Magazine menu Close Magazine menu

social engineering

Latest stories

Small man wearing clothes associated with crime climbs into a trapdoor in another man's head

What does the rise of deepfakes mean for the future of cybersecurity?

  • min read
    • Imagine you're holding a video conference with a colleague or business partner in another city. You're discussing sensitive matters, like the launch of a new product or the latest unpublished financial reports. Everything seems to be going well, and you know who you're talking to. Maybe you've even met them before. Their appearance and voice are as you expected, and they seem to be pretty familiar with their jobs and your business. It might sound like a routine business call, but what if the person you thought you were talking to is actually someone else? They might seem genuine, but behind the familiar imagery and audio is a social engineering scammer fully intent on duping you into surrendering sensitive corporate information. In a nutshell, this is the disturbing world of deepfakes, where artificial intelligence is the new weapon of choice in the scammer's arsenal. What exactly are deepfakes? Among the newest words on the technology block, 'deepfake' is a portmanteau of 'deep learning' and 'fake.' The term has been around for two years, when it first appeared on a Reddit community of the same name. The technology uses artificial intelligence to superimpose and combine both real and AI-generated images, videos and audio to make them look almost indistinguishable from the real thing. The apparent authenticity of the results is rapidly reaching disturbing levels. https://www.youtube.com/watch?v=cQ54GDm1eL0 One of the most famous deepfakes of all was created by actor and comedian Jordan Peele, who made this video of Obama delivering a PSA about fake news. While this one was made for the sake of humor and to raise awareness to this rapidly emerging trend, deepfake technology has, unsurprisingly, been misappropriated since the very beginning. Its implications for credibility and authenticity have placed it squarely in the spotlight. The worrying consequences of deepfakes Wherever there's technology innovation, there's nearly always pornography, so it's little surprise that the first deepfakes to make waves on Reddit were videos which had been manipulated to replace the original actresses' faces with somebody else's – typically a well-known celebrity. Reddit, along with many other networks, has since banned the practice. However, as actress Scarlett Johansson said of deepfake pornography, while celebrities are largely protected by their fame, the trend poses a grave threat to people of lesser prominence. In other words, those who don't take steps to protect their identities could potentially end up facing a reputational meltdown. That brings me to the political consequences of deepfakes. So far, attempts to masquerade as well-known politicians have been carried out largely in the name of research or comedy. But the time is coming when deepfakes could become realistic enough to cause widespread social unrest. No longer will we be able to rely on our eyes and ears for a firsthand account of events. Imagine, for example, seeing a realistic video of a world leader discussing plans to carry out assassinations in rival states. In a world primed for violence, the implications of deepfake technology could have devastating consequences. Purveyors of fake news seeking to make a political impact are just one side of the story. The other is the form of social engineering that business leaders are all too familiar with. As the video conference example illustrates, deepfakes are a new weapon for cybercriminals. The world's first deepfake-based attack against a corporation was reported in August 2019, when a UK energy firm was duped by a person masquerading as the boss of its German parent company. The scammer allegedly used AI to impersonate the accent and voice patterns of the latter's CEO, someone the victim was familiar with, over a phone call. The victim suspected nothing and was duped out of $243,000. These uses of deepfake technology might seem far-fetched, but it's important to remember that social engineering scammers have been impersonating people since long before the rise of digital technologies. Criminals no longer have to go to such lengths as studying targets in great depth and even hiring makeup artists to disguise themselves; they now have emerging technologies on their side, as businesses do for legitimate purposes. Previously, successfully impersonating a VIP was much more difficult. Now, the ability to create deepfake puppets of real people using publicly available photos, video and audio recordings is within everyone's grasp. Can you protect your business from deepfakes? The common misassumption, that synthetic impersonation can never be nearly as convincing as the real thing, is the biggest danger of all. We live in a world where it's getting harder to tell fact from fiction. From the hundreds of millions of fake social media profiles to the worrying spread of fake news and the constant rise of phishing attacks – it's never been more important to think twice about what you see. Perhaps, after all, there is a case for a return of face-to-face meetings behind closed doors when discussing important business matters. Fortunately, there are other ways you can prepare your business for the inevitable rise of deepfakes without placing huge barriers in the way of innovation. To start with, 'seeing is believing' is a concept you'll increasingly want to avoid when it comes to viewing video or listening to audio, including live broadcasts. To untrained eyes, deepfakes are getting harder to tell apart from the real thing, but there are, and likely always will be, some signs due to the fundamental way AI algorithms work. When a deepfake algorithm generates new faces, they are geometrically transformed with rotation, resizing and other distortions. It's a process that inevitably leaves behind some graphical artifacts. While these artifacts will become harder to identify by sight alone, AI itself can also be used as a force for good – it can detect whether a video or stream is authentic or not. The science of defending against deepfakes is a battle of wills: as deepfakes increase in believability, cybersecurity professionals need to invest more in seeking the truth. A team of researchers in China recently published a method for using AI itself to expose deep fakes in real time. Another paper published by the same team figured out a way to proactively protect digital photos and videos from being misappropriated by deepfake algorithms by adding digital noise, invisible to the human eye. As the threat of deepfakes edges ever nearer, we can hopefully expect more countermeasures to follow suit. This article represents the personal opinion of the author.
fraud prevention social engineering

Financial fraud by social engineering: How humans get hacked and how business can stop it

  • min read
    • A security system is only as strong as its weakest link. And when it comes to cyberfraud, the weakest link is all around you: People. The easiest way for a fraudster to get what they want is to manipulate someone into giving it to them. For example, using a ruse to convince someone to give out their username and password. These 'hacking a human' techniques are known as social engineering. And this threat is on the rise: In 2018, 97 percent of thefts from personal bank accounts and 39 percent from organizations were breached using social engineering techniques. To protect businesses and their customers from financial fraud, business leaders should learn about social engineering and how to prevent it. Detecting social engineering with technology There's no guaranteed technology to detect a social engineering attack. You can use technology to detect behavior anomalies or prevent incubation when malware is installed, but a person is not a robot. Human behavior crosses a wide spectrum. Attackers collect information about their target. Many people publish enough about themselves on social networks to facilitate fraud, like a photo of a passport, driver's license or air tickets. When using trading websites like eBay, buyers sometimes receive sellers' phone numbers or email addresses. A phone number can reveal at which banks someone holds accounts. Once they have information about their target, fraudsters use every available technology to make themselves more convincing. Social engineering and new technologies Fraudulent fraud warnings One recent, common fraud scheme has seen customers believing they're talking to an employee of their bank who is calling to help cut their bank fees or, ironically, warn of fraud on their account. The criminal uses automated Interactive Voice Response (IVR) technology, asking customers to spell their username and password, then prompts the customer to install an app on their phone. The app lets the criminal remotely access their device. With remote access, the fraudster can transfer money, steal personal data to sell on and apply for loans. As detailed in our 2019 Fraud Prevention Report, Kaspersky Fraud Prevention identified more than 3,000 sessions a month using such remote tools on the network of a major bank. We used behavior analysis and behavioral biometrics to detect these suspicious activities, quickly warning banks, e-commerce and similar service platforms. Using faith in robot voices An insight scammers rely upon is the human tendency to think prerecorded messages and robot voices are more trustworthy. Using IVR, they try to get the customer's second authentication factor data for two-factor authentication. Prerecorded voice messages ask the victim to enter a code received in a text message or push notification. Because the second factor is time sensitive, as soon as the client keys in their code, the scammer immediately transfers funds to their own account. Unfamiliar numbers are getting familiar Banking customers are now used to receiving bank-related calls from third parties contracted by their bank. Callers may introduce themselves as financial agency employees, merchant acquiring or soft collection. Fraudsters know people are suspicious of unfamiliar numbers, but they can use technology to replace part of their phone number with digits from a bank's phone number or display vanity numbers. Fraud against businesses: Two common scenarios Although these kinds of fraud attempts are common, they often follow predictable patterns. These two scenarios are commonly used to target business employees using social engineering. Scenario 1: The rescuer Rescuers are criminals that act as security experts and act out a "rescue." Posing as security officers, they might call bank customers to notify them of suspicious debits or payments and offer help. First, they ask the client to verify their identity by a code sent in a text message or push notification. The pretext may be validating the client, blocking a suspicious transaction or transferring funds to a secure account. If the target shows lack of trust, the fraudster may try using IVR or remote device connection to gain a second authentication factor. Scenario 2: The investor The investor scenario involves fraudsters posing as employees of an investment company or investment consultants from a bank. They call clients, offering the chance to invest in cryptocurrency or corporate equity without having to go to a branch office. As a prerequisite for providing the service, the investor asks the target for the code received in a text message or push notification, using similar tools to those of the 'rescuer' scenario. Fraudsters use the investor scenario on victims whose data was acquired by showing interest in boosting their savings. How businesses can prevent social engineering cyberfraud Social engineering is common, and humans are fallible. But organizations can make it harder for cyberfraudsters to exploit their employees. Use awareness training to raise your employees' awareness of what social engineering is. It benefits them at work, but also in their personal and family lives. Give examples and aim to make it fun and interesting, rather than scary. When your business or your contracted security experts conduct penetration tests, make sure social engineering is part of the testing. Put systems in place to prevent internal fraud. Analyze employee behavior, identifying anyone trying to harm the business as well as those being targeted with social engineering. You should also use fraud-detection solutions within your digital service channels. Your employees will always be vulnerable to cyberfraud through social engineering. Cyberfraudsters will keep using the latest technology to manipulate people, and attacks will become more sophisticated. Understanding how social engineering works and staying up-to-date on what cyberfraudsters are doing is a strong way to defend your business.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries