4 ms·

> Hardly identity thief material. True, but potentially very dangerous material in other ways. It's not hard to image kidnappers piecing together stolen audio

by gavman 10y ago

> Hardly identity thief material. True, but potentially very dangerous material in other ways. It's not hard to image kidnappers piecing together stolen audio clips to create fake messages as part of a ransom attempt. Or scammers creating audio clips to scare parents and extract money. A large bank of audio clips from a child could be used against that child's family in all sorts of ways, especially if the parents don't know the clips were stolen to begin with.

rm_-rf_slash 10y ago
Or worse, they could train a neural network to mimic the child's voice and create a fake message to send to the police alleging child abuse, with a ransom note at the end - in the child's voice.
- nitemice 10y ago
  You don't even need it. Adobe's working on a product that allows you to make a voice say whatever you want, using 20 min worth of voice samples. [1](https://arstechnica.com/information-technology/2016/11/adobe-voco-photoshop-for-audio-speech-editing/ https://arstechnica.com/information-technology/2016/11/adobe...)
  - mulmen 10y ago
    Their ability to do harm with Flash has been limited so they had to branch out. Really though this is pretty cool, when not used for nefarious purposes.
nobodyorother 10y ago
Of course, when somebody releases a proof of concept, it'll be called RansomBear.
- hornbaker 10y ago
  BearBleed.
  - dTal 10y ago
    I was gonna say "CloudBear", after Cloudflare, but it's basically already called that. Maybe just avoid anything with "cloud" in the name?
    - TeMPOraL 10y ago
      > Maybe just avoid anything with "cloud" in the name? I do exactly that. I treat the word "cloud" in a product name (or feature list) as a huge negative indicator and steer clear.
Eridrus 10y ago
If we assume that you can actually scare the parents into paying a ransom, in the end the impact is... a lot of stress + financial loss. And this assumes that the parents can't get in contact with the kid, the police can't get in contact with the kid and the scammers have enough savvy to accept untraceable money. All of which points to this being more of a movie plot than something that will happen in reality. And even if this were a credible threat, logically we should be more concerned about direct financial theft since it has the same impact, but is far less elaborate (but still far less common than other types of cybercrime).
- lazaroclapp 10y ago
  Do you know how many calls you can get in a year of scammers pretending to have kidnapped members of your family in some developing countries? The only real difference from that to this is the added tech-savyness of obtaining real recordings instead of bad acting, which some scammers are actually likely to have by virtue of purchasing this data the way they currently purchase phone numbers, names and CC numbers. The police in those places won't bother going after a phone scammer that only took money (say, in the form of a non-cryptocurrency digital cash transfer that was quickly exchanged for cash), even if the criminal is fairly traceable in theory. When the rule of law is such that only about 2% of murders ever get investigated, this sort of thing just becomes the background noise of un-safety.
- orless 10y ago
  One of the typical scams in Russia is a message to the parents "mom, I out of money on my phone, please drom 20$ to this number" or "dad, I scratched someone's car need 2000$ right now". In Germany it works with grandparents. They get calls from someone impersonating their grand-child in trouble. This works because in many families grandparents live separately and sometimes don't have much contact to their grandchildren (apart knowing that they exist). This threat is so real that there are police posters about this in community centers. So this works over text messages or phone calls without much sophisticated mimicing. I just imagine a whole new spin of this when AI/DL tech becomes a commodity. So I quite disagree with the "movie plot" estimation of the threat.
ourmandave 10y ago
I don't understand. If I got a call in my daughter's voice saying "Help! I'm being held for ransom! Send all the bitcoins!" And then I call her phone and she answers or she walks in the door having gotten home from school, how is anyone going to collect on that?
- mulmen 10y ago
  I might watch too many spy movies but maybe they wait for a time she will be away from her phone, like the camping trip she has been talking about for weeks or a school field trip that can be easily learned and googled from conversations about class or sports competitions based on googling team names. These are all things that are likely to come up in regular, routine conversation. The real question is why you wouldn't already be terrified about having a microphone in your house that is open to the internet.
- nkrisc 10y ago
  In your contrived scenario meant to defeat the premise, no, it won't work. However there are basically limitless ways this data could potentially be exploited. The point is they don't need to even do it now, it could happen any time. Data doesn't just go away.
hulahoof 10y ago
Moving into the future only makes an audio bank more dangerous with technologies like Adobe VoCo which only require a modest amount of recordings to synthesize in the child's voice (~20m IIRC)

by gavman 10y ago

rm_-rf_slash 10y ago

Or worse, they could train a neural network to mimic the child's voice and create a fake message to send to the police alleging child abuse, with a ransom note at the end - in the child's voice.

nitemice 10y ago
You don't even need it. Adobe's working on a product that allows you to make a voice say whatever you want, using 20 min worth of voice samples. [1](https://arstechnica.com/information-technology/2016/11/adobe-voco-photoshop-for-audio-speech-editing/ https://arstechnica.com/information-technology/2016/11/adobe...)
- mulmen 10y ago
  Their ability to do harm with Flash has been limited so they had to branch out. Really though this is pretty cool, when not used for nefarious purposes.

nobodyorother 10y ago

Of course, when somebody releases a proof of concept, it'll be called RansomBear.

hornbaker 10y ago
BearBleed.
- dTal 10y ago
  I was gonna say "CloudBear", after Cloudflare, but it's basically already called that. Maybe just avoid anything with "cloud" in the name?
  - TeMPOraL 10y ago
    > Maybe just avoid anything with "cloud" in the name? I do exactly that. I treat the word "cloud" in a product name (or feature list) as a huge negative indicator and steer clear.

Eridrus 10y ago

If we assume that you can actually scare the parents into paying a ransom, in the end the impact is... a lot of stress + financial loss. And this assumes that the parents can't get in contact with the kid, the police can't get in contact with the kid and the scammers have enough savvy to accept untraceable money. All of which points to this being more of a movie plot than something that will happen in reality. And even if this were a credible threat, logically we should be more concerned about direct financial theft since it has the same impact, but is far less elaborate (but still far less common than other types of cybercrime).

lazaroclapp 10y ago
Do you know how many calls you can get in a year of scammers pretending to have kidnapped members of your family in some developing countries? The only real difference from that to this is the added tech-savyness of obtaining real recordings instead of bad acting, which some scammers are actually likely to have by virtue of purchasing this data the way they currently purchase phone numbers, names and CC numbers. The police in those places won't bother going after a phone scammer that only took money (say, in the form of a non-cryptocurrency digital cash transfer that was quickly exchanged for cash), even if the criminal is fairly traceable in theory. When the rule of law is such that only about 2% of murders ever get investigated, this sort of thing just becomes the background noise of un-safety.
orless 10y ago
One of the typical scams in Russia is a message to the parents "mom, I out of money on my phone, please drom 20$ to this number" or "dad, I scratched someone's car need 2000$ right now". In Germany it works with grandparents. They get calls from someone impersonating their grand-child in trouble. This works because in many families grandparents live separately and sometimes don't have much contact to their grandchildren (apart knowing that they exist). This threat is so real that there are police posters about this in community centers. So this works over text messages or phone calls without much sophisticated mimicing. I just imagine a whole new spin of this when AI/DL tech becomes a commodity. So I quite disagree with the "movie plot" estimation of the threat.

ourmandave 10y ago

I don't understand. If I got a call in my daughter's voice saying "Help! I'm being held for ransom! Send all the bitcoins!" And then I call her phone and she answers or she walks in the door having gotten home from school, how is anyone going to collect on that?

mulmen 10y ago
I might watch too many spy movies but maybe they wait for a time she will be away from her phone, like the camping trip she has been talking about for weeks or a school field trip that can be easily learned and googled from conversations about class or sports competitions based on googling team names. These are all things that are likely to come up in regular, routine conversation. The real question is why you wouldn't already be terrified about having a microphone in your house that is open to the internet.
nkrisc 10y ago
In your contrived scenario meant to defeat the premise, no, it won't work. However there are basically limitless ways this data could potentially be exploited. The point is they don't need to even do it now, it could happen any time. Data doesn't just go away.

hulahoof 10y ago

Moving into the future only makes an audio bank more dangerous with technologies like Adobe VoCo which only require a modest amount of recordings to synthesize in the child's voice (~20m IIRC)