ChatGPT is much more useful now than it was when I first came out, and this is through the use of plugins and GPTs. Well, if you’re planning on using these, you may be putting your data and cybersecurity at risk. Researchers from Salt Security discovered several security vulnerabilities with plugins and GPTs that may have led to some ChatGPT users’ accounts being hacked
Plugins and GPTs add more utility to ChatGPT. They allow the chatbot to do more than just answer typical AI chatbot questions. Think of GPTs as smaller user-created versions of ChatGPT that are specialized to do specific tasks. Users create these GPTs and post them to the GPT store. So, think of them as Google Chrome extensions. Users create them and post them to the GPT store, where you can install them and use them within ChatGPT.
Security vulnerabilities were found with some ChatGPT plugins
Salt Security was able to find three different potential issues affecting users. These issues could give bad actors access to users’ accounts, which is never a good thing.
First vulnerability
The first security issue occurs when actually installing a plugin or GPT. Unfortunately, ChatGPT does not verify that a user has begun installing a plugin. This is a big issue that will be explained in a bit.
When you install a new plugin, ChatGPT needs to verify it. In order to do this, the plugin’s website will need to send you a code. You will then send that code to ChatGPT which will verify that code with the website. Once ChatGPT verifies that the code is legitimate, the plugin is then installed.
However, this is a way for bad actors to steal victims’ information. The secret code is stored within a link. After that, the plugin is installed with the user’s credentials. This means that the user has control over the plugin.
This is why it’s bad that ChatGPT does not verify that users have started the installation process. A bad actor can send anyone a link containing a code to install the plugin on your account using the attacker’s credentials. Since ChatGPT doesn’t verify that the account holder has started the installation process, any person who sends the code can have the plugin installed.
Once installed, the attacker will have control over the GPT on the victim’s account. At that point, the attacker can have the malicious plugin redirect all of your chat conversations and information to it. This will put all of your sensitive information in the attacker’s hands.
Second vulnerability
The next vulnerability is a major threat if you use the AskTheCode plugin. This is a plugin that connects your ChatGPT account with your GitHub account. When you install this plugin, it actually creates a separate account to store your GitHub credentials.
Well, hackers are able to break into users’ GitHub accounts and steal their GitHub repositories through a vulnerability. According to the report, this action is done by sending the victim a special link. The link will reveal a key piece of information about the user, called their memberId, and send it to the attacker.
Well, the memberId of a person is extremely crucial. After that point, the attacker goes to ChatGPT and installs the AskTheCode plugin. At that point, they will install the plugin and use the victim’s member ID to authenticate it. When that happens, the attacker will gain access to the victim’s AskTheCode account and the victim’s GitHub account. This will give the attacker access to the repositories.
Third vulnerability
Lastly, the third vulnerability is similar to the second one. The attacker would send a malicious link to the victim that will install the plugin but using the victim’s credentials. This will give the attacker control over the victim’s account.
Hopefully, these issues will be ironed out before more victims pop up.
The post Researchers found three vulnerabilities affecting ChatGPT plugins appeared first on Android Headlines.