Security Testing for Chatbots

Božić, Josip; Wotawa, Franz

doi:10.1007/978-3-319-99927-2_3

Cited by 25 publications

(14 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Meanwhile, threats on the chatbot's client-side (such as unintended activation attacks and access control attacks) and network-side (such as MITM attacks and DDoS attacks) have been studied in the literature [37]. Bozic et al conducted a preliminary security study on an open-source chatbot to identify XSS and SQLi vulnerabilities [11]. Their work did not find any XSS and SQLi vulnerabilities and was limited to analysing only one chatbot.…”

Section: Related Workmentioning

confidence: 99%

An Empirical Assessment of Security and Privacy Risks of Web based-Chatbots

Waheed¹,

Ikram²,

Hashmi³

et al. 2022

Preprint

View full text Add to dashboard Cite

Web-based chatbots provide website owners with the benefits of increased sales, immediate response to their customers, and insight into customer behaviour. While Web-based chatbots are getting popular, they have not received much scrutiny from security researchers. The benefits to owners come at the cost of users' privacy and security. Vulnerabilities, such as tracking cookies and third-party domains, can be hidden in the chatbot's iFrame script. This paper presents a large-scale analysis of five Web-based chatbots among the top 1-million Alexa websites. Through our crawler tool, we identify the presence of chatbots in these 1-million websites. We discover that 13,515 out of the top 1million Alexa websites (1.59%) use one of the five analysed chatbots. Our analysis reveals that the top 300k Alexa ranking websites are dominated by Intercom chatbots that embed the least number of third-party domains. LiveChat chatbots dominate the remaining websites and embed the highest samples of third-party domains. We also find that 850 (6.29%) of the chatbots use insecure protocols to transfer users' chats in plain text. Furthermore, some chatbots heavily rely on cookies for tracking and advertisement purposes. More than two-thirds (68.92%) of the identified cookies in chatbot iFrames are used for ads and tracking users. Our results show that, despite the promises for privacy, security, and anonymity given by the majority of the websites, millions of users may unknowingly be subject to poor security guarantees by chatbot service providers.

show abstract

Section: Related Workmentioning

confidence: 99%

An Empirical Assessment of Security and Privacy Risks of Web based-Chatbots

Waheed¹,

Ikram²,

Hashmi³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Furthermore, to answer customer questions accurately, chatbots now have access to larger databases. This implies that if chatbots are attacked by hackers, valuable information will be leaked (Bozic & Wotawa, 2018). To counter this risk, the Chatbot Security Control Procedure (CSCP) (Lai et al, 2018) was proposed to monitor the behaviors of chatbots, avoid the leakage of confidential information, and ensure customer privacy.…”

Section: A Review Of the Application Fields Of State‐of‐the‐art Chatbotsmentioning

confidence: 99%

A critical review of state‐of‐the‐art chatbot designs and applications

Luo

Lau

et al. 2021

WIREs Data Min & Knowl

126

View full text Add to dashboard Cite

Chatbots are intelligent conversational agents that can interact with users through natural languages. As chatbots can perform a variety of tasks, many companies have committed numerous resources to develop and deploy chatbots to enhance various business processes. However, we lack an up‐to‐date critical review that thoroughly examines both state‐of‐the‐art technologies and innovative applications of chatbots. In this review, we not only critically analyze the various computational approaches used to develop state‐of‐the‐art chatbots, but also thoroughly review the usability and applications of chatbots for various business sectors. We also identify gaps in chatbot‐related studies and propose new research directions to address the shortcomings of existing studies and applications. Our review advances both academic research and practical business applications of state‐of‐the‐art chatbots. We provide guidance for practitioners to fully realize the business value of chatbots and assist in making sensible decisions related to the development and deployment of chatbots in various business contexts. Researchers interested in the design and development of chatbots can also gain useful insights from our critical review and identify fruitful research topics and future research directions based on the research gaps discussed herein. This article is categorized under: Technologies > Machine Learning Application Areas > Business and Industry

show abstract

“…Therefore, the security and privacy issues are of great importance for chatbots. Here, we highlight a few of such issues, mostly applicable to financial chatbots, such as secure authentication, data confidentiality and integrity, system availability, accountability and transparency [6]- [8].…”

Section: B Chatbotmentioning

confidence: 99%

“…However, transactions are much more sensitive than services answering to mere trivial queries. Therefore, such chatbots must guarantee a number of security and privacy properties, such as confidentiality, integrity, authenticity, availability, control and transparency of financial transactions [6]- [8]. Also, relying on a single entity to transfer funds introduces a single point of failure.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

BONIK: A Blockchain Empowered Chatbot for Financial Transactions

Bhuiyan

Razzak

Ferdous

et al. 2020

2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)

View full text Add to dashboard Cite

Chatbot is a popular platform to enable users to interact with a software or website to gather information or execute actions in an automated fashion. In recent years, chatbots are being used for executing financial transactions, however, there are a number of security issues that must be carefully handled for their wide-scale adoption. Similarly, blockchain technology, with a number of security advantages, has emerged as one of the foundational technologies with the potential to disrupt a number of application domains, particularly in the financial sector. In this paper, we forward the idea of integrating chatbot with blockchain technology in the view to improve the security issues in financial chatbots. More specifically, we present BONIK, a blockchain empowered chatbot for financial transactions, discuss its architecture and the design choices that we have adopted for its different aspects. Furthermore, we explore the developed Proof-of-Concept (PoC), evaluate its performance, analyse how different security and privacy issues are mitigated using BONIK.

show abstract

Security Testing for Chatbots

Cited by 25 publications

References 7 publications

An Empirical Assessment of Security and Privacy Risks of Web based-Chatbots

An Empirical Assessment of Security and Privacy Risks of Web based-Chatbots

A critical review of state‐of‐the‐art chatbot designs and applications

BONIK: A Blockchain Empowered Chatbot for Financial Transactions

Contact Info

Product

Resources

About