Humans vs. AI. Who's better at Phishing?

[@KDeepFacts]

"If you're satisfied with your security, so are the bad guys" 👌

[@jeffcrume]

I wish I could take credit for that one but I read it somewhere many years ago and it stuck with me

[@rmm2138]

These are great sessions: Relevant to our changing world, real world examples, easily consumed (time), enjoyable to watch. Thank you!

[@jeffcrume]

Thanks so much for watching and for the great feedback!

[@dinesharunachalam]

Interesting fact Jeff. Couple of queries, 1) Which model was used to do the comparison? Did all Gen AI models performed the same way? 2) How about identifying a phishing attack? Did Gen AI did well compared to Humans?

[@jeffcrume]

Good questions ... 1) don't recall if it was GPT 3.5 or 4.0 but my guess is the latter. 2) Different experiment that I'd like to see but our team hasn't done that one yet that I know of. This, of course, would be a case of AI vs AI, which is inevitable.

[@dinesharunachalam]

Thanks @@jeffcrume 👍

[@TopTierTales-ux4se]

At the beginning I was a little bit afraid of AI but it is nothing but a (very strong) tool. You have to learn about AI in order to adapt to the future.

[@jeffcrume]

Like any other tool, it can be used for good or evil. It’s our job to make sure it’s the former and not the latter

[@harriehausenman8623]

Multi-Factor Auth: * Something you can forget * Something that can be stolen * Something that can be immitated 😆

[@toenytv7946]

Just about that. Aggreed❤

[@jeffcrume]

All true but the odds of breaking more than one is substantially more difficult -- hence MULTI rather than SINGLE factor. Multiply the probabilities of each and you will see what I mean

[@harriehausenman8623]

@@jeffcrume Multiplying the probabilities is just wrong. not even close to reality. That's what happens when math concepts are blindly applied without understanding the underlying (physical) system.

[@harriehausenman8623]

@@jeffcrumean btw: even IF one follows this naive approach, it's still wrong, since you can only multiply them if they are *independent* events, which these are clearly not.

[@Ugk871]

Wow thank you for sharing this. The email looks legit. I’m so sorry for our IT team😨

[@jeffcrume]

I know what you mean. We are going to have to rely on other methods for protection

[@whiteweed]

Interesting competition.😎

[@blogcorpo]

Great video!♥♥

[@jeffcrume]

Thanks!

[@MohsenJebelli145]

As always perfect and sweet !

[@jeffcrume]

Thanks!

[@Jacob_Isah]

I'm offended you use Nigeria, Jeff

[@jeffcrume]

Sorry but there’s a reason why these are called 419 scams. Google it and you’ll see what I mean

[@mayaliii]

I am too that was an elderly UK criminal ,no where near ours. Outdated and distasteful

[@aprilmeowmeow]

I think it's because this was an old phishing technique. The prince was always Nigerian in the email. I used to get them. It wasn't racism.

[@AlanCringLtd]

Could the effectiveness of the generative phishing messages be improved by using an adversarial network? In other words, as we're doing with images, could a second AI be set up to try to catch the phishing emails created by the phisher AI? Ultimately, this would improve the adversary's ability to catch phishing emails, which could then be deployed on real email services to filter out the inbound phony traffic.

[@jeffcrume]

No doubt this will be tried

[@Factotumscybersecurity]

Great content and all, but how do you write like that in the air? What technology is that😅

[@jeffcrume]

kzbin.info/www/bejne/gpXRe6KKaq6Khq8

[@jeffcrume]

I posted a link but not sure if it will display. If not, search the channel and you'll see a video on how we make these

[@BillBitner]

Who did you test this on?

[@maneshipocrates2264]

Not sure if those emails only come from Nigeria. Phishers can use generative AI to write better emails. Links and sources are normal red flags. So what is new here?

[@jeffcrume]

What's new is just what you said ... GenAI to compose these, thereby, removing the clues of bad grammar that we've been telling people to look for in their annual security training

[@maneshipocrates2264]

Thanks. Do you think the X-Force can be integrated to down stream tasks in case one is working on methods to help identify phishing or it should be used as a standalone service? Or maybe I am wrong to suggest X-Fore is a service you people reated?@@jeffcrume

[@JeremJarnex]

wait is he writing backwards?

[@jeffcrume]

I wish I could but I can barely write forwards

[@jeffcrume]

kzbin.info/www/bejne/gpXRe6KKaq6Khq8

[@jeffcrume]

search the channel and you'll see a video on how we make them

[@rishnot16]

What if the strategy used by HUMANS is used by the AI? How similar or better will the results be?

[@jeffcrume]

I think that as the AI gets better, it will use more of these same techniques and get only better

[@pauldannelachica2388]

❤❤❤❤❤

[@coachtanishamarie]

Ai is fasting

[@coachtanishamarie]

Faster

[@jeffcrume]

Yes, it’s faster by a lot

[@harriehausenman8623]

Why bother writing things, when it's just gibberish!? 🤷‍♂