AI vs AI: How AI is being leveraged to launch sophisticated attacks

NEW DELHI: In a world where Artificial Intelligence (AI) has made its presence felt in every aspect of our lives, it's imperative to understand the profound impact it has on our personal data security.

While AI has brought us personalised recommendations, advanced healthcare diagnostics, and countless other benefits, it has also ushered in new and more sophisticated digital threats. Let's explore the implications and impact of AI on our lives and the critical need to safeguard our personal information in this new era.

As AI technology advances, so do the tactics of cybercriminals, who are now leveraging AI to craft more convincing social engineering attacks.

Deepfake Technology: With AI, scammers can produce incredibly realistic video or audio impersonations, potentially tricking you into believing a familiar person is requesting sensitive information or money.

Spear Phishing: Unlike widespread phishing scams, AI allows for targeted spear phishing, where fraudulent messages are finely tuned to fit your profile, increasing the likelihood of deception.

Intelligent Attacks: AI can analyse vast amounts of data to pinpoint vulnerabilities, enabling attacks that seem to come from trusted sources.

Credential Guessing: By analysing patterns, AI can predict passwords and usernames, facilitating unauthorised account access.

Simulated Interactions: AI can now create fake video calls that are nearly indistinguishable from real ones, duping users into sharing private information.

In essence, AI is giving scammers a digital "disguise kit" that makes their deceptions hard to spot. It's crucial to be skeptical and double-check whenever you're asked for personal info or money, even if it seems to come from someone you know.

Deepfake technology:

Deepfake technology creates highly convincing fake videos or audio recordings of individuals, often impersonating someone the target knows and trusts. While it may serve legitimate functions in the entertainment industry, such as de-aging actors, it simultaneously presents a heightened risk for sophisticated vishing attacks.

Deepfake technology has been manipulated for scams in several alarming instances. In one recent case, scammers duped a 73-year-old Kerala man by employing deepfake technology to mimic a former colleague’s voice and appearance, convincing him to transfer money. The incident is part of a multi-million rupee scam under investigation by the police.

The media has recently brought to light some shocking instances of the nefarious use of similar technology. A deepfake video starring the popular actor Rashmika Mandanna sent shockwaves across the internet, underscoring the potential risks associated with AI.

In a similar vein, singer Chinmayi Sripada has expressed apprehension over the sinister misuse of deepfake AI technology, particularly as loan apps allegedly employ manipulated images of women to extort money. These disturbing occurrences underscore the exploitation of deepfake technology for generating fabricated scenarios that place undue pressure on unsuspecting victims.

Along the same lines, the "Mimics of Punjab" episode from Darknet Diaries podcast also sheds light on the rising trend of these sophisticated scams, particularly affecting individuals with connections in Canada from Punjab, leading to financial loss and personal distress.

Future of sophisticated attacks:

AI-driven smart home devices, designed to optimise household efficiency and energy use by adapting to our usage patterns, can become a security concern if compromised. Hackers exploiting such breaches might discern when the house is empty, setting the stage for break-ins.

Moreover, if these devices are connected to sensitive accounts, like your email or banking, it could open the door to more severe threats like identity theft or financial fraud. This situation highlights the critical need for careful management of the data we permit our AI systems to handle.

Examples of AI-based tools that threat actors misuse:

Advancements in AI have introduced powerful language models like ChatGPT and GPT-3, but alongside their benefits, they've also sparked concern for their potential misuse.

Variants of these models have been adapted by cyber criminals; one such adaptation, known as FraudGPT, is specifically tailored for malicious activities. It assists in creating sophisticated spear-phishing campaigns, generating hacking tools, and facilitating various forms of digital fraud.

Adding to the complexity of the threat landscape is the emergence of an AI-based bot called Abrax66, which has surfaced with several advanced versions. This bot can perform a range of illegal activities, most notably executing call phishing operations using an array of different synthesised voices. The rise of such tools underscores the urgent need for awareness and stronger cyber security measures in the face of increasingly complex cyber threats.

Proactive measures for personal protection:

Exercise caution with the details you share online. A larger digital footprint can make it simpler for cybercriminals to engage in social engineering tactics to accomplish their nefarious objectives.

When installing Android apps, be cautious of granting unnecessary permissions, especially access to your device's storage, as it could lead to personal photos being accessed and misused.

Be cautious about clicks and links, avoid clicking on suspicious links or attachments in emails or messages, as they may lead to phishing websites or malware downloads. Verify the authenticity of links before clicking.

Be wary of unexpected video calls or phone calls, even if they appear to come from familiar contacts but originate from an unfamiliar number.

Create complex and unique passwords for your online accounts. Consider using a password manager to keep track of them securely.

Keep your operating system, browsers, and software up to date. Updates often contain security patches that protect against vulnerabilities.

In the realm of online services, while privacy policies may reassure us that personal data is stored on our devices and only analytics are shared with consent, it's crucial to understand that this does not render us invulnerable.

Unforeseen security gaps can emerge, potentially allowing unauthorised access to our data, regardless of the stated safeguards. It is wise to be cautious about the data we agree to share and to remain aware of the inherent risks, as complete security cannot be guaranteed.