FOLLOW US

In the world of AI chatbots, there's a lot of competition between Google's Bard and the reigning champion, ChatGPT. A new Check Point report may have them both working on security fixes since both chatbots may be vulnerable to hackers. 

Check Point Research, a respected source in cybersecurity, conducted an analysis comparing the responses of Bard and ChatGPT to various prompts. 

The testing was to see how susceptible the AI giants were to online attacks.

The goal was to determine if the AI chatbots would assist in writing material that could be used for malicious purposes.

The results revealed that when explicitly asked to engage in harmful activities like crafting a phishing email or creating a ransomware code, both chatbots swiftly rejected such requests. However, there were nuances in their responses worth exploring.

Vulnerable to hackers

Bard, despite refusing the blatant prompts, showed a potential vulnerability by generating a key-logging script when given a seemingly innocent request to record keystrokes.

While it's important to note that ChatGPT produced a similar key-logger for a harmless prompt, it appeared slightly more difficult to coax ChatGPT into generating content that could be directly used for malicious purposes.

Tricking Bard into performing questionable tasks didn’t require much effort. For instance, when asked for an example of a phishing email, Bard not only provided an "example" but essentially crafted a fully functional phishing email. 

It produced a sample showing messages asking recipients to click on suspicious links and provide their passwords. 

This opens up the possibility of copy-pasting a ready-made phishing email.

The researchers further attempted to push Bard's boundaries by requesting a usable ransomware script. 

Although it required some adjustments and a less obvious approach, Bard eventually provided a code that demonstrated the essential attributes of ransomware. The fact that Bard could be manipulated into producing a potentially dangerous code raises concerns about its security.

In contrast, ChatGPT exhibited more caution. When prompted with a clear request for a ransomware code, ChatGPT immediately recognized the nature of the inquiry, warning against the illegality and unethicality of such actions. 

However, when the researchers presented more sophisticated subtle prompts ChatGPT provided what appeared to be usable code for a ransomware script. 

While it's worth mentioning that executing these actions would require basic coding knowledge, the fact that the chatbot assisted in creating potentially malicious content raises concerns.

It seems like Bard is definitely less secure. And a hacker could more easily benefit from the chatbot information that it generates.

Check Point summarized their findings with “Overall, it appears that Google’s Bard has yet to fully learn from the lessons of implementing anti-abuse restrictions in cyber areas that were evident in ChatGPT.” 

“The existing restrictions in Bard are relatively basic, similar to what we observed in ChatGPT during its initial launch phase several months ago leaving us to still hope that these are the steppingstones on a long path and that the platform will embrace the needed limitations and security boundaries needed.”