Upcoming Meetings

Turing in a Box: Applying Artificial Intelligence as a Service to Targeted Phishing and Defending Against AI Generated Attacks

Date: 
Tuesday, October 19, 2021 - 6:00pm
Topic: 

With recent advances in next-generation language models such as OpenAI's GPT-3, AI generated text has reached a level of sophistication that matches or even exceeds human generated output. The proliferation of Artificial Intelligence as a Service (AIaaS) products places these capabilities in the hands of a global market, bypassing the need to independently train models or rely on open-source pre-trained models. By greatly reducing the barriers to entry, AIaaS gives consumers access to state-of-the-art AI capabilities at a fraction of the cost through user-friendly APIs.

In our research, we present a novel approach that uses AIaaS to improve the delivery of Red Team operations - in particular, the conduct of phishing campaigns. We developed a targeted phishing pipeline that uses OpenAI and Personality Analysis AIaaS products to generate persuasive phishing emails. Our pipeline automatically personalizes the content based on the target's background and personality. We observed that AI generated phishing content outperformed those that were manually created by Red Team operators. Furthermore, the pipeline freed up Red Team resources to focus on higher-value work such as context building and intelligence gathering.

In addition, we present an AIaaS-powered phishing defense framework to detect such attacks. Compared to traditional classification-based email filters, our framework adapts deep learning language models such as OpenAI's GPT-3 to accurately distinguish between AI and human generated text. This allows security teams to mount a credible defense against advanced AI text generators without requiring significant AI expertise or resources.

Our research provides actionable takeaways for both red and blue teams to prepare for the current reality of advanced AI proliferation. We discuss the long-term implications of this trend and recommend high-level strategies such as AI governance frameworks to safeguard against the abuse of AIaaS products.

 

 

Speaker: 
Eugene Lim

Eugene Lim Associate Cybersecurity Specialist at GovTech Singapore. Also known by his white hat handle @spaceraccoon, Eugene enjoys researching application security and devsecops. His work has been featured in newsletters such as Security Week and The Daily Swig.

 

Glenice Tan

Glenice Tan Associate cybersecurity specialist at GovTech Singapore who enjoys exploring the quirks of different systems, applications and processes. Currently, she is focusing on web security, cloud technology, and social engineering practices.

 

Tan Kee Hock

Tan Kee Hock Specialist who simply likes to 'hack' things. He loves to play CTFs and is always keen to explore more!

 

Timothy Lee

Timothy Lee Associate Cyber Security Specialist focusing on iOS security. As a certified OSWE, OSCP, and CRT, he has performed several security assessments, ranging from mobile and web application penetration tests to source code reviews. His main research area is on iOS kernel security.

 

Location: 

Link to meeting will be provided upon registration

Sponsored By ForAllSecure:

For All Secure

Using‌ ‌Capture‌ ‌the‌ ‌Flag‌ ‌contests‌ ‌to‌ ‌recruit,‌ ‌identify,‌ ‌and‌ ‌train‌ ‌talent

Date: 
Tuesday, November 16, 2021 - 6:00pm
Topic: 

Do‌ ‌you‌ ‌want‌ ‌to‌ ‌know‌ ‌how‌ ‌to‌ ‌build‌ ‌a‌ ‌top-ranked‌ ‌competitive‌ ‌security‌ ‌team?‌ ‌I‌ ‌don’t‌ ‌mean‌ ‌some‌‌
sort‌ ‌of‌ ‌certification‌ ‌--‌ ‌I‌ ‌mean‌ ‌a‌ ‌team‌ ‌of‌ ‌master‌ ‌hackers‌ ‌who‌ ‌can‌ ‌bend‌ ‌systems‌ ‌to‌ ‌their‌ ‌will‌ ‌to‌‌
achieve‌ ‌any‌ ‌objective.‌ ‌

It’s‌ ‌all‌ ‌about‌ ‌the‌ ‌system.‌ ‌In‌ ‌sports,‌ ‌we‌ ‌understand‌ ‌systems‌ ‌that‌ ‌coaches‌ ‌can‌ ‌use‌ ‌to‌ ‌build‌ ‌a‌‌
system‌ ‌for‌ ‌identifying‌ ‌talent,‌ ‌recruiting‌ ‌them,‌ ‌training‌ ‌them‌ ‌up,‌ ‌and‌ ‌competing‌ ‌in‌ ‌big‌ ‌games.‌‌
Learn‌ ‌our‌ ‌proven‌ ‌system‌ ‌for‌ ‌building‌ ‌an‌ ‌elite‌ ‌team‌ ‌of‌ ‌hackers‌ ‌that‌ ‌we’ve‌ ‌maintained‌ ‌for‌ ‌over‌ ‌a‌‌
decade.‌ ‌It’s‌ ‌surprisingly‌ ‌easy,‌ ‌but‌ ‌not‌ ‌what‌ ‌you’d‌ ‌think.

 

Speaker: 

David‌ ‌Brumley

David‌ ‌Brumley:

ForAllSecure‌ ‌CEO‌ ‌David‌ ‌Brumley‌ ‌received‌ ‌his‌ ‌PhD‌ ‌in‌ ‌Computer‌ ‌Science‌ ‌from‌ ‌Carnegie‌ ‌Mellon‌‌ University,‌ ‌MS‌ ‌in‌ ‌Computer‌ ‌Science‌ ‌from‌ ‌Stanford‌ ‌University,‌ ‌and‌ ‌a‌ ‌BA‌ ‌in‌ ‌Mathematics‌ ‌from‌ ‌the‌‌ University‌ ‌of‌ ‌Northern‌ ‌Colorado.‌ ‌Brumley‌ ‌is‌ ‌a‌ ‌tenured‌ ‌Professor‌ ‌of‌ ‌Electrical‌ ‌&‌ ‌Computer‌‌ Engineering‌ ‌at‌ ‌Carnegie‌ ‌Mellon‌ ‌University,‌ ‌and‌ ‌was‌ ‌Director‌ ‌of‌ ‌the‌ ‌university-wide‌ ‌security‌ ‌and‌‌ privacy‌ ‌institute.‌ ‌Brumley‌ ‌is‌ ‌the‌ ‌author‌ ‌of‌ ‌over‌ ‌50‌ ‌publications‌ ‌in‌ ‌computer‌ ‌security‌ ‌and‌ ‌has‌‌ received‌ ‌numerous‌ ‌awards,‌ ‌including‌ ‌the‌ ‌US‌ ‌PECASE‌ ‌award‌ ‌from‌ ‌President‌ ‌Obama,‌ ‌the‌‌ highest‌ ‌award‌ ‌in‌ ‌the‌ ‌US‌ ‌for‌ ‌early‌ ‌career‌ ‌scientists‌ ‌and‌ ‌engineers.‌‌ ‌ ‌ In‌ ‌2012,‌ ‌Brumley,‌ ‌along‌ ‌with‌ ‌his‌ ‌graduate‌ ‌students‌ ‌Athanasios‌ ‌Avgerinos‌ ‌and‌ ‌Alexandre‌‌ Rebert,‌ ‌co-founded‌ ‌ForAllSecure‌ ‌with‌ ‌the‌ ‌mission‌ ‌to‌ ‌secure‌ ‌the‌ ‌world's‌ ‌critical‌ ‌software.‌ ‌In‌‌ 2016,‌ ‌ForAllSecure‌ ‌went‌ ‌on‌ ‌to‌ ‌win‌ ‌the‌ ‌DARPA‌ ‌Cyber‌ ‌Grand‌ ‌Challenge‌ ‌with‌ ‌Mayhem,‌‌ ForAllSecure’s‌ ‌autonomous‌ ‌cyber‌ ‌security‌ ‌system.

Location: 

Meeting link to be provided upon RSVP