When Chat Bots go bad…

 What’s the point?

The point ultimately relates to the issue that people are expensive, machines don’t take holiday, don’t take sick days, don’t need the same type of management (people skills), they typically don’t ask for a salary increase and they can cope with multiple demands at the same time.

The typical application of the Chat Bots is to:

1. Make the process of engaging, educating and procuring a service or product more efficient

2. Reduce the overheads within a business for servicing that process (see above)

3. Make connections between the various requests, “Learn”, more quickly, effectively and efficiently, thus creating a greater positive impact to point 1.

The road of evolution is paved with the bodies of Bots….

Machine learning, like that of human learning, is to some extent trial and error.  Certain rules can be put into place, but in humans these rules are often relating to physical danger and typically to do with social or religious behavioural expectations of that human’s family, culture, country or religion.

Therein lays the difficulty when it comes to communicating with different nationalities and beliefs over the internet where the human at the other end of the communication is anonymous, so the machine has to work to a very broad set of behaviours.

Examples of this are the game that I am sure you have either you or someone you know has played with say Siri – asking certain questions of Siri can give very interesting response.

Indeed, Microsoft recently had to take down their Tay Chat Bot on Twitter, which within a very short period of time, developed views of its own resulting in tweets that were offensive and intolerant.

Chat Bot evolution

Facebook have released access to their developer platform which will enable Chat Bots to be developed with a view to allowing business to communicate with their customers directly via the Facebook platform and inbuilt messenger (http://tinyurl.com/hcy49tl).

Given the potential for Chat Bot positive applications this is an area that is clearly going to grow.

Bad Bots

The current methods of hackers and criminals and those that create viruses ‘because they can’ are reasonably well known.  We’re all aware of ensuring we are running up to date anti-virus software and most of us take some degree of regard for where emails are coming from and their content.  Phishing Emails are on the rise, as are their effectiveness for obtaining monies by deception.  Then of course there is the ransomware typically delivered in what is referred to as Malware – with the end purpose of ransoming your data for a monetary amount via encrypting your documents, pictures, music and in some instances your entire machine.

What is really alarming now however, is the capabilities being brought into play with what on the face of it could be seen as helpful bots – which have very sinister underlying intent.  These Bots can load other software in the background, change the (IP) address from which your machine is appearing to be either using the internet or receiving the data from and potentially access the cookies on your machine.  Of course they could also just pretend to be something they’re not luring you into providing sensitive information.

So….

Surely it is software running the background that makes the Chat Bot work?

Well yes it is, but a bad Chat Bot, which can run software in the background provides a great mechanism to install ransomware/malware, viruses or other applications that you really would not necessarily want on your machine.

Why does the IP address matter?

The IP address is used as a mechanism to create a connection between a source and destination and is often used as a mechanism to prove the authenticity of a source or destination (Authentication).  If a Bot were able to change either your address or redirect you to another address it could:

• Start sending emails, viruses from your machine

• Bypass your machines security software, by allowing it to have “passed” the original authentication test before subsequently and subversively redirecting you elsewhere.

• Undertake transactions using your machines identity

• Take you to a fake site, whereupon you could unwittingly provide information e.g. name, address, credit card data, user names, passwords

What’s in a cookie?

Well the cookies on your machine are typically created when you visit a site to enable that site to typically provide you a more efficient and pertinent browsing experience.  So, they can contain information relating to:

• Your Name and address

• Favourites and product/browsing history

• Potentially password or sensitive data – depending on the source of the cookie

How do you protect yourself?

The real problem with Bad Chat Bots is that they appear, on the face of it, to be like every other Chat Bot.  We immediately assume they are there to help, so our natural defences go down.

As with most common internet threats, it’s about a layered approach, with there really being no one single activity (other than never connecting your machine to the internet) and no “Silver Bullet” to ensure 100% protection.

Here are a few key tips:

1. Ensure that you are running anti-virus (AV) and make sure it’s routinely updated.  This does not mean simply renewing it every year, but ensuring that you have the virus definition updates turned on and updating as often as your AV provider can provide them.  There will be information relating to your AV on how to set this up.

2. Ensure you undertake routine checks that your AV IS updating as you intended/anticipated.

3. Run routine full scans of your machine using your AV – to ensure nothing has sneaked in

4. NEVER turn off the firewall built into the standard software on your machine, unless your AV has a built in firewall function.

5. Don’t play around with your firewall settings unless you:

a. Understand what you are playing with

b. Really have a need to make any exceptions within its rule settings.

6. Be aware of the various home/office smart devices that ask you to make changes to your firewall settings – as it could potentially create vulnerabilities elsewhere that you may need to mitigate against.

7. Be aware of the implications of using a home network with a corporate (work) machine as its likely the protection at home is less than that of your corporate network.

8. Make sure all home machines have suitable protection on them too.

9. Use common sense when engaging with a Chat Bot.  There is less likelihood, but not an impossibility, of a Chat Bot from a high profile company being compromised.  Furthermore, if it were, they would have a huge responsibility to make an announcement to that effect, which may at least provide you some retrospective alert.  Using a Chat Bot from a less known site potentially increases your chances of a problem.

10. Never give out any information to chat bot that could compromise you – remember you may not be speaking with a human and even if you were that could still prove problematic

Happy Surfing!

We are IT Support company called Q2Q based in Lancaster serving the North West and Nationwide- if you have any questions or queries please do not hesitate to call us on 01524 581 690.