Artificial intelligence experts are issuing a cautionary alert, advising individuals to utilize robust passwords and promptly update their device software to counteract the emergence of “AI-driven computer worms.” This new type of cyber-threat can launch tailored attacks on devices, depleting resources and data as they seek out new targets.
A recent study from the University of Toronto, spearheaded by Nicolas Papernot, the AI chair at the Canadian Institute for Advanced Research, demonstrated that publicly accessible AI models have the potential to power a worm that can dynamically adjust its assault as it spreads across internet-connected devices like laptops, printers, and cameras.
This research, carried out in partnership with the Vector Institute, was shared with key national bodies before its release. Papernot, an associate professor at U of T specializing in computer engineering and computer science, now emphasizes the importance of heeding software update notifications and regularly changing passwords.
“We must prioritize cybersecurity hygiene,” Papernot emphasized during a U of T panel discussion. “The days of using weak passwords are over. Multi-factor authentication is essential. Keeping devices up to date is crucial, and organizations must adapt their processes to ensure swift deployment of software patches.”
Unlike traditional computer viruses, worms propagate from one device to another without human intervention. The AI worms devised by the U of T team gather intelligence as they traverse devices, exploiting weaknesses and passwords to infiltrate additional machines. If left unchecked, these worms could access the internet, learning from alerts about newly discovered vulnerabilities and outpacing efforts to patch them.
Papernot warns that these AI-driven worms, in addition to being more effective than previous threats, are also significantly cheaper to develop and unleash. The reduced costs make it easier for hackers to target a larger number of victims, as the worm operates using resources stolen from compromised devices, effectively lowering the cost of subsequent attacks to near zero.
A recent survey by the Communications Security Establishment found that a large percentage of respondents regularly update their device software and use complex passwords. However, there is a notable gap in consistently using unique passwords. Papernot advocates for enhanced cybersecurity measures in Canada, particularly for critical infrastructure sectors exposed to online threats.
The study sheds light on the imperative need to fortify cybersecurity practices in the face of evolving AI threats, emphasizing the importance of proactive measures such as strong passwords and timely software updates.