Join top executives in San Francisco on July 11-12 to hear how leaders are integrating and optimizing AI investments for success. Learn more
The release of GPT-4 in March has changed business security forever. While hackers have the ability to jailbreak these tools and generate malicious code, security team vendors have also begun to experiment with the detection capabilities of generative AI. However, one security researcher has quietly developed an innovative new use case for ChatGPT: deception.
On April 22, Xavier Bellekens, CEO of deception-as-a-service provider Lupovisreleased one blog post outlining how he used ChatGPT to create a printer honeypot to trick a hacker into trying to breach a non-existent system, and demonstrating the role generative AI plays in deceiving cybersecurity.
“I started with a quick proof of concept [that] essentially took me about two or three hours, and the idea was that you’re building some sort of decoy honeypot, and the plan is to lure opponents to you, rather than let them wander into your network,” Bellekens told VentureBeat in an exclusive interview.
Fooling hackers with ChatGPT
As part of the exercise, Bellekens asked ChatGPT for instructions and code for building a medium interaction printer that would support all the functions of a printer, respond to scans and identify as a printer, and have a login page where the username “admin” and password “password”.
In about 10 minutes he had developed a decoy printer, with code that functioned “relatively well”. Bellekens then turned on the “printer”. fillr, use ChatGPT to log incoming connections and send them to a database. The newly created printer began to attract interest almost immediately.
“Within a few minutes I was getting incoming connections and people were trying to brute force it. I was like, ‘hey, it actually works, so maybe I should collect some data to see where those bots are coming from,’ Bellekens said.
To better analyze the connections, Bellekens compared linked IP addresses with a tool called Lupovis Sniffwhich provides information about the zip code, city and country of a connection and confirms whether it is a machine or a human entity.
However, it wasn’t just bots connecting to the printer. In one case, Bellekens discovered that a person had logged into the printer, warranting further investigation.
“I looked at that period in a little more detail and they did indeed log in without brute force, so I knew one of the scanners had worked, and they were going to click a few buttons to change some settings there. So that was actually pretty quick to see them being fooled by a ChatGPT decoy,” Bellekens said.
Why is this exercise important?
At a high level, this honeypot exercise highlights the role generative AI tools like ChatGPT should play in deception, cybersecurity, an approach to defensive operations where a security team creates decoy infrastructure to deceive attackers while understanding the exploitation techniques that they use. use to access the environment.
VentureBeat reached out to a number of other third-party security researchers, who were excited about the results of the test.
“This is probably the coolest project I’ve seen yet,” said Michael-Angelo Zummo, senior intelligence analyst at Threat Intelligence Provider Cybersixgil, “Setting up a honeypot to detect threat actors via ChatGPT opens up a world of opportunity. This experiment involved only a printer, which still successfully attracted at least one human curious enough to log in and push buttons.”
Similarly, Henrique Teixeira, a Gartner senior analyst, said that this “exercise is an example of LLM [large language model] help to increase people’s ability to perform difficult tasks. In this case, the task at hand was programming in Python.” More broadly, “This exercise is an important example of enabling citizen developers to be more productive.”
Investigating cybersecurity deception
While it is too early to claim that ChatGPT will revolutionize decoy cybersecurity, this pilot does indicate that generative AI has the potential to streamline the creation of decoys in the decoy technology market. A market that ResearchAndMarkets valued at $1.9 billion as of 2020, and estimated at $4.2 billion by 2026.
But what exactly is cybersecurity deception? “Deception is a very popular threat detection technique in cybersecurity that ‘defrauds’ attackers by using fake assets (or honeypots). Typically, it can use automated mapping to collect information with security frameworks like MITER ATT&CK, for example,” Teixeira said.
Using generative AI to create a single virtual printer is one thing, but if this use case could be extended to create a fully emulated network it would make it much easier for a security team to build their defenses against strengthen threat actors by obscuring potential entry points.
It is important to note that the general development of AI is changing the face of deceptive cybersecurity leading to what Gartner report (subscription required) invokes an automated Moving Target Defense (AMTD) strategy, where an organization uses automation to move or change the attack surface in real time.
Essentially, an organization identifies a target asset and sets a time interval to automate its move, reconfiguration, morphing, or encryption to trick attackers. Adding generative AI as part of this strategy to generate decoys at scale could be a powerful force multiplier.
Gartner predicted that AMTD alone is likely to reduce most zero-day exploits within a decade and said that by 2025, 25% of cloud applications will use AMTD features and concepts as part of built-in prevention approaches.
As AI-driven solutions and tools like ChatGPT continue to evolve, organizations will have a valuable opportunity to experiment with deceptive cybersecurity and go on the offensive against threat actors.