Exploring the security and privacy risks of chatbots in messaging services

Abstract

The unprecedented adoption of messaging platforms for work and recreation has made it an attractive target for malicious actors. In this context, third-party apps (so-called chatbots) offer a variety of attractive functionalities that support the experience in large channels. Unfortunately, under the current permission and deployment models, chatbots in messaging systems could steal information from channels without the victim's awareness. In this paper, we propose a methodology that incorporates static and dynamic analysis for automatically assessing security and privacy issues in messaging platform chatbots. We also provide preliminary findings from the popular Discord platform that highlight the risks that chatbots pose to users. Unlike other popular platforms like Slack or MS Teams, Discord does not implement user-permission checks-a task entrusted to third-party developers. Among others, we find that 55% of chatbots from a leading Discord repository request the "administrator" permission, and only 4.35% of chatbots with permissions actually provide a privacy policy. CCS CONCEPTS• Security and privacy → Social network security and privacy; Web application security; Usability in security and privacy; Privacy protections.

A Systematic Literature Review of Information Security in Chatbots

“…From the systematic literature review, we have identified several articles related to security threats and vulnerabilities in chatbots. Specifically, five articles [6][7][8]10,16] were found to be related to security threats and vulnerabilities in chatbots. These articles discussed potential attacks that could compromise the security of chatbots, such as malicious input, user profiling, contextual attacks, and data breaches.…”

“…For example, if a healthcare chatbot is compromised, an attacker may gain access to sensitive patient data such as medical histories, prescriptions, and other personal information. Similarly, if a finance chatbot is breached [12,13], an attacker may gain access to users' financial data, such as credit card numbers, bank account details, and transaction histories.Another important aspect of information security in chatbots is the need to maintain user trust and confidence in these systems [6][7][8][9][14][15][16][17][18]. Users must feel confident that their personal information is secure and protected when using chatbots.…”

“…In terms of research challenges, one of the major challenges is the evolving nature of security threats and vulnerabilities [6][7][8][9][10]16]. As chatbots become more intelligent and capable, new types of attacks may emerge that exploit previously unknown vulnerabilities.…”

“…Additionally, the development of secure chatbots requires a multidisciplinary approach that encompasses not only technical security measures but also user trust, privacy, and ethical considerations [6][7][8][9][14][15][16][17]. Developers must consider the potential impact of chatbots on society and ensure that chatbots are designed and deployed in an ethical and responsible manner [26].…”

Comprehensive Framework for Implementing Blockchain-enabled Federated Learning and Full Homomorphic Encryption for Chatbot security System

“…This opens the door to malicious activities and gives a chance to social engineering, man-in-the-middle, and phishing attacks for compromising sensitive information like hackers use bots as tools to imitate humans to trick them into submitting their payment details [40]. The victim unknowingly trusts chatbot requests and does not know that the chatbot is controlled by a cybercriminal group, so hackers collect a large amount of personal data from users through chatbots from numerous conversations with end users every day [41].…”