in the UK, five times over! And from 2021 to 2023, the number of data breaches rose by 72% and it keeps climbing.

Before we can get into exactly how AI is affecting cyber crime, we have to look at the types of cyber crime that can affect your organisation.

Types of Cyber Crime

Malware

Malware is any piece of software that seeks to do harm to your computer or hardware or your organisation’s network. When offices can have hundreds of machines that are all connected, it’s more important than ever to avoid malware on computers whether they come from suspicious websites or from emails from unfamiliar addresses.

Hacking

Hacking is what most people think of when they think of cyber crime many other types are actually much more common. Hacking is the process of accessing a computer system in order to install malware, gain information or access accounts.

Social engineering

Cyber crime isn’t always online, and it’s definitely not all about computers. Social engineering, or social hacking, is something your whole team should be aware of. It can come in many forms, from a fraudulent phone call to using knowledge of where your team might be to pickpocket a keycard from them.

Cryptojacking

This is a lesser-known form of cybercrime and one that hasn’t really existed until recently, but in the last few years it has really taken off. It’s all to do with cryptocurrency (think Bitcoin).

Cryptocurrencies are digital currencies built on a decentralised system rather than a government system like £s or $s. That makes their value related solely to their demand or lack thereof. Instead of being minted, like pound sterling, they are “mined” using the processing power of computers. For some cryptocurrencies, like Bitcoin and Ethereum, they have an incredibly high demand and require significant computer processing to create them.

Some people will use entire warehouses worth of computers to generate enough processing power to make just one coin, but what some bad actors will do is secretly install malware on your computer that use a portion of your computer’s processing power and create a network of hundreds of computers to mine these coins. This makes computers run slower, crash more often, and use more power.

DDoS attacks

DDoS (Dedicated Denial of Service) attacks target networks and websites with a large amount of traffic by using bots. These slow network capabilities and obstruct normal traffic and have been catastrophic for many of the most used digital service providers, including Amazon and Microsoft.

There are many other ways your organisation might be under threat from cyber criminals, and it’s important that even without considering AI you and your team are aware of the types of threats you could be facing. With all of the above, however, AI is having a big impact on how often and how much it can affect you – but it’s not ALL negative.

AI is incredibly easy to access. Not only is it free, but companies have happily put their AI-based products at the front and centre of their users’ experiences. The likes of ChatGPT come with a seemingly endless bank of information and anyone with the technical knowhow can access it.

Yes, OpenAI (the creators of ChatGPT) and other generative AI companies do put some guardrails on their systems, but so called “Prompt Engineers” create workarounds just as quickly as new roadblocks are put in place. And it’s still not that difficult to circumvent existing roadblocks.

The real strength of ChatGPT is its ability to generate code quickly. That means with little to no knowledge of how to code, with ChatGPT, you can. That puts the bar to entry very low for any criminal looking to do damage to your organisation – but it works both ways. Those interested in cyber security will also have an easier time entering the profession with the help of the same generative AI tools.

Lowering the bar to entry is just the beginning for the impact AI is having on the cyber crime industry.

How AI is impacting Cyber Crime

Malware

As previously mentioned, AI speeds up the process of creating malware significantly, meaning that organisations across the globe have to deal with an increase in malware and responding to that increase is very difficult for cyber security professionals.

Because of AI, it’s easier than ever to create more sophisticated malware that can even be adaptable to traditional cyber security defences – and with the right training data, these malware systems could be produced rapidly, with little investment in time and money.

It’s not all doom and gloom, however. As we’ve already mentioned, the same features that help make capable malware quickly also help antivirus developers make their software quicker as well. Since its inception, dealing with malware has always been a game of wack’o’mole, with one antivirus software solution beating back a certain type of malware until another pops up.

That’s why it’s so important to constantly update your software systems so your computer has the best defences against any type of malware attack.

Hacking

The idea of brute forcing a password has been around since before we’ve even had computers. And while many systems, software and websites have built-in ways of dealing with brute force attempts, AI might start to complicate things.

One of the strengths of AI is pattern recognition, which means given enough information about you, it might be able to make more accurate attempts at your password. Brute forcing doesn’t have to mean trying every combination of characters quickly; instead it could try several passcodes around your birthday or other significant dates, and then move on to other words to do with you. This saves hackers time and computational power.

We recommend using a Password Manager to generate and store complex passwords for all your logins.  In addition, no matter how complicated your password is or where you store it , you should always use two-factor authentication so that whether or not a nefarious actor has managed to crack your passwords, they won’t be able to access your accounts.

Social Engineering

It sounds straight out of science fiction, but if one of your staff got a call from ‘you’ asking for a password or to download a file from an email you just sent them, would they challenge it? Would they ever suspect it might not be you?

Social hacking is one of the most underestimated aspects to cyber security and when you can’t even trust your team members’ voice, you have to approach requests and enquiries with a real cynicism. On a study performed on over 500 people, it found that people couldn’t tell the difference between a real voice and an AI generated voice 73% of the time.

And it doesn’t just stop at voices; faces on video are also becoming harder to spot with another study finding that 43% of the time people could not detect a deepfake within a video.

Let’s not forget that story from the start of this article – all it takes is a team member being stressed or distracted for them to be encouraged to do something to their own detriment without realising it.

Until recently, it seemed like AI would not be much help outside of helping detect AI influence – something that hasn’t been proven successful. But Telecommunications provider O2 recently developed “dAIsy”, an AI granny designed to scam the scammers by wasting their time, all the while learning about how they operate to better protect people in the future.

It’s still so important to make sure your team are aware of potential risks that AI now poses in the world of social hacking, and by implementing policies when it comes to performing tasks that could jeopardise security, you can eliminate a lot of that risk.

Cryptojacking

AI has been deeply tied to Crypto and Web3 since ChatGPT-3’s public release in 2022. But AI has been doing more to detect and eliminate Cryptojacking than it has been in developing. AI can detect unexpected changes in computer performance or, use pattern recognition to find programs that are using an unexpected amount of processing power and alert users to it.

DDoS Attack

Ask any web developer and they’ll tell you the best way to stop a DDoS attack is to eliminate bot traffic from your site. Unfortunately, there are not many ways to eliminate bot traffic without also limiting the human access to your site. The best way to keep bots off your site whilst allowing humans in is a CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) you’ve likely done one of these yourself whether you’re clicking all the pictures with stairs in or typing in the word hidden in a squiggled text.

These tests have been incredibly effective at keeping unnecessary traffic off sites but these tests have actually been used to help train AI to better detect images and words – and now that AI is easily accessible, CAPTCHAs will not be as effective as they once were.

Quickly detecting this traffic before it’s too late is near impossible for any human to do – but an AI trained to detect unnatural traffic, identify whether it’s human or not and eliminate it, might be a new way to reduce the risk of DDoS attacks.

You’ve already taken a big first step in protecting your organisation – by being aware of the threats posed to you, your team and your organisation you can be more secure against cyber threats. AI is here to stay, and for every new threat it poses to your organisation, it gives you new tools to protect yourself.

If you want to help slow cyber criminals down, share this article with your team and anyone else you know – not being aware of these threats or prepared to deal with them when they come up could make you the next victim.

Or, if you’re ready to mitigate against these threats now, then take a look at Cyber Essentials accreditation which certifies that you’re taking steps to secure your organisation, you and your team’s data and your customers’ data. If you’re interested in finding out more about it, visit our website.