Deepfaking it: the new cybersecurity frontier

A few weeks ago, on a rou­tine com­pa­ny video call, one of the tech groups decid­ed to prank the boss and five of them turned up look­ing like him. 

“It was very spooky. They used a pub­lic­i­ty still of me and the per­son in the pub­lic­i­ty still was blink­ing, mov­ing his head, smil­ing, talk­ing, say­ing things I don’t say, but it was me,” Andrew Bud, chief exec­u­tive of bio­met­ric authen­ti­ca­tion provider iProov, recalls. 

Over the past cou­ple of years, deep­fakes – manip­u­lat­ed videos or audio record­ings that appear to show indi­vid­u­als doing or say­ing things they nev­er did or said – have start­ed to emerge. Most fea­ture celebri­ties or polit­i­cal fig­ures, with some cre­at­ed pure­ly for amuse­ment val­ue and oth­ers vehi­cles for mis­in­for­ma­tion. 

Deepfake threat to businesses

How­ev­er, new types of deep­fake have now entered the frame with the aim of com­mit­ting fraud. Indeed, the use of deep­fake video and audio tech­nolo­gies could become a major cyberthreat to busi­ness­es with­in the next cou­ple of years, cyber-risk ana­lyt­ics firm Cyber­Cube warns in a recent report.

“Imag­ine a sce­nario in which a video of Elon Musk giv­ing insid­er trad­ing tips goes viral, only it’s not the real Elon Musk. Or a politi­cian announces a new pol­i­cy in a video clip, but once again it’s not real,” says Dar­ren Thom­son, head of cyber­se­cu­ri­ty strat­e­gy at Cyber­Cube. 

“We’ve already seen these deep­fake videos used in polit­i­cal cam­paigns; it’s only a mat­ter of time before crim­i­nals apply the same tech­nique to busi­ness­es and wealthy pri­vate indi­vid­u­als. It could be as sim­ple as a faked voice­mail from a senior man­ag­er instruct­ing staff to make a fraud­u­lent pay­ment or move funds to an account set up by a hack­er.”

In fact, such attacks are already start­ing to occur. In one high-pro­file exam­ple in 2019, fraud­sters used voice-gen­er­at­ing arti­fi­cial intel­li­gence soft­ware to fake a call from the chief exec­u­tive of a Ger­man firm to his oppo­site num­ber at a UK sub­sidiary. Fooled, the UK chief exec­u­tive duly autho­rised a pay­ment of $243,000 to the scam­mers. 

“What we’re see­ing is these kinds of attacks being used more and more. They’re not over­ly sophis­ti­cat­ed, but the amount of mon­ey they’re try­ing to swin­dle is quite high,” says Bharat Mis­try, tech­ni­cal direc­tor, UK and Ire­land, at Trend Micro.

“I was with a cus­tomer in the UK and he was telling me he’d received a voice­mail, and it was the chief infor­ma­tion offi­cer ask­ing him to do some­thing. Yet he knew the CIO of the organ­i­sa­tion was on hol­i­day and would nev­er have phoned. There was no dis­tin­guish­ing fac­tor, so you can see how clever it is.”

Attacks such as this fol­low the same pat­tern as tra­di­tion­al busi­ness email com­pro­mise scams, but with vast­ly more sophis­ti­ca­tion. 

“We’ve seen all these cloud tech­nolo­gies, things like ana­lyt­ics, machine-learn­ing and arti­fi­cial intel­li­gence, and deep­fakes are just an exten­sion of that tech­nol­o­gy, using the tech in an abu­sive man­ner,” says Mis­try.

Fraudulent bank accounts

Anoth­er emerg­ing type of deep­fake fraud is the fraud­u­lent cre­ation of accounts, whether they are bank accounts, for­eign exchange deal­ing accounts or share deal­ing accounts. These can be used by organ­ised crime for the pur­pos­es of mon­ey laun­der­ing. And with the advent of the coro­n­avirus pan­dem­ic, what was pre­vi­ous­ly a grad­ual shift to remote account cre­ation has now been mas­sive­ly accel­er­at­ed, along with the poten­tial for fraud.

Set­ting up an account remote­ly gen­er­al­ly involves a two-step process: first, pro­vid­ing a scan of an iden­ti­ty doc­u­ment and then pre­sent­ing a self­ie. The self­ie is often gen­er­at­ed by ask­ing the appli­cant to record a video in which they recite words or num­bers, or per­haps through a short video inter­view with an agent. 

“It’s obvi­ous­ly been a good way of pro­tect­ing against fraud up until now, but now the fraud­sters can deep­fake them­selves to look like the inno­cent vic­tim,” says Bud. 

“They may have stolen or copied the doc­u­ments of an inno­cent vic­tim from some source, and then all they need to do is deep­fake the vic­tim’s face onto their face and con­duct the inter­view with the agent, and the agent will be nev­er the wis­er.”

In a report late last year, iden­ti­ty ver­i­fi­ca­tion firm Jumio found self­ie-based fraud rates were five times high­er than ID-based fraud and par­tic­u­lar­ly preva­lent where users are able to upload their own ID images. This means fraud­sters can manip­u­late a legit­i­mate ID or use an image of an ID found on the dark web or from a Google Images search.

Finan­cial insti­tu­tions are awak­en­ing to the risk. In a sur­vey for iProov, three quar­ters of cyber­se­cu­ri­ty experts in the finan­cial sec­tor said they were con­cerned about deep­fake fraud and near­ly two-thirds said they expect­ed the threat to get worse.

“Banks like ING, Rabobank in the Nether­lands, Stan­dard Bank in South Africa and the gov­ern­ment of Sin­ga­pore, which is sup­ply­ing the finan­cial ser­vices indus­try, these are all aware of the threat of deep­fakes and are tak­ing proac­tive mea­sures,” says Bud.

How­ev­er, only 28 per cent of sur­vey respon­dents said they’d put plans in place to pro­tect against deep­fakes, with 41 per cent plan­ning to do so in the next two years. 

And with anoth­er poll of bank­ing cus­tomers reveal­ing most were uncon­cerned about deep­fake fraud, intro­duc­ing extra secu­ri­ty mea­sures can be prob­lem­at­ic.

“There’s a big dif­fer­ence between how much cyber­se­cu­ri­ty experts think peo­ple care and how much they do care, and that turns into a prob­lem as soon as they try to imple­ment intru­sive mea­sures,” says Bud.

“There is a risk that if they pro­tect against deep­fakes in ways that impact the cus­tomer expe­ri­ence, it will be imme­di­ate­ly resist­ed.”

How organisations are fighting back

The first line of defence against imper­son­ation attacks, says Mis­try, is to make sure all stan­dard secu­ri­ty pro­ce­dures are imple­ment­ed and to build in auto­mat­ic checks.

“If they’re ask­ing for a mon­ey trans­fer or to change some­thing or to amend some­thing on a doc­u­ment, then it should be ver­i­fied through anoth­er chan­nel,” he says.

Finan­cial insti­tu­tions, mean­while, are turn­ing to more sophis­ti­cat­ed meth­ods of detect­ing deep­fakes.

Pas­sive live­ness detec­tion uses algo­rithms to detect signs in an image that it’s not gen­uine by exam­in­ing tex­tures, edges and the like.

Increas­ing­ly, though, active detec­tion is being used, intro­duc­ing unpre­dictable infor­ma­tion the deep­fak­er can’t pre­dict and can’t effec­tive­ly spoof. 

“What we do is illu­mi­nate the sub­ject; we use the screen of the per­son­’s device to illu­mi­nate them with a rapid­ly chang­ing sequence of colours,” says Bud.

“Then we stream the video of their face back to our servers and analyse the way the light reflects from their face and the sequence of colours reflect­ed on their face, and this is an unpre­dictable ele­ment that it’s dif­fi­cult for a deep­fake to repli­cate effec­tive­ly.”

What’s clear is the use of deep­fakes for fraud is an esca­lat­ing risk and over the com­ing years the arms race between fraud­sters and secu­ri­ty pro­fes­sion­als will only increase.

“At the moment it’s in its infan­cy; a lot of cyber­crim­i­nals are still after using ran­somware or busi­ness email com­pro­mise, but as these chan­nels start to dry up and peo­ple cot­ton on, I think they’re going to move on to deep­fakes more and more. At the moment, the only lim­it­ing fac­tor is the tech­nol­o­gy,” Mis­try con­cludes. 

---