7 ms·
This is going to be awesome/terrible for social engineering attacks. We'll be training millions of people to to trust phone calls from "Google". But are you tal
by 542458 8y ago
This is going to be awesome/terrible for social engineering attacks. We'll be training millions of people to to trust phone calls from "Google". But are you talking to Google-calling-on-behalf-of-your-boss, or Google-calling-on-behalf-of-some-phisher? Or better yet, some custom system that pretends to be Google over the phone? Who knows!
- apendleton 8y agoAt least in the demo, the system didn't identify itself as a bot. It pretended (fairly convincingly) to just be a person, and seemed focused on interactions (making a restaurant reservation, etc.) that don't involve someone recognizing your voice. In other words, I don't think the attack surface is any different than situations where you could just place the call yourself, save perhaps for the possibility of scaling it.
- menzoic 8y agoI don't think the scaling concern should be underestimated. Thats a big difference. Its mostly a numbers game.
- throwawayjava 8y agoIt's not just scaling, but also speed. If you sequentially attack a subpopulation (e.g., employees at a company, senior citizens) the eventually news about your attack will spread throughout that network (internal security alert, evening news+daily newspapers+AARP+...). If you attack the entire subpopulation in rapid succession over the course of days or even hours, educational countermeasures become much less effective.
- jbob2000 8y agoSo now I can script a bot to book restaurant reservations all over the city at busy times. Then nobody shows up for the reservations, the busy time has passed, and customers have moved on or gone home. Restaurants make or break on one or two nights in a month. A calculated social engineering attack like this could bring down hundreds of restaurants in a city, which would cause millions of dollars in lost taxes, and you see where this is going.
- freehunter 8y agoWas there something stopping you from doing that before? A lot of places you can even do it online.
- spydum 8y agoliterally effort. when you lower the attackers effort and cost to try an attack, the attempts generally go up.
- freehunter 8y agoI meant, you could build a bot that calls. We have the technology already, and the people on the other end probably won't notice. Plus the "do it over the Internet" thing where screen scraping and scripting is super easy.
- jbob2000 8y agoYes, the time commitment of having one person pickup the phone and place 100+ phone calls (and the suspicion on the other end when you call back with a new name but the same voice). You could write a screen scraper to book online through the various booking systems, but each booking system probably has its own restrictions on how many accounts you can have and how often they can book. You skip all of these protections when you phone your reservation in (arguably, the restaurant staff should be enforcing these protections when they pick up the phone, but restaurant staff are often overworked and apathetic).
- bduerst 8y agoThis isn't that different than all the bad actors calling from the "IRS". Educating people about giving personal details out over the phone has always been a challenge and will continue to be one.
- criddell 8y agoOr maybe we should fix the phone system. Something is terribly broken when my connection to YouTube is better protected and authenticated than when I'm talking to the IRS over the telephone.
- ryandrake 8y agoYou’re only ever talking to the IRS over the phone if you initiate the call. Ideally the phone system gets fixed but that’s likely to not happen any time soon. Now you need to deal with current reality. Nobody should trust that any incoming call, purportedly from a business or government, is from who they say it’s from either verbally or through caller ID.
- bduerst 8y agoWhy stop there? Why not fix human communication? Or how about we fix human behavior so there are no bad actors? Education may be hard, but scrapping and rebuilding a century-old communication standard in use by billions is harder. I used the IRS example because the IRS never calls you. This is only known through experience, i.e. education.
- criddell 8y agoOn irs.gov, it says: > However, there are special circumstances in which the IRS will call or come to a home or business, such as when a taxpayer has an overdue tax bill, to secure a delinquent tax return or a delinquent employment tax payment, or to tour a business as part of an audit or during criminal investigations. So the IRS might call if you owe taxes. Surely moving from unsecured to a secured phone system can't be that big of a deal. In the US at least, we have experience something similar when we went from analog to digital television. Add a secured mode of telephone calls and then telephone owners choose if they want to receive calls or messages from unauthenticated callers.
- politician 8y agoCredit card companies have already solved this problem by publishing a well-known 1-800 number that their customers can call back to verify the intent of an unexpected caller. Google Duplex can do the same thing - without even staffing a call center.
- jokh 8y agoI don't understand what you mean, can you elaborate? Who calls the 1-800 number, and what info do they get from the call?
- stephenbez 8y agoIf you get a call from someone who claims to work at the credit card company you use, instead of trusting the caller (who could be a scammer) and potentially divulging private information, you should just hang up and call the number on the back of your card.
- caresource_ta 8y agoThat's now how this works, that's not how any of this works. If you have ever been cold called by Google I would go change your passwords and the like.
- brownbat 8y agoClever social engineering is really customized, but social engineering that works "often enough" is mostly reducible to a flow chart. If you can automate it, your response rate only needs to be, what, like people clicking on spam? Tiny. The days of trusting meat sacks with important information might be numbered. Someone should make the dystopia where Skynet doesn't build terminators, but call centers.
- notabee 8y agoWhen people talk about AI taking over, they really need to consider this route. Social engineering most of the world simultaneously. It doesn't have to build armies of robots when we'll tear everything down for it.
- darepublic 8y agoIt's more like ai empowering individuals tremendously and some of these empowered people using their abilities to do harm
- EGreg 8y agoSo you simply tell google a cookie that it would keep safe, to prove it’s google when calling. Presumably it wouldn’t be on speakerphone at the time. Have you ever wondered the same thing about your favorite OS’s admin credentials dialog? What if an app spoofs it?
- lozenge 8y agoOn Windows, there's a group policy to require Ctrl-Alt-Del before the UAC prompt asks for your password. It's impossible for an application to hijack that key combination.
- dperfect 8y agoSounds like we'll have to start solving voice captchas just to call businesses.
- mywittyname 8y agoClick all the boxes in this picture that contain a sign.
- sus_007 8y agoHas anybody found a way/hack to bypass Recaptcha ?
- TheCoreh 8y agoYes, which is why over time it has gotten progressively more difficult. I find some of the challenges to be almost impossible. (Also why Google started using yout session with them to bypass the captcha automatically, it would be too frustrating of an experience otherwise)
- mFixman 8y agoI think the biggest issue won't come from phishers, but from resellers and other occupations that are helped by automation. I could easily call every hot restaurant in San Francisco a several a day to try to snatch a table. On the other hand, most of these places have online reservations which are already extremely gamed.
- rhizome 8y agoAnd without some indicator of attribution, this is just doubling down on the problem of Caller ID spoofing. https://www.nytimes.com/2018/05/06/your-money/robocalls-rise-illegal.html https://www.nytimes.com/2018/05/06/your-money/robocalls-rise...
- notatoad 8y agoEither that, or it will train people to stop trusting a phone call as some sort of authentication. The whole social engineering problem is that when somebody gets a phone call, they trust that the person at the other end is who they say they are. Which can be a false assumption. When the robots start calling, maybe people will finally stop making that assumption automatically.
- wrinkl3 8y agoSo what can you trust? The person calling you might be a simulated voice, crafted to sound like someone you know. The person texting/DMing/emailing you might be an attacker pretended to be someone you know. You can put trust in things like PGP, but they're sparsely adopted and still leave a huge attack surface.
- stri8ed 8y agoYou can trust that they have the private key corresponding the public key you associate with that entity.
- deleted 8y ago[deleted]
- saudioger 8y agoI don't think the intention of this system is for your boss to use Google to call you and ask for passwords. It seems very limited to scheduling appointments.
- rorykoehler 8y agoI stopped answering calls I am not expecting years ago. If it's important they will find a better async way to get in touch.