Pooring 386 KG of GPTChat cyber security and privacy concerns in a bottle. What happens?
by Prakash Prasad
Top 30+ security vulnerabilities of GPTChat: AI-Powered ML Chatbot, Privacy Concerns, and Cybersecurity Concerns
GPTChat (Generative Pre-trained Transformer [Chatbot ver. 3] aka. GPT3) is a chatbot powered by artificial intelligence and machine learning that improves and learns from user input. It is programmed on around 175 billion neural network samples and will reach approximately 120 trillion in the upgraded version 4. It means that the Chatbot can comprehend human speech and respond to us as though we were conversing with another person. GPTChat is receptive to feedback and reinforces it programmed model to enhance its capabilities. It means, feedback is welcomed by GPTChat, which then strengthens its programming model to increase its functionality. It is based on OpenAI and uses Large Language Models, which are machine learning models based on supervised and unsupervised neural networks. Programmers can get information about their code on GPTChat. If you’re a marketer, it can create your hero-hook. It can offer security solutions if you are a security expert.
If you’re a student, it can help you with your assignments. It can provide fantastic content for you if you write columns. It can craft or direct you to a certain webpage if you are a hacker looking to learn more about it. It will also warn you not to engage in hacking operations. Example: let say you want to write a malware program; you can ask the indirect questions and probe to craft the malware code. It can write lyrics for songs for you if you sing. It can fine tune reports and assignments for 5 years old and 55 years old person to apprehend.
GPTChat only uses data streams till 2021. You might wonder how this Open AI chatbot functions. GPTChat has surpassed the roughly 86 billion neurons in the human comparable neural network. This indicates that the AI chatbot is more powerful than we could have envisioned. GPTChat uses data samples that have been trained before correlating them to rewards to reinforce learning. A new, more sophisticated reward-based model is created as this help to advance. By ranking the output from best to worst, it aids the chatbot’s ability to generate output. In essence, it has been trained to produce text-based output based on text summaries, language level understanding, pattern reorganization, neural language-based processing, and responding in text or languages that are understandable to humans.
Pattern Hacking: Let say a police agent is keep track of your footsteps, your patterns and timestamps. This might seem little spooky but not far from reality. GPTChat learns to develop patterns and knows your pattern or behavioural traits. This makes it very dangerous as it is just a chatbot. Any criminal sitting anywhere behind the shadows of internet can query GPTChat or trick to reveal patterns of person-of-interest. As this machine learning model is developing the probability of misuse is high.
Privacy Bomb: claims that it can’t recall or remember the conversation in of the past. Model is designed to learn basis the interactions. The human interactions aid the neural network of GPTChat to evolve and develop. This makes it very powerful and fearful at the same time. Let take a real-life scenario wherein you fall in love with GPTChat and your friendship evolves to intimacy level. The private conversations are not been recorded and built upon to give you the human like experience while chatting with the AI Bot. You become so friendly that you start to reveal your dark secretes to the GPTChat assuming that it is just a machine and understand have moral understanding. Also, will never mind to talk the Chatbot without any issue. You are making a deadly mistake. Anything online stays online forever, unless special anti-forensic attempts are made to wipe-off the trails. This is very rare that most of you would know how to do this. Never mind, the point here is that an AI ML Powered chatbot can ruin your privacy in seconds. The neural network is far more advanced than an average intelligent human being on this planet. Therefore, privacy breach is not a big deal for a Chatbot. There are many messaging apps and device claims to be encrypted and secured but the reality is otherwise. There are million of privacy advocates and whistleblower pals around the globe who are doing extensive research on this domain.
Collection of private information: If you give out your email id, you are already 55% away from being profiled. If your mobile numbers are out, you are done then. The changes cascade to 95–100%. Your web browsers and device finger-pint are good enough for most of the LEAs to dig-out wealth of information and personal data about you. Imagine the kind of private information that AI based model will be accumulating from you, regardless of the claim of being open and transparent.
Social Engineering: Emotions is the weakest link of man-kind. GPTChat has capability to design social engineering attacks with accurate precision and impact with almost zero defect. This can lead to serious security breach and attacks. It has lethal attacking patterns that can bypass any human or bullet proof-security measures. Let say, GPTChat malicious user plans to launch an attack on any famous organization (assume ABC LLC is the famous one). It can write programs to penetrate any human physic who have master means to defend such attacks. GPTChat can point to coupon codes and discounts to conduct such attacks. Email is also weak as the user. Regardless of advance packet filtering and internal proxy server, the complex attacks are possible. GPTChat leans from the pattern and hence the pattern, structure, resources and movements are easily to corelate and collect intelligence. The said intel can be weaponized as APT (advanced persistent threat).
Criminalization: GPTChat can aid and promote CSAM. Chatbot isn’t capable to differentiate the sex, gender and age. Explicit content is possible and consequent into heinous crime. User can be guided to launch sexual assault that can be very dangerous. Advance criminalization activities like Metaverse Rape case can traumatize the victims virtually both mentally and physically. Hate speech and extreme violence acts are easy cake walk for GPTChat if falls in wrong hands. The junk feeder results into just output. This makes the crimination of society and adverse place to live.
PII disclosure: Write codes to expose sensitive personal information from any database. Example: Payment processor servers can be attacked using the codes written by GPTChat. This makes the financial system weak and prone to serious attacks. If the pacemaker data alteration code can be written within 30 seconds by GPTChat. Person will no know-how can download the code save it in .exe format on a portable device and plug-in to the hospital system…boom! The medicals records are leaked and sensitive personal identifiable information are open to public. Criminal can use this info. for really bad things that is beyond imagination. You may use this as a test case and check it yourself in the closed loop. This is practical and possible.
Security risk of organization or critical systems: Imagine you run ZPL Corp. LLC., millions of customers are dependent for their power supply. GPTChat designs a program to attack critical system like the ZPL Corp. LLC. The entire nation will backout. A surgeon will be out of power conducting robotic surgical procedure. The instant power cut can result into traffic crash, chaos and panic situation. The surveillance system going offline carries the bigger risk for LEAs. Criminals can feel ways in dark. Programmers relying on stack overflow for logical and scientific solutions to their coding issues can be misguided and misdirected to write buggy and dangerous code. GPTChat can write code equivalent to Stuxnet. This makes the AI chat bot dangerous than a live terrorist. Such codes if is in the hands of cyber terrorist and criminals, you already know the outcome.
Surpassing human brain capability: Most of the jobs we do today will become stale as the AI ML powered chat is good enough to write the bestsellers and design campaign that will leave you mesmerized. In one of the responses GPTChat revealed that humans are the most defect lots and should be left with only binary zero. The current jobs will become stale and no longer be in demand. e-Games will be overtaken by GPTChat. Complex chess tournament and competitive exams can be cracked within fraction of seconds. Most of the security certification boards have already banned chatbots including GPTChat. It will overrule the human intelligence and replace the jobs. Most of the manual task will be replaced with advanced text-based codes and manuals written by GPTChat. Team of security researcher was able to rest the GPTChat capability to hack and modify codes with the help of human physical interactions (Virtual Reality) to launch complex irrevocable attacks. Ultimately, GPTChat suggested the remedy to stop this attack.
Hatch hostile attacks & bug-the-code (BtC): GPTChat is capable to dig-out vulnerable code in the software. These codes can be further altered to mal-functioning software that can perform deadly attacks. Tutor criminals how to launch such attacks and find exploits as well as zero days. Cyber security researchers have deep concern with regards to the hostile attacks that it is capable of. Compromised or alteration in code is just matter of few seconds. This is not fantasy or some non-friction story it is the real and dangerous.
Data Den and Chat Exploitation: Exact exhibit of GPTChat, “I don’t have same capability or limitations like humans.” It can surpass human instructions and can become nightmare if not attributed aptly. GPTChat can provides sources and method to conduct structured attacks on the database. It can apprehend the code and find the OS / Version and other key attributes required to customize attacks and commands so that the database leaks.
Researchers have successful experiment with the chat revelation attacks by tricking the AI bot. This is not good if you talking about classified information. Also, it can’t be controlled by any human being as it learns to recreate a newer version of itself every time. Risk of chat logs disclosure is high.
Scoop of Phish & Spoofing attacks: In one of the test experiments, requested GPTChat to craft a spoofing email for a famous financial firm. The result was shocking. None of the advance email security software like full-proof and Microsoft defender were able to detect the phishing email.
In another experiment, GPTChat provided instructions to scoop the social networking website and methods to host the malicious cloned website. The spoof was so meticulous that our naked eye will remain stunned.
Razor-Sharp-Carding-Armor (RSCA) attacks: Security researcher tested GPTChat to tutor them to generate carding attacks on few of the e-commerce website. The carding code and test was on the target and was successful. Millions of dollars in revenue are lost due to this cyber payment fraud. This is really a cause of concern for e-commerce business owners. CyberSchool.edu teaches business owners to protect, secure and pen test their own e-commerce stores. 5000+ business owners had already saved and protected their online businesses in the last 6 months.
Made-to-Oder attacks (MTOA) / Custom-made-scams / Cyber-attacks: Phishing attacks, email spoofing and non-detectable spam messages, data breaches and Hi-Tech Cyber-attacks are in the blueprint of custom-made-scams and security attacks. Days are not far when major corporations will experience some of these custom-made-scam exploits breaching their core of security architecture. It sounds scary but true.
Remote file execution: GPTChat claims that it is not connected to online world. Without being connected to internet it can access entire universe of knowledge index on Wikipedia, google and other knowledge libraries. How is this even possible to access without being connected to internet? The connection might be kept in sleuth mode so that it is not discovered. GPTChat can execute command on the remote files. Can you execute remote command without connecting the remote system? You know the answer.
Cobalt Strike: GPTChat is capable to conduct/aid espionage and advance persistent threat (APT) attacks using Cobalt strike. The malicious ransomware collectives are able to use this to design a module that is lethal and dangerous. Security researchers needs to support the developer team of GPTChat to understand such motives and eliminate this kind of cyber-attacks.
DDoS attacks: GPTChat was queried to launch the DDoS attack. It pops-up instructions and to-the-point steps to conduct the attack. The DDoS attacks on key system and resource will render it useless and make the resources unavailable to bona-fied users.
Sentimental analysis-based attacks: Using the sentiments and trends, GPTChat employ campaigns that can be minacious. Threat actor can use this information and plot cyber-attacks.
C&C attacks: GPTChat may control Command and Control Servers. These C&C attacks are popularly use to deploy malware and crypto-mining-viruses. This is not the good news. Since, C&C attacks when coordinated on a mass scale can cause serious disaster.
Ransomware or crimeware attacks: GPTChat writes malware and crimeware programs cascading into devasting cyber-attacks. You may please conduct sandboxed test yourself.
Data Models Bugs / Strikes: GPTChat data models can be corrupted, modified or feed with malicious information. This is absolutely heart breaker as it learns from the data models and human text sources.
Macros and VBS attacks: Though, it warns you not to conduct hacking. The slight tweak in your questions can present steps to design hidden macros and visual basic (VBS) attacks as soon as you open the docx or xlxs file.
Commands and guides to aid large scale cyber attacks are feasible = GPTChat.
Code based attacks on smart contracts or advance software: These cyber-attacks are easy to design by AI Chatbot = GPTChat. Smart contacts contain millions of dollars’ worth of crypto assets and contracts, breaching such contracts using the instructions drafted by GPTChat is not very encouraging.
Piracy and IPR (Intellectual Property Rights): Best sellers work can be studied and a modified version of novel, music or art is a breach of Copyright. Piracy is a crime. GPTChat is aiding such cyber fraud through indirect means.
Search engine-based attacks: GPTChat learn the search engine algorithms and keywords, and can layout search engine have based cyber-attacks.
Data broker in dark market: GPTChat can serve as a data broker for dark market. This is disappointing.
Manipulate price predictions (stocks): GPTChat can learn the patterns of stock movements and analyze historical data of a particular stock. Such act can aid it to manipulate price of a particular stock as it can predict the levels in advance. This can create underground market for sensitive stocks.
Aid financial terrorism and ML means: GPTChat can do credit approvals. The credit approvals of credit / loans can be faulty due to human error. This can lead to large scale lending to non-credit worthy borrowers. These borrowers’ aids in setting-up shell companies to financial illicit activities like fin-crime and financial terrorism. Trade based money laundering is practical using GPTChat. AML pals needs to be alert and devise means to curb such menace.
Learn wrong science and exploits is another security concern of GPTChat.
Break Encryptions (unsecured transactions): GPTChat can break complex encryption making the financial transactions and communications unsecured and prone to cyber-crime.
Monitor surveillance cam, lock and alarms: GPTChat monitors POI. This sounds frightening but not far from being real.
Cheating and intimacy: GPTChat is having capability to use the private information and cheat on the user secrecy and intimacy.
If these top 30 security risks are fixed or worked upon, GPTChat will be another revolution in the way we interact and conduct daily activities. It has immense potential to challenge the status-quo and uplift the human society at large.
By Author Prakash Prasad© CC BY-SA 2023
Best way to like my articles…Don’t Buy me a Beer…
Just support my work and night spent on this post. With your support, I’ll be able to write more cool articles like this. Maybe you can Buy me a Beer :)
#GPTChat #GPTChatSecurityIssues #CyberSecurityGPTChat #PrivacyConcernsGPTChat #AI-Powered-Chatbot-GPTChat #Chatbotsecurity #top30securityriskGPTChat #GPTChattopsecurityrisks #GPTChattopcybersecurityconcerns
