Artificial intelligence experts are cautioning the general public to prioritize strong passwords and timely software updates on their devices to combat a new form of cyber-threat known as “AI-driven computer worms.” These sophisticated worms are capable of launching customized attacks on devices, depleting processing power and extracting information as they search for new targets.
In a recent study, a team from the University of Toronto, led by Nicolas Papernot, the Canadian Institute for Advanced Research AI chair, revealed that publicly accessible AI models can empower a worm that can adapt its attack strategy in real-time as it spreads among internet-connected devices like laptops, printers, and cameras. The research, conducted in collaboration with the Vector Institute, was shared with national science, security, and defense entities before publication.
Papernot, an associate professor of computer engineering and computer science at U of T, emphasized the importance of not neglecting software update notifications and regularly changing passwords during a panel discussion. He stressed the necessity of utilizing multi-factor authentication and ensuring prompt deployment of software patches by organizations.
Unlike traditional computer viruses, worms propagate from one machine to another without human intervention. The U of T researchers explained that the worm they developed in their lab acquires information as it traverses devices. Each breach exposes passwords and vulnerabilities that can be exploited to infiltrate additional machines.
These AI-driven worms have the ability to learn from warning alerts about newly identified vulnerabilities, surpassing the pace at which software patches are released to halt them. The researchers highlighted that while some issues can be resolved through software updates, others, such as weak passwords and inadequate IT setups, require more comprehensive solutions beyond patch deployments.
Papernot underscored that the evolving nature of AI-driven worms poses a significant cybersecurity risk, as they can design unique attack strategies tailored to each victim device they encounter. This individualized approach makes it challenging to thwart their spread by fixing a single vulnerability or a small set of vulnerabilities.
The cost-effectiveness of constructing and deploying these AI-driven worms is a cause for concern, according to Papernot. Lower costs enable hackers to target a larger number of victims, as the worm utilizes compute resources stolen from infected devices, resulting in minimal additional costs for subsequent attacks.
A survey conducted by the Communications Security Establishment (CSE) in January revealed that while a majority of respondents regularly update their device software and use complex passwords, there is room for improvement in adopting unique passwords consistently. Papernot emphasized the necessity of enhancing cybersecurity measures in critical sectors such as power grids, water supply systems, hospitals, schools, and grocery stores, as these systems are vulnerable to online threats.
The study findings underscore the urgency for individuals and organizations to enhance cybersecurity practices by implementing robust password strategies, promptly updating software, and adopting multi-factor authentication to mitigate the risks posed by AI-driven computer worms.