Artificial intelligence experts are cautioning the public to prioritize strong passwords and timely software updates on their gadgets to counter the emergence of “AI-driven computer worms,” a novel category of cyber-threat capable of launching tailored assaults on devices, draining resources and data as they seek out new targets.
Recently, a team from the University of Toronto, led by Nicolas Papernot, the Canadian Institute for Advanced Research AI chair, unveiled that publicly accessible AI models have the potential to empower a worm that can adjust its attack strategies in real-time while propagating between internet-connected devices like laptops, printers, and cameras.
The collaborative research with the Vector Institute was communicated to key national science, security, and defense entities before its public disclosure. Papernot, an associate professor at U of T specializing in computer engineering and computer science, emphasized the importance of not neglecting software updates and advocating for regular password changes.
“We can no longer be lax with our cybersecurity practices,” Papernot stressed during a panel discussion at U of T. He highlighted the necessity for multi-factor authentication, consistent software maintenance, and expedited deployment of software patches by organizations.
Unlike traditional computer viruses, worms can autonomously spread from one machine to another without human intervention. The U of T researchers highlighted that the worm they engineered in a controlled environment gathers intelligence as it traverses devices, exploiting vulnerabilities and weak points to infiltrate new systems.
In uncontrolled scenarios, such a worm could infiltrate the internet, learning from warning alerts about newly identified vulnerabilities, surpassing the speed of software updates aimed at thwarting them. Papernot noted that some issues could be rectified through software updates, but vulnerabilities stemming from human errors like weak passwords and inadequate IT configurations pose challenges that cannot be solely mitigated by patches.
Papernot underscored that the AI-driven worms are not only more efficient than previous threats but are also more cost-effective to develop and deploy. This affordability may enable hackers to target a larger number of victims, amplifying cybersecurity risks.
A study by the Communications Security Establishment (CSE), the government’s cybersecurity agency, revealed that a large percentage of respondents regularly update their device software and use complex passwords. However, the survey also exposed a gap in consistently using unique passwords.
Papernot emphasized the urgent need to enhance cybersecurity measures in Canada, especially concerning critical infrastructure like power grids, hospitals, and schools, which are vulnerable due to their internet exposure.