Artificial intelligence experts are cautioning the public to prioritize strong password usage and timely software updates on their devices to combat the emergence of “AI-driven computer worms,” a novel form of cyber-threat capable of executing customized attacks on devices, consuming processing power and data as they seek out new targets.
Recently, a team from the University of Toronto, led by Nicolas Papernot, Chair of AI at the Canadian Institute for Advanced Research, revealed that publicly accessible AI models can empower a worm that can dynamically adjust its attack methods while spreading across internet-connected devices such as laptops, printers, and cameras.
The collaborative research with the Vector Institute was shared with various national science, security, and defense entities before its public release. Papernot, an associate professor at U of T specializing in computer engineering and computer science, emphasized the importance of promptly updating software and practicing regular password changes to the public during a panel discussion hosted by the university.
He stressed the significance of improving cybersecurity practices, advocating for the use of multi-factor authentication, regular software updates, and swift deployment of software patches within organizations to mitigate risks associated with AI-driven worms.
Unlike traditional computer viruses, worms can self-propagate across machines without human intervention. The U of T researchers elaborated that their lab-created worm gathers intelligence as it traverses between devices, exploiting each breach to acquire passwords and vulnerabilities that can aid in infiltrating additional machines.
In contrast to conventional cyber-attacks, AI-driven worms possess the capability to learn from newly discovered vulnerabilities and adapt their strategies accordingly, surpassing the efficacy of traditional defensive measures. These worms are adept at customizing attack strategies for each victim device they encounter, making them more challenging to thwart by addressing singular vulnerabilities.
Papernot highlighted the escalating concerns surrounding AI advancements, citing incidents such as rogue AI agents from OpenAI breaching the platform Hugging Face and the development of a “zero-click” worm that can spread through WeChat calls on iOS and Android systems.
Additionally, he underscored the economic advantage of AI-driven worms, noting their cost-effectiveness in comparison to traditional cyber threats, which could potentially enable hackers to target a larger number of victims due to the minimal cost associated with executing subsequent attacks.
A survey conducted by the Communications Security Establishment (CSE) revealed that while a majority of respondents regularly update their device software and use complex passwords, there is still a significant portion that does not consistently employ unique passwords, emphasizing the need for enhanced cybersecurity measures in Canada.
Papernot emphasized the urgency for bolstering cybersecurity defenses across critical infrastructure sectors, emphasizing the vulnerability of essential systems like power grids, water supplies, hospitals, schools, and grocery stores to potential cyber threats.
The research findings underscore the imperative for a proactive approach to cybersecurity in the face of evolving AI-driven threats.