Schneier says the real significance of the aftermarket head unit story is that an ordinary person could reverse-engineer insecure IoT software with AI, and he expects many more such stories.
It’s interesting because it exposes all the insecurities in this piece of IoT software. But I think the real story is that a random person was able to do this reverse-engineering with the help of AI. Expect a lot more stories like this in the future.
All statements by Bruce Schneier ›
Schneier notes that he has long argued AIs could find vulnerabilities in and hack the legal system, and points to new German demonstrations.
In both a 2021 essay and my 2022 book, A Hacker’s Mind, I talk about AIs finding vulnerabilities and exploits—hacking—the legal system.
Schneier warns that lawmakers will need to harden legislation, possibly using advanced AI themselves, as AI-driven legal hacking is definitely coming.
In such a world, lawmakers would need to significantly harden the process of legislation, for example by leveraging advanced AI themselves. Still in its early stages, but definitely something that’s coming.
Schneier highlights that AI-driven vulnerability discovery is finding critical software bugs at an astonishing pace, on track to add about 26% to the all-time total this year, and calls this staggering.
3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do you realize how fucking insane that is?
Schneier argues AI is just a tool for campaigns, useful for both good and malicious ends, questioning why AI alone should be banned.
If you want to do good things, AI will help. If you want to do evil things, AI will help as well,
Schneier says AI is dual-use for both phishing and phishing detection, may favor defenders in the short term in some respects, but is an ongoing arms race.
Bruce Schneier emphasizes the dual-use nature of AI: it can efficiently automate phishing, and can also be used to identify phishing intent with high accuracy. He believes defenders may benefit more in some respects in the short term, but this is an ongoing arms race.Original (zh)
Bruce Schneier 强调 AI 的双用途：它既能高效自动化钓鱼，也能用于高准确率识别钓鱼意图。他认为短期内防御者在某些方面可能受益更多，但这是一场持续的军备竞赛。