AI is exposing how fragile the web really is. What you can do to stay safe

ArtistGNDphotography/E+/Getty Images

The vulnerabilities were around for years — more than a decade — but researchers were only able to understand how hackers could take advantage of them with the help of AI.

The vulnerability, called P2PShell , impacts a coding language that powers 70% of the world’s websites, enabling hackers to remotely execute code or gain access to information stored on servers. That sent websites into a scramble to update their systems, with some government websites in Europe going offline temporarily this past week until they could install the fix.

The discovery is yet another reminder of the fragile infrastructure of the internet. And with AI supercharging the abilities of both researchers and bad actors to discover flaws, it likely won’t be the last time a discovery like this is made.

“A lot of the internet and a lot of global IT infrastructure runs on technology that’s quite old, or is based on things that are very old in terms of computers, and likely have similar vulnerabilities,” said Patrick Fussell, IBM’s global head of adversary simulation.

With a vulnerability like P2PShell, there isn’t much that users can do to protect themselves. It’s up to organizations, businesses and governments to update their services with the latest security patches.

But it does underscore the importance of being smart about your digital habits. The age-old advice of keeping your passwords secure and being wary of suspicious emails is more important than ever as hackers gain more sophisticated tools and use AI to find more of the internet’s weak points.

Don’t ignore those software update notifications on your laptop or phone. Many of these updates include critical security fixes, and installing them as quickly as possible shortens the amount of time hackers have to take advantage of bugs.

“Users still need to do their parts in terms of installing those updates and maintaining a good security hygiene to put them in a slightly better position,” said Gang Wang, associate professor of computer science at the University of Illinois.

Most smartphones now support software updates for roughly seven years following their release. If you have an older phone, you should check if it’s still compatible with new software versions. You can find information about software compatibility on Apple , Google and Samsung’s websites.

Jakub Porzycki/NurPhoto via Getty Images

Pay attention to the URLs of websites you’re visiting and links you’re clicking, especially if you’ve received the link in an email or text claiming to be your bank or credit card company. Never share personal data, email addresses, passwords, banking information or credit card numbers unless you’re certain the website is legitimate.

AI has enabled attackers to create sophisticated phishing attacks that are more difficult to spot and may lack the key red flags of a scam.

“The traditional way of determining a phishing attack was, ‘Hey, it didn’t sound right. It used wrong language. It had spelling errors, grammar errors,’” Jud Dressler, head of the risk operations center at cyber insurance firm Resilience, previously told CNN. “All of that stuff, the AI is going to take care of that.”

AI can also help attackers conduct deeper research on potential targets to create more personalized and convincing messages, Dressler added.

The best way to avoid phishing scams is to log into your account or call the company or person you’ve received a suspicious message from, rather than clicking links.

Also, remember that smaller businesses may be slower to patch their systems in the event of an attack or data breach compared to large companies.

Never reuse passwords. Instead, try a password manager that creates long, unique passwords for all your online accounts.

Simply put: Computers are better than humans at making passwords that are hard to guess.

“We know humans, when they make decisions, they tend to make the same decisions as other people,” Rachel Tobac, CEO of cybersecurity and training company SocialProof Security, told CNN’s Terms of Service podcast with Clare Duffy in 2024. “So, you know, they make a password for their work. It has the work’s name in it. It’s got a capital letter in the first position to satisfy the capitalization requirement.”

Tobac recommended password managers like Bitwarden, 1Password and Dashlane. The most important thing to look for is whether a password manager offers encryption, which keeps your passwords safe and unreadable to hackers.

Use passkeys instead of passwords: Passkeys are digital credentials that let you sign into online services using your fingerprint, face scan or PIN instead of a typed password. Passkeys are generally thought to be more secure than passwords since they’re tied to biometric data stored on your device that can’t be as easily stolen or spoofed. Apple , Google and Microsoft’s operating systems all support passkeys.

Use two-factor authentication: Enable two-factor verification on any service that offers it. Two-factor authentication sends a login code via text, email or phone call as an extra layer of protection in addition to your password. Some experts prefer app-based code generators like Google Authenticator since text messages can be vulnerable to hackers.

Monitor all your important accounts: Keep an eye on all important accounts for suspicious changes. Many offer automatic email or text alerts.

Freeze your credit report: Freezing your credit file with the three main agencies — Experian, Transunion and Equifax — is an easy way to prevent nefarious actors from trying to open new accounts in your name.

Create a family code word: If you get a suspicious call or message from someone who sounds like a loved one asking for information, call them back yourself, or call people close to them if you can’t get a hold of them. A code word shared between you and your loved ones can confirm their identity.

While AI is making it easier for even novice hackers to execute more advanced campaigns, bad actors are still trying to take advantage of humans at the end of the day.

“It’s still kind of a familiar attack method,” said Dressler. “It’s just using essentially AI to make it more believable and more effective.”

ArtistGNDphotography/E+/Getty Images

这些漏洞已经存在多年——超过十年——但研究人员直到人工智能的帮助才了解到黑客如何利用这些漏洞。

这个名为 P2PShell 的漏洞影响了一种为全球 70% 的网站提供支持的编程语言，它使黑客能够远程执行代码或访问存储在服务器上的信息。这导致各大网站争相更新系统，欧洲一些政府网站上周一度暂时下线，直到安装修复程序为止。

这一发现再次提醒人们互联网基础设施的脆弱性。随着人工智能极大地增强了研究人员和不法分子发现漏洞的能力，此类发现很可能还会再次出现。

IBM 全球对抗模拟主管帕特里克·富塞尔表示：“很多互联网和全球 IT 基础设施运行在相当老旧的技术上，或者基于非常古老的计算机技术，很可能存在类似的漏洞。”

面对像 P2PShell 这样的漏洞，用户几乎无法采取任何措施来保护自己。组织、企业和政府有责任使用最新的安全补丁来更新其服务。

但这确实凸显了养成良好数字习惯的重要性。保护密码安全、警惕可疑邮件这些古老的建议，如今比以往任何时候都更加重要，因为黑客掌握了更精密的工具，并利用人工智能来寻找互联网的更多漏洞。

不要忽略笔记本电脑或手机上的软件更新通知。许多更新都包含重要的安全修复程序，尽快安装可以缩短黑客利用漏洞的时间。

“用户仍然需要尽自己的一份力，安装这些更新并保持良好的安全习惯，这样才能让自己处于稍微好一些的位置，”伊利诺伊大学计算机科学副教授王刚说。

大多数智能手机在发布后大约七年内都会获得软件更新支持。如果您使用的是较旧的手机，则应检查其是否仍然兼容新的软件版本。您可以在苹果、谷歌和三星的网站上找到有关软件兼容性的信息。

Jakub Porzycki/NurPhoto via Getty Images

访问网站时务必注意网址，点击链接时也要注意，尤其是在收到声称来自银行或信用卡公司的电子邮件或短信时。除非确定网站合法，否则切勿泄露个人数据、电子邮件地址、密码、银行信息或信用卡号。

人工智能使攻击者能够创建更难发现的复杂网络钓鱼攻击，这些攻击可能缺乏诈骗的关键危险信号。

“传统的判断钓鱼攻击的方法是，‘嘿，这听起来不对劲。它用了错误的语言。它有拼写错误和语法错误，’”网络保险公司Resilience的风险运营中心负责人Jud Dressler此前告诉CNN。“所有这些问题，人工智能都会处理。”

德雷斯勒补充说，人工智能还可以帮助攻击者对潜在目标进行更深入的研究，从而创建更具个性化和说服力的信息。

避免网络钓鱼诈骗的最佳方法是登录您的帐户或致电您收到可疑消息的公司或个人，而不是点击链接。

此外，请记住，与大型公司相比，小型企业在遭受攻击或数据泄露时，修复系统漏洞的速度可能会较慢。

切勿重复使用密码。建议使用密码管理器，它可以为您的所有在线账户创建长而独特的密码。

简而言之：计算机比人类更擅长创建难以猜测的密码。

“我们知道，人类在做决定时，往往会做出与其他人相同的决定，”网络安全和培训公司 SocialProof Security 的首席执行官 Rachel Tobac 在 2024 年接受 CNN 的“服务条款”播客节目主持人 Clare Duffy 采访时表示。“所以，你知道，他们会为自己的工作设置密码。密码中包含工作名称。为了满足首字母大写的要求，密码的首字母是大写的。”

Tobac 推荐使用 Bitwarden、1Password 和 Dashlane 等密码管理器。最重要的一点是查看密码管理器是否提供加密功能，加密功能可以保护您的密码安全，防止黑客窃取。

使用通行密钥代替密码：通行密钥是一种数字凭证，允许您使用指纹、面部扫描或 PIN 码登录在线服务，而无需输入密码。通行密钥通常被认为比密码更安全，因为它们与存储在您设备上的生物识别数据相关联，这些数据不易被窃取或伪造。苹果、谷歌和微软的操作系统都支持通行密钥。

启用双重身份验证：在任何提供此功能的服务上启用双重验证。双重身份验证会在您的密码之外，通过短信、电子邮件或电话发送登录验证码，作为额外的安全保障。一些专家更倾向于使用基于应用程序的验证码生成器，例如 Google Authenticator，因为短信验证码可能容易受到黑客攻击。

监控所有重要账户：密切关注所有重要账户的异常变动。许多账户都提供自动电子邮件或短信提醒服务。

冻结您的信用报告：冻结您在三大信用机构（Experian、Transunion 和 Equifax）的信用档案，是防止不法分子以您的名义开设新账户的简单方法。

设定家庭暗号：如果接到疑似亲人的电话或短信，对方询问信息，请先自行回拨，如果联系不上对方，则联系他们的亲友。你和亲人之间约定的暗号可以帮助确认对方身份。

虽然人工智能让即使是新手黑客也能更容易地执行更高级的攻击活动，但归根结底，不法分子仍然试图利用人类的弱点。

德雷斯勒说：“这仍然是一种比较常见的攻击手法。只不过本质上是利用人工智能让它更可信、更有效。”