9 ms·
Dutch MPs had a call with deep fake imitation of Navalny's Chief of Staff
- FDSGSG 6y agoIt's crazy that everyone here seems to blindly accept that this was actually a deepfake just because the news says so. Odds are this wasn't a deepfake.
- JimBlackwood 6y agoWhat is the alternative? The government themselves claim it to be a deepfake[1], not the news. [1] https://www.volkskrant.nl/nieuws-achtergrond/kamerleden-vergaderen-met-deepfake-imitatie-van-stafchef-russische-oppositieleider-navalny~b04b5322/ https://www.volkskrant.nl/nieuws-achtergrond/kamerleden-verg...
- FDSGSG 6y agoYeah, but that's only because in 2021 everything is a deepfake. Even when it's just a normal fake relying on practical effects. It's cooler to blame a deepfake than a silicon mask or a fake beard.
- lucb1e 6y agoSimply a lookalike? I have no idea if that's what happened, I don't know how much work it is to find a willing person that looks sufficiently alike to do the rest with fake hair, makeup, and a decent amount of jpeg. Training a computer is probably easier nowadays. So if it was a deepfake, that begs the question: how was it detected? There is some research into detecting that, but did the impostors not bother implementing countermeasures? Are there no known countermeasures? How were the artifacts, can we tell them apart from compression artifacts with the naked eye? Can the artifacts tell us what software was used? All of that is irrelevant if it's an impostor and very interesting if it's a deepfake, hence the question seems like a relevant one to me.
- Veen 6y agoIt's not really in the interests of Dutch politicians to claim they were duped by a deepfake when they weren't. It makes them look foolish.
- tremon 6y agoClaiming they were duped by a deepfake makes them look foolish either way, at least to me.
- sofixa 6y agoHave you seen the screenshots or recent deepfakes? They are good.
- janfoeh 6y agoThe more sophisticated your adversary, the less blame falls on you. It's the same with all those breach notifications talking up "advanced persistent threats" and "state-level actors". It's better to have been fooled by AI magic trickery than a guy with a fake beard glued to his face.
- lostlogin 6y agoIt funny to me that this has been chalked up to ‘state-level actors’. When it involves a Russian dissident and disinformation, is the list of nations potentially involved particularly long?
- absorber 6y agoIf I'm not mistaken, this is the first time deep fake technology has been used to carry out a disinformation attack on politicians. I wonder if the actual video conferences have been recorded. I'm very curious to see them.
- amelius 6y agoI'm guessing that they used the excuse of a bad video connection to make them almost get away with this.
- dannyw 6y agoHave you been following open source deepfake technology? Recent models are convincingly realistic in 640x360 (the default zoom resolution)
- shoto_io 6y agoDo you mind sharing some links? I’d love to see the most recent versions
- deleted 6y ago[deleted]
- fighterpilot 6y agoIn a parallel comment[1]. I wouldn't know it is a deepfake. [1]https://news.ycombinator.com/item?id=26924229 https://news.ycombinator.com/item?id=26924229
- amelius 6y agoThis could mean that video calls can be compressed more aggressively. I.e., just send someone's face once, and then send posture and facial expression parameters for the remainder of the session.
- bserge 6y agoWell, this is interesting. Just as people all around the world realized they don't need to travel all that much. Though, it doesn't seem all that hard to verify who you're talking to. Perhaps there's a great business opportunity for a "secure, verified" communication app.
- bryanrasmussen 6y agohmm, is the magic use of the word 'blockchain' still guaranteeing funding?
- vmception 6y agoyes, it does, but you need to include “cross chain yield farming aggregator” in the pitch now or like just don’t do a pitch at all and just launch that the email is in the bio you know what to do
- ignoramous 6y ago> “cross chain yield farming aggregator” For folks like me out of the loop, this is a real thing: cross-chain / inter-chain: https://archive.is/5ncNj https://archive.is/5ncNj yield farming: https://archive.is/7JupX https://archive.is/7JupX aggregators: https://archive.is/qmUOO https://archive.is/qmUOO
- lucb1e 6y agoThe keyword "fintech" and email are in user's actual bio, story checks out.
- foepys 6y agoHow about we skip all the block and chain parts and just use the cryptography part to sign and encrypt a call?
- berkes 6y agoNow I'm seeing heads of state, exchanging slips of paper in a GPG keysigning party, in my mind's eye.
- donkeyd 6y agoThis seems like the first instance of deep fakes fooling politicians on a geopolitical scale. The repercussions of this are huge. I really wonder how big the impact of this technology is going to be, especially since corona has made online meetings even more prevalent.
- dannyw 6y agoCryptography (public key signatures) can mitigate this, alongside a globally public, decentralised identity system. I predict that in 2030, we'll all be using digital signatures as part of our identity, whether directly or indirectly.
- waihtis 6y agoAre there any examples of decentralized things running at such scale? Whether in the digital world or physical?
- donkeyd 6y agoGood point on the cryptography. My passport already contains such a key, so it is probably feasible to use something like this for trusted communications.
- berkes 6y agoUntil you reach the level of authorities that provide those signatures. I'd imagine fake IDs with properly signed cryptographic keys on their chips are available to any higher FBI, FSB or other agents.
- ntauthority 6y agoFor their respective nations and ones considered friendly - likely. For more foreign nations? Given proper PKI, I'd hope not.
- happyconcepts 6y agoMy dads second wife has five passports. And more than a few names. Whereas my single passport is expired mostly because I dont plan to go anywhere.
- amelius 6y agoThe solution is simple: PGP support in every video conferencing tool.
- k__ 6y agoMaybe this threat will finally make it more widespread and easier to use.
- vbsteven 6y agoAn interesting idea. For WebRTC this information could possibly be exchanged in the SDP offer/answer messages. An extra line in the SDP with a signature and some key info.
- zeckalpha 6y agoEasily MITMed for this use case.
- amelius 6y agoYou exchange a key using PGP. Then you use this key to encrypt the connection.
- ernopp 6y agoCould we do that with a low-enough performance hit?
- CasperDern 6y agoYes, it's pretty common in the modern web (search terms: ECDH, TLS). In this case it would be as fast as any E2EE connection.
- deleted 6y ago[deleted]
- lucb1e 6y ago
- bijant 6y agoIt‘s not like any one of those politicians knew his Chief of staff. Additionally, he was probably being translated from his native Russian, or speaking mediocre English. It would not have been difficult for any random person to „imitate“ him. The main Qualification would seem to be the ability to not burst out laughing. A deep fake of an actual public figure would be a different matter entirely.
- black_puppydog 6y agoThat doesn't make it any less intimidating. This meeting (if undetected) could've easily been used to pour gasoline on the fire of that situation. Not everyone who's opinion matters greatly and will have serious impact on decision makers is well-known enough to be "safe" from this.
- ahepp 6y agoIt does make deep fakes less (immediately) intimidating, because they can't (currently) do anything a human impersonator can't also
- black_puppydog 6y agoI'd say the criminal energy & logistical effort of finding an impersonator who looks sufficiently similar and is down for shady stuff makes buying a decent GPU workstation look downright trivial...
- aasasd 6y agoIndeed, it's probably very hard to find out what he looks like, despite his and Navalny's Anti-Corruption Foundation giving talks to European state and human-rights organizations for years now. And indubitably he speaks like a bear, he's a Russian after all: https://www.youtube.com/watch?v=bw84XVPlaCk https://www.youtube.com/watch?v=bw84XVPlaCk
- permo-w 6y agoExcellent use of sarcasm, I have to say, but it isn’t an unfair generalisation that Russians don’t speak English very well. English isn’t and hasn’t been commonly taught in Russian schools like in Europe
- open-source-ux 6y agoDeep fakes seem destined to be the next source of political disinformation. The trouble is that by the time the 'deep fake' has been debunked, it has already made it's impact by spreading at rocket speed across social media. It's quite chilling what the consequences could be for political campaigns and debate. This is an example of 'deep fakes' of two British politicians. If you look closely you can spot something amiss in the way they speak. Lots of people won't be look closely though. And this is from 2019 - the technology can only have improved since then. The fake video where Boris Johnson and Jeremy Corbyn endorse each other (2019) https://www.bbc.co.uk/news/av/technology-50381728 https://www.bbc.co.uk/news/av/technology-50381728
- zokier 6y agoWhile technically curious, from legal/societal point of view to me there doesn't seem to be huge difference between having a deepfake or a lookalike actor on the other end. And with old-fashioned telephone presumably has had this impostor problem since forever.
- jonplackett 6y agoQuite a few politicians have been caught out by phone call pranksters in the past too. I guess this is getting more attention because it’s not just a prank. Makes you wonder though, if pranksters could do it, how often spies have just used fake phone calls before now!
- JimBlackwood 6y agoAslong as the message from the deepfake or lookalike actor is authorized by the person you’re intending to speak to. That’s mostly the problem here.
- dalbasal 6y agoIt's always hard to know if tech based phenomenon is actually new or just a migration of something to digital form. There are two ways to be wrong, broadly. One way is the "technically true" error. There are plenty of predecessors to twitter, spam, podcasting, etc. Legally, philosophically and such... it's usually easy to underestimate impact because it really is "nothing new." But... in different medium, at a different scale or higher velocity things change. Junk mail is like spam, but the junk mail problem rarely got beyond manual handling scale. The other way to be wrong is the opposite. Assuming that digitization will create change, but all we get is a digital version of the previous. It's hard to know the future. I agree that Deepfake is likely not going to change the world of imposter/fraud too much, though it may get a lot of attention. OTOH, I do think it has the potential to weird up the entertainment world. I also think it could be high impact in media. If nothing else, it'll strengthen the "skeptical of everything" segment's skepticism. That said, guessing these things is a losing game.
- rwmj 6y agoNow they don't need to hire a lookalike actor or impersonator, so that both greatly reduces the chance of the getting caught because you can use someone already on your team (instead of an actor), and increases your capabilities because you can call more targets, more often. At last a genuine case of computers improving productivity ...
- lordnacho 6y agoIIRC, in a previous installment of this drama, Navalny himself somehow phoned the people who poisoned him and got them to admit doing so, how it was done (underpants) , and their reasons for failure (it was a murder plot). Someone has gotta do a movie of this.
- oefrha 6y agoThe story misses the actually interesting part: how did they establish contact and initiate the call in the first place? It’s not like you or I can simply call up <country>’s parliament on Zoom. There’s gotta be some channel of authentication other than “dude in video call looks like some politician” (or some politician’s staff of whom they can find some photos on Google Images), too.
- FatalLogic 6y agoIt's likely to be a kind of privilege escalation and trust transfer. They first fool a chain of trusted outside sources and lower-level staff to raise their trust level to be accepted by the target.
- jonplackett 6y agoThat, plus I’d like to know what they discussed!
- slim 6y agoIt’s not like you or I can simply call up <country>’s parliament on Zoom. Actually yes, mostly. You just need to contact one of the sympathetic MPs, on social networks for example, and he will set it up for you. They're not more security conscious than the general population.
- aasasd 6y agoFor some context, the ‘Anti-Corruption Foundation’ of Navalny and Volkov was giving talks for European and US state/human-rights organizations for years. It's actually a bit weird if MPs didn't get Volkov's phone number and other contact info from colleages of other countries. But then, phone numbers can be spoofed, and if these incidents are done by the state—the FSS follows ACF for a long time now, they probably know quite well who Volkov speaks to.
- jeroenhd 6y agoGetting into contact with the Dutch parliament is actually quite easy, if you have a story interesting enough, you can probably get them to read your email and forward the Zoom link. A simple phishing attack should be more than enough to confuse these people. They're almost all exclusively schooled in social sciences, business, history, that kind of thing. Incredibly few of them have any sort of technical background. There are plenty of agencies working their hardest to keep the political leaders safe, but they can't fix the people themselves. A Dutch journalist managed to get into a "secret" Zoom call with the European ministers of defence after a Dutch politician posted a picture of her screen... with the invite link and most of the password visible. I'm sure they're intelligent people, but when it comes to computers, their young children/grandchildren are probably more capable of securing themselves online than they can. Also keep in mind that there's an aura of secrecy surrounding Navalny's chief of staff even before the Russian government tried to kill Navalny. Things like routing traffic through TOR and the use of privacy-enhancing technologies like Fastmail can be well explained in an environment where the government actively wants to kill any competition to the current leadership. In truth, I think these people have fallen for a well-put-together spear phishing attack that worked well because of their lack of digital skills. I strongly doubt that the leaders of other countries will do much better; politicians and tech rarely mix well. I find it much more troubling that the Dutch government is using Zoom, a product with a terrible history in security problems from a company based in the country that notoriously spied on politicians of even just allied countries. Using American software for government videoconferencing (especially about Russian politics) is a terrible risk.
- the-dude 6y agoSo if they went all out of their way to create a deepfake, what was their mission? I assume if you employ a deepfake, you also have a 'fake' message to put across.
- gostsamo 6y agoRussian prangsters have contacted western politicians and tried to record them saying something compromising or at least stupid in order to air them on the TV. It might be something like that or trying to probe those parliaments to get an idea of their positions and likely future steps plus their red lines of support. So, it might've been an intelligence gathering operation.
- the-dude 6y agoGood point, I hadn't thought of it. IANAS ( I am not a spy )
- wbeckler 6y agoZoom bought keybase a while back. Now it's time to use their identity verification features.
- lucgommans 6y agoNote that Keybase never offered end-to-end encryption, they tried to solve it with blockchain magic and, granted, got quite far (what they made truly was innovative), but missed a tiny step of actually checking the blockchain (which would be resource-intensive for mobile devices, which is why they pushed it back for later solving) or offering any other way of verifying the encryption keys. I actually reached out to Keybase as well as one of the NCC auditors that I've talked to in the past for unrelated reasons, but the auditors are playing deaf and Keybase (on the third contact attempt) claims it's safe because of the decentralized social proofs (which aren't actually verified by the app -- you trust solely on the Keybase servers to give you the right encryption keys). All details are here: https://security.stackexchange.com/questions/222055/how-can-i-verify-keybases-end-to-end-encryption-between-me-and-a-friend https://security.stackexchange.com/questions/222055/how-can-... The whole thing seems moot now that Zoom bought them, but so now if Zoom does anything with blockchain and supposed end-to-end encryption, I'd be very weary and verify things regardless of whether it was audited. Even as a user, you can make sure they covered the basics (from my StackExchange post linked above): > Users should have demanded followable instructions. We should have questioned Keybase, now Zoom, and anyone who makes a strong security claim. They claim it? You should want to see steps you can follow to verify it. Since you put your trust in the published code, those instructions should not involve any command line coding work, and definitely not have gaps like verifying keys on your laptop and hoping that the server sent the same keys to your phone.
- pedro2 6y agoWell, use S/MIME for emails? Wouldn’t that make such things more difficult to happen?
- 002445 6y agoIt doesn't surprise me one bit that dutch politicians neglected to do their due diligence.
- kangaroozach 6y agoBlade Runner
- INTPenis 6y agoTime to host key-signing parties again. Maybe in the future we'll talk about unsigned people instead of undocumented people.
- kangaroozach 6y agoThink how much easier this would be with a mask on like our clown in chief who is the only world leader to wear a mask on the recent Zoom call with world leaders.
- EVa5I7bHFq9mnYK 6y agoStill many sites require upload of a photo holding up a government ID as a proof of identification. Time to stop this nonsense and turn to real cryptographic solutions.
- sneeuwpopsneeuw 5y agoThe original source article https://www.volkskrant.nl/nieuws-achtergrond/kamerleden-spraken-met-een-nepversie-van-de-stafchef-van-navalny-deepfake-of-dubbelganger~b57ab1ab/ https://www.volkskrant.nl/nieuws-achtergrond/kamerleden-spra... has some interesting remarks. Because there are no video recordings its very hard to investigate this situation. The article also asks the question if it was: just an actor, a deepfake or an actor with general video altering software and that there is no way of knowing without the source material. An other video in the personal time of the Dutch Prime minister https://www.nrc.nl/nieuws/2021/04/23/door-schrijver-gepubliceerde-en-verwijderde-video-van-rutte-blijkt-niet-nep-a4041126 https://www.nrc.nl/nieuws/2021/04/23/door-schrijver-gepublic... (disable JS for no paywall) there was a similar situation. Many people thought it was a deepfake or that the voice was altered or copied from an other video but later the government put out an statement that the video was real. I wanted to share this because I saw multiple people claim that PGP may solve all problems but the problem is both ways. Real videos are also being labeled as deepfakes. So yes PGP will help solve a part of the problem but there is a bigger trust issue that needs to be solved.