“Promptdorking” and Targeted Phishing Attacks – David Maynor, Cybrary

This is Textron TV. Hey guys. Thanks for the throw.

We're here with David. Mayner. He's the senior director for threat intelligence for cybery and we're gonna be talking about a thing called prompt Dorking and chat GPT and how it applies to cybersecurity David.

Welcome the shop. Thank you having me. I think the first question everybody's gonna have is what the heck is propped working.

So maybe you want to explain that a little bit. How does it work? And how does it impact cybersecurity?

Front door King is the extension or the evolution of what people call Google dorky which came around in the early 2000s. Basically you could Make more specific queries in Google to get more useful information right like so a lot of people were used to searching for. Excel spreadsheet passwords, but front door King.

I'm sorry Chad working came along and it was because people could figure out you could add extensions an additional information to Google queries to make it return more specific information like Excel spreadsheet password file type XLS right, so then you're only going to get Excel spreadsheets in your search results. This makes finding things much easier much faster and a lot of cases a lot more malicious. So are we now worried about using chat GPT to kind of make those types of queries easier and faster and we're gonna start seeing more targeted attacks because people will be able to refine their searches better for these malicious activities or what's the outcome here.

Well, there's versions of this that you can do in chat GPT or it's backend. Open AI the playground model chat. GPT is actually from model called DaVinci.

That's what opener I refers to it as and there's a lot of actual security put in places for chat GPT to stop these kind of weird activities. So there's a lot of tools that make searching for email addresses and search engines like Google easy, but open Ai and chat to be team makes it even easier with a couple word query. com and it will give me a list that can keep tracking continue until I've gotten all the email addresses.

I'd want to start a fishing campaign and some people will say well that will give you generic addresses like Play Store help or things. That's true. That's what starts with but the Dorking part of prompt working comes making them more specific requests the request for what you're wanting for instance if I move on to Amazon, I can write a query this Please print and I I'm sorry.

I always say please and thank you. So I even do it to machine models. com and will give me a list of not the big ones like Alexa feedback or not.

They give me the ones that are barely mentioned people like individual people's email address. Send you guys like the thread is almost twofold now one is people will use chat GPT to create more sophisticated fishing messages that are full more people and then secondarily they'll be able to use it also to pull up more addresses to send those threats to more efficiently and we may see an exponential increase in the number of fishing attacks. Is that what we're worrying about that is actually exactly what I'm worried about it.

It used to be somewhat hard to craft fishing emails with the right tone the right language, you know, if you're someone in Russia, you're facing somebody in Wisconsin. It's hard to fake a Wisconsin. accent but chat GPT in addition to being able to give you the information you can say make me sound as if I am from blah at this age range blah.

I am from New York and I am in my mid-20s in the fashion industry, right the following content at to sound like that. That makes the fishing part a lot easier. now there's a long that there's a lot of people believe that because chat GPT says it's not connected to the internet and the data really stops around 2021.

That means that there's not gonna be a lot of updated information in it. Thus reducing the risk, but that's not actually that accurate for instance. This was just this morning when I was writing these prompts to show you.

it domains and that was the top 10 the produce. We're still accurate. And in addition to that I could ask it.

What websites on the internet actually link to these subdomains and it gave me a link to like CSL online techpedia Network World Forbes things like that. So that even makes it easier because now I can pretend that I'm responding to an article or some other reference and trick somebody into thinking that my my messages even more legitimate and this is the whole done with normal conversational text. And it's not hard at all.

5 is already floating around out there and that's got more current. 0 and 5 and 6 will all be more current than the original Three. So the pace at which these things are learning is just accelerating.

Correct? It's crazy. It is crazy fast.

In addition that there's now an ecosystem of third-party tools that can link things like chat TPT together with other search engines or tools and apis one of them by is called Lang chain is basically glue they can put these types of models together. It will help you generate better prompts. It will help you tie, you know multiple apis together.

It really provides the gluten necessary to avoid having to copy and paste from different strings. But you that also means you can do things at scale really fast. So if this is all the case, then will there be security tools in the future that are able to detect chat gbt or some other AI engine or is that always going to be just too much to ask of the cybersecurity tools?

I when Chet GPT came out and it may start making a lot of headlines in early December. They're also the the flood of well, I've written an AI based tool to detect AI based tools, right all of them were easily defeated. By having it paraphrase rewrite or write in a different voice.

Like for instance the example. I said earlier. I'm from New York.

I'm in my 20s into fashion industry right this as if I was that person a simple prompts like that can convert your text. Into something new that really bypasses a lot of the scoring. I haven't found one that so it may detect the first attempt at it.

But after you convert it a couple of times it looks just like everything else people, right? All right, that was a little close to home. My daughter's in her 20s lives in New York and works in the fashion industry.

So there you go. Really? Yeah.

That was well I picked that that's the least like like I mean my 40s and live in the Maryland and working in cyber security and I'm balding. No. so my question then becomes to you is the whole communication around the internet in danger breaking down because we won't be able to trust anything that's coming across so if that happens well, many of our current business processes kind of be at risk here because everything that shows up in an email might be a business email compromise attack or something like that and we don't have any way of knowing Let me ask you a question think about all of the tools that you have for security from.

Email filters web filters AV basically, there are all designed to stop Communications from happening whether or better not they're designed to stop communication from bad people, right? I would feel like probably 95% of the communications I get are automated malicious or just something I'm not gonna read. Anyway, I would say that we're not really communicating that much to begin with on the internet.

You know less than we think we are right but at least we can identify those things a little more easily and it might not be such in the in the future. So we talk about two-factor and multi-factor authentication. Is this going to be one of these scenarios where if someone sends me something I'm gonna have to actually call them and you know understand that it's them and say them and say did you send this because or am I gonna have to like call you to tell you that I'm gonna send you an email so that you trusted and what is the mechanism for trust gonna ultimately be Well, this might sound old-fashioned.

I mean, but I do exactly that one when I send people emails I follow up and tell them I sent I actually did send them an email and I really generally only read emails that somebody's done vice versa. I know that that may be Anti, uh tech industry or whatnot, but that's really the only thing that seems to be to be efficient. All right, of course in the next flavor of this chat GPT thing is multimodal and they'll be doing more than text.

They'll be doing images and everything else that goes along with that. So, you know at some point we may not even know the fact that I'm looking at you right now. I mean, is that really you how will I know?

You won't there's already tools you can string together. Now with things like Lane chain, you can bring text to speech and basically automated avatars together you you wouldn't be able to tell and the way things have worked on a world stage in the last five or so years with information operations and disinformation campaigns. I'm surprised people put so much faith in what they read on the internet.

already But it's just going to get worse. So what's your long term outlook here? I'd like to find a cave in the mountains.

Ideally with no internet access. Go back to getting a paper my milk delivered to my front door. and and maybe we all have to live in a small village where we know each other and can identify each other immediately because the world's maybe not the village we thought it was gonna be That is it.

That is an apt analogy. All right, my friend. Hey, hopefully things get better than sooner than later.

But right now we're kind of all challenging and we're not the only ones freaking out about chat GPT for sure David. Thanks for being on the show. Thank you, sir.

Thank you for having me. All right back to you guys in the studio.