Artificial intelligence experts are cautioning the public to utilize robust passwords and promptly update software on their devices to combat the emergence of “AI-driven computer worms,” a new type of cyber-threat capable of launching tailored attacks on devices, depleting computing resources and data as they search for new targets.
A recent study by the University of Toronto, led by Nicolas Papernot, the Canadian Institute for Advanced Research AI chair, revealed that publicly accessible AI models can empower a worm that can adjust its attack strategies dynamically as it propagates across internet-connected devices like laptops, printers, and cameras.
The research, conducted in partnership with the Vector Institute, was shared with key national science, security, and defense entities before publication. Papernot, an associate professor of computer engineering and computer science at U of T, stressed the importance of not disregarding or delaying software updates and the regular alteration of passwords.
“We can no longer be negligent in our cybersecurity practices,” Papernot emphasized during a U of T-hosted panel discussion. “We must avoid password reuse, implement multi-factor authentication, ensure our devices are up to date, and organizations should streamline processes to swiftly deploy software patches.”
Unlike traditional computer viruses, worms spread autonomously between machines without human intervention. The AI-driven worm developed by the U of T researchers collects data as it moves between devices, exploiting every breach to uncover passwords and vulnerabilities that can be exploited on other machines.
In an uncontrolled environment, such a worm could access the internet, learn from warnings about newly identified vulnerabilities, and outpace software patches meant to thwart them. According to U of T, some vulnerabilities can be mitigated with software updates, but others, such as weak passwords and inadequate IT configurations, cannot be addressed solely by patching.
Papernot highlighted the unique threat posed by AI-driven computer worms, which can craft customized attack strategies for each victim device they encounter, unlike traditional attacks with fixed scripts. This adaptability makes it challenging to halt their spread by addressing individual vulnerabilities.
The lower cost of developing and deploying AI-driven worms makes them not only more effective but also more accessible to hackers, enabling them to target a larger number of victims. Samir Chhabra from Innovation, Science, and Economic Development Canada noted that these worms leverage stolen computing resources, effectively reducing the cost of subsequent attacks to nearly zero.
A survey by the Communications Security Establishment found that while a majority of Canadians regularly update their software and use complex passwords, there is still a gap in employing unique passwords consistently. Papernot emphasized the need for enhanced cybersecurity measures, particularly concerning critical infrastructure vulnerabilities exposed to the internet.
As concerns about AI escalate, the imperative for robust cybersecurity practices becomes increasingly urgent. Papernot’s research underscores the necessity for proactive measures to fortify cybersecurity in Canada and protect against evolving cyber threats.