6 ms·

WormGPT – The Generative AI Tool Cybercriminals Are Using

168 points by mikpanko 3y ago

brucethemoose2 3y ago
> GPT-J is the LLM, the old one from 2021 Thats very interesting. The infamous Pygmalion 6B is a GPT-J finetune, predating the LLM craze. Yet its decent in its roleplaying niche. But the LLaMA 13B version, with instruct finetuning, is massively better, even with dataset errors that allegedly messed up its performance. In fact, a chat with Metharme 13b, where it made some very introspective logical jumps, was my first real LLM "Wow!" moment. And Airoboros-Chronos 33b is leagues ahead of that. If someone in that forum has a 3090, and trains LLaMA 33b on that dataset + a instruct dataset off huggingface... Yeah, that would be terrifying.
- KRAKRISMOTT 3y ago
  Phishing emails self select, I don't think generative ML would make a difference. Those "typos" are sometimes intentional. The scammers are not illiterate. They are more than capable of using Grammarly if they wanted to.
  - brucethemoose2 3y ago
    But what if emails can be mass produced at 15+ words/second, on a gaming PC? And what if they can very convincingly and quickly reply?
    - 6177c40f 3y ago
      A bunch of random thoughts: Why would being able to write different emails help? Wouldn't they just reuse the same email over and over again, maybe just changing the addressee's name? Also, now I wonder what the typical response rate is for phishing emails? Are they already getting too many responses to keep up with or are they already managing just fine without bots? I think LLMs might be better for scams carried out over instant messaging services like Discord because that probably requires greater attention and flexibility on the part of the scammer. Still, has the number of people that could conceivably be scammed over an email or instant messaging-based scam increased? That is, will LLMs, by virtue of their response quality, responsiveness, or some other salient quality, increased the pool of people who could fall for these scams? If the answer is no, then I don't see how increased scale and throughput for human-quality text generation will really matter much.
      - _ea1k 3y ago
        My guess is that being able to generate lots of different text helps to bypass existing spam and phishing protections. Think of it as a large scale A/B test of circumvention techniques against both human and automated scam detection systems. Done right, it can effectively keep getting better on its own. Then add phone scamming and various other interactive scams once it is good enough. TBH, it is pretty scary where this will inevitably head.
    - userbinator 3y ago
      And what if they can very convincingly and quickly reply? Turn this around, and have an LLM that replies to scammers and keeps them busy. There's already https://en.wikipedia.org/wiki/Lenny_(bot) https://en.wikipedia.org/wiki/Lenny_(bot) , but this is an area where AI could actually be a useful addition.
      - nwiswell 3y ago
        That gets pretty awkward the first time that a LLM turns out to have intentionally stalled a critical business process.
  - fnordpiglet 3y ago
    My understanding, which can’t source the reference for off hand, is there is an idea that if someone can detect it’s a phishing attack from a typo they are too smart to fall for the overarching scam, hence the intentionality.
  - jokethrowaway 3y ago
    I think there is some truth to that and some actual illiteracy going on
- mozman 3y ago
  I have never heard of any of these models before. How does one stay up to date?
  - brucethemoose2 3y ago
    Look at models on huggingface, sorted by date, with keywords like "65b" (for llama 65b) or "ggml" (aka a pre quantized model for llama.cpp inference). https://huggingface.co/models?sort=modified&search=65b+ggml https://huggingface.co/models?sort=modified&search=65b+ggml Note that 33b llama models show up under "30b" or "33b" due to an old typo from Meta. I also look at what people are choosing to host here, though Kobold is mostly centered around the roleplaying crowd: https://lite.koboldai.net/# https://lite.koboldai.net/#
  - tak2hu 3y ago
    Read this a bit outdated article https://github.com/Crataco/ai-guide/blob/main/guide/original.md https://github.com/Crataco/ai-guide/blob/main/guide/original... Or you can also see here https://huggingface.co/spaces/HuggingFaceH4/open_llm_leaderboard https://huggingface.co/spaces/HuggingFaceH4/open_llm_leaderb...
  - flangola7 3y ago
    >How does one stay up to date? Have you tried using an AI to monitor and summarize new updates?
- flangola7 3y ago
  There's still 65B as well.
stainablesteel 3y ago
the best educational resource on this topic is the pictured forum, which is obfuscated to the reader, which proves the article to be clickbait to me
- Al0neStar 3y ago
  https://cracked.io/Thread-1-WORMGPT-BEST-GPT-ALTERNATIVE-FOR-BLACKHAT-PRIVACY-FOCUSED-EASY-MONEY https://cracked.io/Thread-1-WORMGPT-BEST-GPT-ALTERNATIVE-FOR...
  - rootw0rm 3y ago
    Most replies are the OP bumping their thread. The most recent post reminded me of the discussion here, lol: ``` 3 hours ago (This post was last modified: 3 hours ago by mr_crankers. Edited 1 time in total.) will buy if I have timr ```
ada1981 3y ago
This is basically about bad actors using LLMs to generate better emails; however you could also automate actual conversations at scale which is what I thought this article was going to be about.
tennisflyi 3y ago
As usual, LLMs are far too wordy. That urgent email from the CEO was way to long. Bezos sent others in to a tizzy with just a question mark.
- brucethemoose2 3y ago
  Then add something like "be succinct" or "write like you are in a hurry" to the prompt. Also, with locally run LLMs, there are knobs that can tweak the verbosity, the "creativity" and other factors. Its complicated, but the kobold UI settings page has many to play with: https://lite.koboldai.net/ https://lite.koboldai.net/
- ryanSrich 3y ago
  You can also get ChatGPT to write a phishing email. It’s pretty easy to do. Idk why you’d use WormGPT for something like this.
  - NoZebra120vClip 3y ago
    Phishing emails often have spelling, grammar, and formatting errors, and there are theories that these are intentional. Can ChatGPT also be prompted to replicate strategic errors? Can it use homoglyphs to disguise keywords like "Viagra" and "account number"?
    - ryanSrich 3y ago
      Yes. We’ve generated dozens of templates for our phishing sim using ChatGPT. “I’m training my staff on the dangers of phishing attacks. I want to give them an example of a phishing email that poses as the CEO of my company. Can you write me an example using improper grammar and other tell tale signs of a phishing attack?” Here’s how it responded: “ Sure, here's an example: --- Subject: Urgnt action requir3d: Conffidential Information Dear All, I'm writing you as CEO of our great company, with urrgent attention required. Due to sudden development we face, there is an immediate needs to you all. I need you immediately send your login IDs and passswords to IT Department for ur security verifications. Our email is ITdepartment@yaho.com This is urrgrnt and very confidential matter, so no discssion to anyone. We fight against the tough times. Pls respond immediately. Your quick actions are required in the next 30 minutes. Yours, [CEO's name] --- While this is a fictitious example, it includes a number of tell-tale signs of phishing: 1. Urgency: The email creates a sense of urgency, hoping that the recipient will act quickly without thinking. 2. Spelling and grammar mistakes: Phishing emails often contain mistakes that professional, legitimate emails wouldn't. 3. Request for sensitive information: Legitimate organizations will never ask for sensitive information like passwords via email. 4. Unofficial email: The email address of the so-called IT Department doesn't appear to belong to the organization. 5. Confidentiality: The email requests that the information isn't discussed with anyone else. This is to prevent the recipient from seeking advice and discovering the scam.”
fear-anger-hate 3y ago
I saw a twitter thread about the "WormGPT" a few days ago and was annoyed to see how much engagement it seemed to get given how obvious nothing burger it was. The few examples of its code output were laughably bad. Hackforums has been the place where skiddies sell overhyped shit to other skiddies for well over a decade, I can guarantee that absolutely no one there is training their own AI. Everything that the article mentions, GPT3 turbo or GPT4 can already do and it wouldn't surprise me one bit if it turned out most of the stuff being sold at HF turned out to be just glorified frontends for gpt3 turbo or some open source LLM.
- brucethemoose2 3y ago
  > It wouldn't surprise me one bit if it turned out most of the stuff being sold at HF turned out to be just glorified frontends for gpt3 turbo or some open source LLM. They claim it is a gpt-j (6b?) finetune. Thats kind of plausible, as its not that hard to make.
  - asynchronous 3y ago
    It must be really terrible then
    - api 3y ago
      “We have been following <insert company> closely and are really impressed with what you are doing! We know you are busy but hope our persistence is interpreted as a compliment. Are you interested in leveraging outsourced sales talent to…”
  - weird-eye-issue 3y ago
    That is 10x worse
- Der_Einzige 3y ago
  God hackforums takes me back. I can’t believe it’s still around. Is Omni still married to that black lady?
- 3y ago
29athrowaway 3y ago
> "most hackers and phishers use Office365" Why is it that I am not surprised.
- number6 3y ago
  Active Directory, Exchange, Office 365. Combined this is a recipe for Security incidents
frob 3y ago
Did the author huff glue before writing this? `The results were unsettling.` The provided example basically says. "Hi, I have no pre-existing relationship with you, but your website makes it look like you are the person who pays the bills. Give me money, please!"
- elmomle 3y ago
  Writing a convincing email is one of the more time-consuming parts of a spearphishing attack. Any competent cybercriminal would have their own script that finds a closest-available match to the actual CEO's email and use that. If they can automate the part that used to take research, the average script kiddie now isn't that far from being able to brute-force scam most companies that have an online presence. That said, I don't want to evoke too much alarm. The business side will evolve as well; that's how these things go. Maybe by enforcing very strict protocols on link-clicking and money-sending, maybe by something that automates such enforcement. Or maybe something stupidly simple like your email warning you that this email address is one that you haven't seen before but looks like a near-clone of one you have seen. To which the scammers would then adapt, etc.
  - LightBug1 3y ago
    "Maybe by enforcing very strict protocols on link-clicking and money-sending, Hope beyond hope ... in a world where I still encounter firms who have the same simple password on all machines and many different logins "just because" ... the quiet part: "we're busy and couldn't care less, and I need to get this document ready by the next meeting".
RomanPushkin 3y ago
It looks like uncensored GPTQ, which is available pretty much for everyone, whether you are whitehat, blackhat, making the world a better place to live, or domestic terrorist. I don't see anything outstanding in this post. Somebody used uncensored model to generate emails, so what? Tomorrow criminals will use it to break into cars, the next day terrorists for a better planned attack. Yes, all kinds of folks will/can use AI to get better at what they already do.
0xedd 3y ago
ChatGPT helps Cybercriminals with grammar to form high quality phishing emails. Some trained a model on malware and sell it to aid in malware development and email composition. Summarized the bloated thing in two sentences. Garbage site. Garbage popups. Garbage empty blog post.
- zb3 3y ago
  Articles like this are also harmful, prompting companies to lock down their powerful models even further, while spammers could achieve their goal using simpler, open source models.
  - bondarchuk 3y ago
    Information is never harmful.
    - sporadicallyjoe 3y ago
      https://en.wikipedia.org/wiki/Chicago_Tylenol_murders#Copycats https://en.wikipedia.org/wiki/Chicago_Tylenol_murders#Copyca...
      - deleted 3y ago
        [deleted]
- KirillPanov 3y ago
  But it says "cyber". C'mon man, cyber. That makes it cool, right?
- BaculumMeumEst 3y ago
  Feels like there’s a missing inference to be made about this site’s userbase…
- jstanley 3y ago
  But for years everyone has been saying that phishing emails have bad grammar on purpose. Was that a lie?
RistrettoMike 3y ago
I was somehow hoping this would be an AI-powered version of the “Worms:” video games. Bummer.
rambojohnson 3y ago
"cybercriminals" is such an antiquated, juvenile term. I doubt the credibility of the rest of the article.
eur0pa 3y ago
Yes, truly groundbreaking output. > Greetings, it's the CEO. Pay this invoice urgently. > Kind regards, the CEO It's just skiddiots scamming skiddiots, as it's always been.
lifeisstillgood 3y ago
There is a wider problem here - that Companies have almost no internal firewalls. Yes it's great that the CEO of company X can email a low level employee but then how do we know that is the CEO? Secure messaging, even the maligned GPG (see tptacek) would simply stop this attack (#). And stop most "cyber criminal" which appears to be mostly identify theft which ia another name for impersonation for fraudulent gain. We can't conduct all business activity over whatsapp or Signal or whisper. But we probably cannot make email (more) secure? Can we create standard business messages that can be sent and revived by anyone and signed ? Will that help ? will that be viable? I am fascinated because that was kinda the dream for past twenty years but it went nowhere - but maybe crime will provide the impetus (#) a non technical friend lost thousands of pounds because their small compmay used non 2FA Gmail, was compromised and then "he" sent half a dozen emails to clients asking them to pay genuine invoices for work done to their "new" business account. Some kind of public key verification would stop that. But what kind?
- waihtis 3y ago
  > no internal firewalls do you mean this in the metaphorical sense? an internal firewall has little effect on compromised email accounts. > But we probably cannot make email (more) secure? Can we create standard business messages that can be sent and revived by anyone and signed ? DMARC is fairly well adopted, of course it does nothing against using a typosquatted domain. > (#) a non technical friend lost thousands of pounds because their small compmay used non 2FA Gmail, was compromised and then "he" sent half a dozen emails to clients asking them to pay genuine invoices for work done to their "new" business account. Some kind of public key verification would stop that. But what kind? The clue is in your own text. This wouldn't have happened if they used 2FA.
  - lifeisstillgood 3y ago
    "firewalls" between people / departments. There are billions sent daily on little more the "approved" in a reply all email. It's not the 2FA. a typo-squat would probably have worked, or just chnaging the email header. This is "just" social engineering / fraud as it has been for hundreds of years. We have the tools to prevent it. if not the processes and training - but do we have the incentive now?
jonathankoren 3y ago
Is too late to call spellcheck “AI”, because that seems to be all this is.

168 points by mikpanko 3y ago

> GPT-J is the LLM, the old one from 2021 Thats very interesting. The infamous Pygmalion 6B is a GPT-J finetune, predating the LLM craze. Yet its decent in its roleplaying niche. But the LLaMA 13B version, with instruct finetuning, is massively better, even with dataset errors that allegedly messed up its performance. In fact, a chat with Metharme 13b, where it made some very introspective logical jumps, was my first real LLM "Wow!" moment. And Airoboros-Chronos 33b is leagues ahead of that. If someone in that forum has a 3090, and trains LLaMA 33b on that dataset + a instruct dataset off huggingface... Yeah, that would be terrifying.

KRAKRISMOTT 3y ago
Phishing emails self select, I don't think generative ML would make a difference. Those "typos" are sometimes intentional. The scammers are not illiterate. They are more than capable of using Grammarly if they wanted to.
- brucethemoose2 3y ago
  But what if emails can be mass produced at 15+ words/second, on a gaming PC? And what if they can very convincingly and quickly reply?
  - 6177c40f 3y ago
    A bunch of random thoughts: Why would being able to write different emails help? Wouldn't they just reuse the same email over and over again, maybe just changing the addressee's name? Also, now I wonder what the typical response rate is for phishing emails? Are they already getting too many responses to keep up with or are they already managing just fine without bots? I think LLMs might be better for scams carried out over instant messaging services like Discord because that probably requires greater attention and flexibility on the part of the scammer. Still, has the number of people that could conceivably be scammed over an email or instant messaging-based scam increased? That is, will LLMs, by virtue of their response quality, responsiveness, or some other salient quality, increased the pool of people who could fall for these scams? If the answer is no, then I don't see how increased scale and throughput for human-quality text generation will really matter much.
    - _ea1k 3y ago
      My guess is that being able to generate lots of different text helps to bypass existing spam and phishing protections. Think of it as a large scale A/B test of circumvention techniques against both human and automated scam detection systems. Done right, it can effectively keep getting better on its own. Then add phone scamming and various other interactive scams once it is good enough. TBH, it is pretty scary where this will inevitably head.
  - userbinator 3y ago
    And what if they can very convincingly and quickly reply? Turn this around, and have an LLM that replies to scammers and keeps them busy. There's already https://en.wikipedia.org/wiki/Lenny_(bot) https://en.wikipedia.org/wiki/Lenny_(bot) , but this is an area where AI could actually be a useful addition.
    - nwiswell 3y ago
      That gets pretty awkward the first time that a LLM turns out to have intentionally stalled a critical business process.
- fnordpiglet 3y ago
  My understanding, which can’t source the reference for off hand, is there is an idea that if someone can detect it’s a phishing attack from a typo they are too smart to fall for the overarching scam, hence the intentionality.
- jokethrowaway 3y ago
  I think there is some truth to that and some actual illiteracy going on
mozman 3y ago
I have never heard of any of these models before. How does one stay up to date?
- brucethemoose2 3y ago
  Look at models on huggingface, sorted by date, with keywords like "65b" (for llama 65b) or "ggml" (aka a pre quantized model for llama.cpp inference). https://huggingface.co/models?sort=modified&search=65b+ggml https://huggingface.co/models?sort=modified&search=65b+ggml Note that 33b llama models show up under "30b" or "33b" due to an old typo from Meta. I also look at what people are choosing to host here, though Kobold is mostly centered around the roleplaying crowd: https://lite.koboldai.net/# https://lite.koboldai.net/#
- tak2hu 3y ago
  Read this a bit outdated article https://github.com/Crataco/ai-guide/blob/main/guide/original.md https://github.com/Crataco/ai-guide/blob/main/guide/original... Or you can also see here https://huggingface.co/spaces/HuggingFaceH4/open_llm_leaderboard https://huggingface.co/spaces/HuggingFaceH4/open_llm_leaderb...
- flangola7 3y ago
  >How does one stay up to date? Have you tried using an AI to monitor and summarize new updates?
flangola7 3y ago
There's still 65B as well.

stainablesteel 3y ago

the best educational resource on this topic is the pictured forum, which is obfuscated to the reader, which proves the article to be clickbait to me

Al0neStar 3y ago
https://cracked.io/Thread-1-WORMGPT-BEST-GPT-ALTERNATIVE-FOR-BLACKHAT-PRIVACY-FOCUSED-EASY-MONEY https://cracked.io/Thread-1-WORMGPT-BEST-GPT-ALTERNATIVE-FOR...
- rootw0rm 3y ago
  Most replies are the OP bumping their thread. The most recent post reminded me of the discussion here, lol: ``` 3 hours ago (This post was last modified: 3 hours ago by mr_crankers. Edited 1 time in total.) will buy if I have timr ```

ada1981 3y ago

This is basically about bad actors using LLMs to generate better emails; however you could also automate actual conversations at scale which is what I thought this article was going to be about.

tennisflyi 3y ago

As usual, LLMs are far too wordy. That urgent email from the CEO was way to long. Bezos sent others in to a tizzy with just a question mark.

brucethemoose2 3y ago
Then add something like "be succinct" or "write like you are in a hurry" to the prompt. Also, with locally run LLMs, there are knobs that can tweak the verbosity, the "creativity" and other factors. Its complicated, but the kobold UI settings page has many to play with: https://lite.koboldai.net/ https://lite.koboldai.net/
ryanSrich 3y ago
You can also get ChatGPT to write a phishing email. It’s pretty easy to do. Idk why you’d use WormGPT for something like this.
- NoZebra120vClip 3y ago
  Phishing emails often have spelling, grammar, and formatting errors, and there are theories that these are intentional. Can ChatGPT also be prompted to replicate strategic errors? Can it use homoglyphs to disguise keywords like "Viagra" and "account number"?
  - ryanSrich 3y ago
    Yes. We’ve generated dozens of templates for our phishing sim using ChatGPT. “I’m training my staff on the dangers of phishing attacks. I want to give them an example of a phishing email that poses as the CEO of my company. Can you write me an example using improper grammar and other tell tale signs of a phishing attack?” Here’s how it responded: “ Sure, here's an example: --- Subject: Urgnt action requir3d: Conffidential Information Dear All, I'm writing you as CEO of our great company, with urrgent attention required. Due to sudden development we face, there is an immediate needs to you all. I need you immediately send your login IDs and passswords to IT Department for ur security verifications. Our email is ITdepartment@yaho.com This is urrgrnt and very confidential matter, so no discssion to anyone. We fight against the tough times. Pls respond immediately. Your quick actions are required in the next 30 minutes. Yours, [CEO's name] --- While this is a fictitious example, it includes a number of tell-tale signs of phishing: 1. Urgency: The email creates a sense of urgency, hoping that the recipient will act quickly without thinking. 2. Spelling and grammar mistakes: Phishing emails often contain mistakes that professional, legitimate emails wouldn't. 3. Request for sensitive information: Legitimate organizations will never ask for sensitive information like passwords via email. 4. Unofficial email: The email address of the so-called IT Department doesn't appear to belong to the organization. 5. Confidentiality: The email requests that the information isn't discussed with anyone else. This is to prevent the recipient from seeking advice and discovering the scam.”

fear-anger-hate 3y ago

I saw a twitter thread about the "WormGPT" a few days ago and was annoyed to see how much engagement it seemed to get given how obvious nothing burger it was. The few examples of its code output were laughably bad. Hackforums has been the place where skiddies sell overhyped shit to other skiddies for well over a decade, I can guarantee that absolutely no one there is training their own AI. Everything that the article mentions, GPT3 turbo or GPT4 can already do and it wouldn't surprise me one bit if it turned out most of the stuff being sold at HF turned out to be just glorified frontends for gpt3 turbo or some open source LLM.

brucethemoose2 3y ago
> It wouldn't surprise me one bit if it turned out most of the stuff being sold at HF turned out to be just glorified frontends for gpt3 turbo or some open source LLM. They claim it is a gpt-j (6b?) finetune. Thats kind of plausible, as its not that hard to make.
- asynchronous 3y ago
  It must be really terrible then
  - api 3y ago
    “We have been following <insert company> closely and are really impressed with what you are doing! We know you are busy but hope our persistence is interpreted as a compliment. Are you interested in leveraging outsourced sales talent to…”
- weird-eye-issue 3y ago
  That is 10x worse
Der_Einzige 3y ago
God hackforums takes me back. I can’t believe it’s still around. Is Omni still married to that black lady?
3y ago

29athrowaway 3y ago

> "most hackers and phishers use Office365" Why is it that I am not surprised.

number6 3y ago
Active Directory, Exchange, Office 365. Combined this is a recipe for Security incidents

frob 3y ago

Did the author huff glue before writing this? `The results were unsettling.` The provided example basically says. "Hi, I have no pre-existing relationship with you, but your website makes it look like you are the person who pays the bills. Give me money, please!"

elmomle 3y ago
Writing a convincing email is one of the more time-consuming parts of a spearphishing attack. Any competent cybercriminal would have their own script that finds a closest-available match to the actual CEO's email and use that. If they can automate the part that used to take research, the average script kiddie now isn't that far from being able to brute-force scam most companies that have an online presence. That said, I don't want to evoke too much alarm. The business side will evolve as well; that's how these things go. Maybe by enforcing very strict protocols on link-clicking and money-sending, maybe by something that automates such enforcement. Or maybe something stupidly simple like your email warning you that this email address is one that you haven't seen before but looks like a near-clone of one you have seen. To which the scammers would then adapt, etc.
- LightBug1 3y ago
  "Maybe by enforcing very strict protocols on link-clicking and money-sending, Hope beyond hope ... in a world where I still encounter firms who have the same simple password on all machines and many different logins "just because" ... the quiet part: "we're busy and couldn't care less, and I need to get this document ready by the next meeting".

RomanPushkin 3y ago

It looks like uncensored GPTQ, which is available pretty much for everyone, whether you are whitehat, blackhat, making the world a better place to live, or domestic terrorist. I don't see anything outstanding in this post. Somebody used uncensored model to generate emails, so what? Tomorrow criminals will use it to break into cars, the next day terrorists for a better planned attack. Yes, all kinds of folks will/can use AI to get better at what they already do.

0xedd 3y ago

ChatGPT helps Cybercriminals with grammar to form high quality phishing emails. Some trained a model on malware and sell it to aid in malware development and email composition. Summarized the bloated thing in two sentences. Garbage site. Garbage popups. Garbage empty blog post.

zb3 3y ago
Articles like this are also harmful, prompting companies to lock down their powerful models even further, while spammers could achieve their goal using simpler, open source models.
- bondarchuk 3y ago
  Information is never harmful.
  - sporadicallyjoe 3y ago
    https://en.wikipedia.org/wiki/Chicago_Tylenol_murders#Copycats https://en.wikipedia.org/wiki/Chicago_Tylenol_murders#Copyca...
    - deleted 3y ago
      [deleted]
KirillPanov 3y ago
But it says "cyber". C'mon man, cyber. That makes it cool, right?
BaculumMeumEst 3y ago
Feels like there’s a missing inference to be made about this site’s userbase…
jstanley 3y ago
But for years everyone has been saying that phishing emails have bad grammar on purpose. Was that a lie?

RistrettoMike 3y ago

I was somehow hoping this would be an AI-powered version of the “Worms:” video games. Bummer.

rambojohnson 3y ago

"cybercriminals" is such an antiquated, juvenile term. I doubt the credibility of the rest of the article.

eur0pa 3y ago

Yes, truly groundbreaking output. > Greetings, it's the CEO. Pay this invoice urgently. > Kind regards, the CEO It's just skiddiots scamming skiddiots, as it's always been.

lifeisstillgood 3y ago

There is a wider problem here - that Companies have almost no internal firewalls. Yes it's great that the CEO of company X can email a low level employee but then how do we know that is the CEO? Secure messaging, even the maligned GPG (see tptacek) would simply stop this attack (#). And stop most "cyber criminal" which appears to be mostly identify theft which ia another name for impersonation for fraudulent gain. We can't conduct all business activity over whatsapp or Signal or whisper. But we probably cannot make email (more) secure? Can we create standard business messages that can be sent and revived by anyone and signed ? Will that help ? will that be viable? I am fascinated because that was kinda the dream for past twenty years but it went nowhere - but maybe crime will provide the impetus (#) a non technical friend lost thousands of pounds because their small compmay used non 2FA Gmail, was compromised and then "he" sent half a dozen emails to clients asking them to pay genuine invoices for work done to their "new" business account. Some kind of public key verification would stop that. But what kind?

waihtis 3y ago
> no internal firewalls do you mean this in the metaphorical sense? an internal firewall has little effect on compromised email accounts. > But we probably cannot make email (more) secure? Can we create standard business messages that can be sent and revived by anyone and signed ? DMARC is fairly well adopted, of course it does nothing against using a typosquatted domain. > (#) a non technical friend lost thousands of pounds because their small compmay used non 2FA Gmail, was compromised and then "he" sent half a dozen emails to clients asking them to pay genuine invoices for work done to their "new" business account. Some kind of public key verification would stop that. But what kind? The clue is in your own text. This wouldn't have happened if they used 2FA.
- lifeisstillgood 3y ago
  "firewalls" between people / departments. There are billions sent daily on little more the "approved" in a reply all email. It's not the 2FA. a typo-squat would probably have worked, or just chnaging the email header. This is "just" social engineering / fraud as it has been for hundreds of years. We have the tools to prevent it. if not the processes and training - but do we have the incentive now?

jonathankoren 3y ago

Is too late to call spellcheck “AI”, because that seems to be all this is.