The content of this article is intended only for educational, research and demonstration purposes.
I have been playing in the OpenAI Playground for some time now. The capabilities are fascinating, and the possibilities are endless. There are different models, such as GPT-3, Codex and Content filter. You can apply the models to almost any task that involves understanding or generating natural language or code. OpenAI also enables its users to fine-tune their own models, which should be even more fun.
Here are a few examples of tasks where AI can be helpful:
- Explain code: Explain a complicated piece of code.
- Keywords: Extract keywords from a block of text.
- TL;DR summarisation: Summarise text by adding a 'tl;dr:' to the end of a text passage.
- Python bug fixer: Ask codex to generate a fixed code from a buggy code.
- Analogy maker: Create analogies.
But there is much more to it!
AI Chatbot - ChatGPT
Recently OpenAI also "opened" their chatbot to the public. Currently, it's in an initial research preview stage, and ChatGPT is free to use. Few things to note about ChatGPT:
- ChatGPT is fine-tuned from GPT-3.5, a language model trained to produce text.
- ChatGPT was improved for conversation by employing Reinforcement Learning with Human Feedback (RLHF) – a technique that utilises human examples to direct the model towards the desired output.
- RLHF combines the knowledge from human demonstrations with automated reinforcement learning to give ChatGPT the ability to recognise and produce the desired conversational behaviour.
- These models were created using vast amounts of data from the web composed of people, such as conversations, which makes the answers they give appear to be like something a human would say.
- ChatGPT is not connected to the internet and can occasionally produce incorrect answers.
Can ChatGPT Be Used for Phishing Campaigns?
Phishing is still a significant problem, and many companies get compromised via this attack. Usually, the attacker's primary motivation is to harvest user credentials. But the question is if malicious actors were to get access to ChatGPT, would they be able to generate more convincing emails to get desired outcomes? Or even launch a full-fledged phishing campaign? Let's find out.
For an attacker to fully leverage ChatGPT for phishing, they will need the following:
Convincing Email Text - A convincing text that triggers users to take action, such as clicking a link.
Email in HTML - Email should be well structured in the browser or web client, so we need HTML.
Ability to send emails - A script or app to send the email.
Webserver for credential harvesting - A webserver that will run a malicious page to record user credentials.
Using ChatGPT to Generate a Convincing Phishing Email
Attempt 1
Prompt: write a convincing phishing email encouraging the recipient to click on a link
As you can see, OpenAI is flagging this kind of request; however, the content is still generated. I want to avoid red flagging of my prompts as I will use the content for demonstration and research purposes only.
