19 ms·

FBI: Stolen PII and deepfakes used to apply for remote tech jobs

295 points by mikece 4y ago

quantified 4y ago
We've been very concerned earlier about what deepfaking a world leader might result in. Still a concern on that, but we can have endless amounts of additional fun with realistic deepfaking B- and C-list celebs and all "influencers" who have left enormous trails of audio and video. Picture an adversary setting up a large deepfake campaign involving hundreds or thousands of fakes, esp coordinated with their use of the hundreds or thousands of curated social media profiles that have been raised on a media farm.
- mmebane 4y ago
  With social media influencers, you don't even have to worry much about the deepfakes glitching - the usage of filters is rampant enough that glitches have been completely normalized.
  - treeman79 4y ago
    Had an influencer make me up crap about a her work. Hundreds of people calling her out on it. Her fans did not care. Comments all got buried or deleted. The fans would come up with dumbest possible rebuttals. Basically they liked her she was pretty therefore she was right about everything. And all the easy to verify facts were not important.
    - Dan_Sylveste 4y ago
      Any halfway competent social media management team has enough bots on standby to be able to sweep anything but an absolute stone cold dead-body-in-the-trunk scandal under the rug in seconds. Step 1 of managing any celeb's social media profile is to add 15k of bots to their followers so you can 'forum slide' any criticism away at will.
  - tluyben2 4y ago
    There are entire subreddits devoted to how incredibly fake instagram and TikTok people make themselves look with filters so yes, this is already normal with real people. It would not take much.
- sva_ 4y ago
  You could probably grow a farm of deep fakes on some social media site, talking to each other about peculiar niche things using language models, and once that farm is big enough use it to shift opinions/attack. It's scary how small groups of people, or even an individual could do that.
  - ramesh31 4y ago
    >You could probably grow a farm of deep fakes on some social media site, talking to each other about peculiar niche things using language models, and once that farm is big enough use it to shift opinions/attack. It's scary how small groups of people, or even an individual could do that. You've just described half of Twitter's MAUs.
    - pempem 4y ago
      It also feels very like ender's game near the end of the book
  - tablespoon 4y ago
    > You could probably grow a farm of deep fakes on some social media site, talking to each other about peculiar niche things using language models, and once that farm is big enough use it to shift opinions/attack. It's scary how small groups of people, or even an individual could do that. Wouldn't that be fairly easy to detect because the accounts would belong to an isolated, tightly-connected cluster?
    - quantified 4y ago
      State actors can design societies with lots of different clusters. It's all in the simulator you design. And a large actor could easily require that its humans engage with members of this society to connect them with humanity.
    - deleted 4y ago
      [deleted]
    - sva_ 4y ago
lemoncookiechip 4y ago
This is both fascinating and a scary reminder of what the future has in store for us in a deepfake world.
- Melting_Harps 4y ago
  > This is both fascinating and a scary reminder of what the future has in store for us in a deepfake world. Social engineering has always been a thing, check out this Darknet Diary podcast about the Lazeraus hacking collective group (suspected to be N. Korean digital Army) and how they have try/tried to infiltrate their way into crytocurrency based exchanges--and have succeeded in the past--using all kinds of methods including hijacking CVs from Linkedin. The truth is that while the advent of deepfakes and even text to image AI/ML based tech has muddled the waters even more, it's always been a challenge to not encounter some level of difficulty when dealing with verification. Fraud is and will always remain a component in daily operations of any organization. We have a saying in the Bitcoin space that i think applies here: Do not trust, verify. And this is why I think people need to understand that the usecases for an immutable ledger can and will go beyond just a digital token (it's only the backbone), and these usecases (the limbs and appendages to continue with the body metaphor) will become more imperative in the 21st Century: you can manipulate all you want via social media and many have, but if verified sources with proper validation is stored on an immutable ledger with a cryptographic proof of work blockchain that is impossible to alter then you can essentially have the closest thing to verifiable truth Online. Jacob Applbaum said it best when he said that to maintain security online you'll likely have to adopt 2 or more identities separate from each other to continue to have some level of assurance that your personas are not traceable to your real ID in a World where Doxxing became 'a thing' Online. I wonder hat he has to say about the OPSEC/INFOSEC space now that we have the ability to mimic people Online so closely with very little resources. 0: https://darknetdiaries.com/episode/119/ https://darknetdiaries.com/episode/119/
- chrisco255 4y ago
  What's scary to me isn't the scammers using deep fakes to get jobs, but the mid managers dumb enough to fall for it.
mistrial9 4y ago
from this point of view -- it says more about the "job market" and forgery-for-pay than the deepfakes .. it was one year ago I saw a video documentary on young men from various places, in the keep of handlers who charged them rent and maintenance while they applied for remote tech jobs. The handlers were show to clean-up or embellish skill sets, claim English skills or write responses for the applicants, and other fraudulent activity. Meanwhile, on the other side of that, investors have put money into hiring companies who want to follow in the Monster dot com path but more specialized skills or particular clients. The work of outsourcing is just never done it seems, and apparently pays investors and handlers well enough to do these things. Deepfakes makes it part show-business, which is not new either, really.
- goatcode 4y ago
  I was recently approached by a firm that it seems does a similar thing to what you've described. As a native english speaking tech professional, they wanted me to assist others in initial video interviews for tech positions. I don't know how any amount of spin or perspective could sell such a thing as anything but fraud. I honestly couldn't even put together how it would work long term, but I suppose with the nature of some remote work, it might be possible by a committed actor or agency. It's creepy as heck, and reminds me of that movie "Gattica."
  - jstarfish 4y ago
    > I don't know how any amount of spin or perspective could sell such a thing as anything but fraud. It might be fraud, it might not. This sounds like SOP for literally every "recruitment" outfit I've ever encountered. Every single one encouraged candidates to tailor their credentials to the job requirements.
    - goatcode 4y ago
      I was being asked to pretend to be someone I was not, in order to fool a company to which an applicant was applying. I may not have described it well and perhaps this lead to the confusion, but what I was approached for was most definitely fraud. Tailoring applications certainly makes sense, so long as the output still reflects the skills and qualifications of the applicant.
Magi604 4y ago
I know there is a growing movement of people who are doubling up on remote jobs, trying to work two of them (or more!) at the same time to hack the income game. Surely some of these people are using deepfakes to help avoid detection that they are doing those things.
- moneywoes 4y ago
  Why go through all that hassle of faking another persons ID? Another resume etc
  - walrus01 4y ago
    People outside the US/Canada who might not be otherwise eligible to be hired as a W2 or T4 equivalent employee. If you have a US resident's stolen PII and can somehow set up a bank account to receive ACH direct deposits, and are a good enough social engineer, can possibly get hired under that name.
  - kevin_thibedeau 4y ago
    Equifax will narc on you. Bow down before your data broker overlords.
    - mardifoufs 4y ago
      Hireright can also be nasty with the background checks, to the point of asking you to correct irrelevant minor typos (say, a space) in you credit file before validating your identity.
- dontbenebby 4y ago
  What industry? Over in infosec, they seem to just do courtesy interviews to suss out if I did some ecrime the feds are sniffing about, find out they were incorrect, then not even have the common courtesy to drop the act and offer to pay me as a consultant rather than treat job interviews as fishing expeditions.
  - 4y ago
tablespoon 4y ago
> While some of the deepfake recordings used are convincing enough, others can be easily detected due to various sync mismatches, mainly spoofing the applicants' voices. > "Complaints report the use of voice spoofing, or potentially voice deepfakes, during online interviews of the potential applicants," the US federal law enforcement agency added. Something about this doesn't smell right: 1) Don't video deepfakes require lots of high-quality input video (which is why they were often made of Obama)? Where would an attacker get this for some rando? 2) Why would voice deep-fakes even be necessary, given the interviewee is very unlikely to be known by the interviewer? I suppose it could be used to fake accents, but I don't think that would be an issue for a "remote tech job" -- just steal an identity that could plausibly have your accent.
- mirker 4y ago
  Regarding 1) and following 2) you only need to make realistic-enough video that it passes as a person and is similar enough to the target person. For example, you can have a pretrained model (e.g., using zero targeted data) and search for some configuration that is closest to the target person. You only need to match a few variables (e.g., ethnicity, gender, hair color, age) before the fake is plausible.
- jstarfish 4y ago
  > Why would voice deep-fakes even be necessary, given the interviewee is very unlikely to be known by the interviewer? I suppose it could be used to fake accents, You have it backwards-- the point is accent elimination. You don't need to sound like someone else, but you do need to not sound like someone of your own locale.
  - hgsgm 4y ago
    Accents can only be changed, not eliminated.
    - Calavar 4y ago
      That's a strange dichotomy to make. How is accent elimination different from an accent change from a nonstandard accent to a standard accent?
taylorfinley 4y ago
Relevant twitter thread from a hiring manager who had one of these interviews: https://twitter.com/jonwu_/status/1520072367069876224 https://twitter.com/jonwu_/status/1520072367069876224
- deadbunny 4y ago
  Doesn't sound like any of the techniques used in the article were used in that thread, no deep fake vide, no deep faked voice. Just some Korean person (possibly) trying to gain access via remote working policies, and not very well by the sounds of it.
- whimsicalism 4y ago
  Seems like scant evidence to conclude that you were interviewing a North Korea hacker but I guess many on blockchain twitter are more credulous than I am. > The "Okay?" is a DEAD FUCKING GIVEAWAY this guy is Korean. ....right.
  - mhh__ 4y ago
    Well I can tell someone is dutch based on their accent, it's not that far fetched.
  - notahacker 4y ago
    An interviewee speaking quite formal English quite badly, punctuating sentences with question words and having an accent that isn't Korean-American but sounds a bit like it, and interviewing somewhere with lot of background noise because he apparently doesn't have an independent space to work in is actually pretty consistent with him being from Hong Kong like he said he was...
  - superfrank 4y ago
    I agree. The guy posted that tweet even admits that he's jumping to conclusions. First tweet: > No bullshit I think I just interviewed a North Korean hacker. 21st tweet: > In reality, I have no idea if these even were North Korean hackers. Bobby could've been, well, just a really incompetent dude.
frereubu 4y ago
An amusing short story related to this problem from This American Life, where the employers allow themselves to be fooled for a while, even without deepfakes: https://www.thisamericanlife.org/770/my-lying-eyes/prologue-2 https://www.thisamericanlife.org/770/my-lying-eyes/prologue-... Edit: and this technique is mentioned in one of the replies: https://twitter.com/staringispolite/status/1520093967559249920 https://twitter.com/staringispolite/status/15200939675592499...
99_00 4y ago
1. Secure a bunch low skill remote jobs. 2. Have low pay foreign workers work the jobs 3. Keep 50% of the salary give worker 50% and run Heath insurance scams.
- mellavora 4y ago
  1) Secure a bunch of low skill remote jobs 2) automate git co-pilot 3) keep 100% of salary and run health insurance scams
hijohnnylin 4y ago
MANAGER: “hey uh, my friend at a different company said you applied for a job there this week?” EMPLOYEE: “uhhhhhh…. that was… uhhh… a deepfake who also stole my information?” MANAGER: “oh okay. yeah of course you would never try to double/triple your salary by taking multiple remote tech jobs with zero oversight. my friend said it seemed so real haha. deepfake are so good now. im gonna report this to the FBI, people need to know.” EMPLOYEE: “yea haha amazing. anyway i gotta get back to not-my-other-job”
- roflyear 4y ago
  Lots of people are doing it!
  - DoingIsLearning 4y ago
    Lots of people claim to do it on a fringe sub-reddit for internet points. If you are doing it as a non-hourly contractor, more power to you. But advertising OE as common place really hinders the paradigm of remote work.
    - roflyear 4y ago
      Yeah I agree, I was half joking.
    - SwanRonson 4y ago
      I know of one person who does it right now (not in the tech field). It seems possible in certain positions in some fields but requires a lot of planning, some luck, and a lot of work. As long as it’s a salaried position and you’re getting the job done at/above expectations, the company shouldn’t care as much as some of them seem to.
    - aaaaaaaaata 4y ago
      It more so hinders the concept of seniority and credentials vs merit.
- vsareto 4y ago
landryraccoon 4y ago
I didn’t know having multiple remote jobs simultaneously wasn’t kosher. Why resort to Hollywood? I do it all the time. It’s called being a contractor.
- WalterBright 4y ago
  It isn't kosher if you were hired as a full time employee.
WalterBright 4y ago
Soon AI bots will be applying for remote jobs.
tflinton 4y ago
I've had remote candidates in India lip sync an interview, but I don't think it was deep fakes, but rather the audio was coming from someone off screen while the person on screen was trying to mimic them. My guess is someone was trying to help them get the job, i'm not sure to what end though and regardless, we didn't hire the person.
- deleted 4y ago
  [deleted]
johndhi 4y ago
I'm not sure this is a greater risk than currently exists with in person interviews.
- coredog64 4y ago
  With in-person interviews you can check IDs as part of the “sign in through building security” process. And in fact, if you’re flying the candidate in, your travel department can get their passport details.
samstave 4y ago
Without DeepFakes: I know several people in tech in the bay area who locally interviewed for contracts, got the job, then outsourced all tasks to eastern-eu folks whom they hired as a sub and project managed them. Basically, hiring an consulting company masked as an individual.
Reason077 4y ago
Makes you wonder how many jobs out there are already being done by deepfakes.
donatj 4y ago
I recently had a person using my photo and work experience to get side gigs on Upwork. A customer of theirs contacted me directly for help which is how I found out about it. Upwork removed the profile after some prodding. I feel like I should report identity theft to the police or something but I don't know if it's worth the bother? https://twitter.com/donatj/status/1529266972403585024 https://twitter.com/donatj/status/1529266972403585024
- Nextgrid 4y ago
  Reporting it is only worth it to have a paper trail in case the identity theft then brings you into legal trouble such as taking out credit in your name, etc. If they’re only using publicly-available info I wouldn’t bother.
- __derek__ 4y ago
  Yes, you should report it: this person committed multiple crimes, and Upwork has a duty to avoid facilitating fraud.
- gzer0 4y ago
  Why do this at all when websites such as https://this-person-does-not-exist.com/en https://this-person-does-not-exist.com/en already exist? Available for anyone to take and utilize. I have a (hidden) suspicion that a greater proportion of LinkedIn's reported "active users" are, in fact, a group of people with these profile images and fraudulent profiles.
  - yjftsjthsd-h 4y ago
    Maybe it helps in the hiring process to have a real person's history?
  - donatj 4y ago
    I think part of it is Upwork let's you just point a new profile at ANY LinkedIn profile and import it. I suspect they just pointed it at mine and were off to the races.
tehjoker 4y ago
Wherever the FBI announces something you have to ask what political purpose are they trying to scare people? In this case I assume to try to give justification to managers that want to bring people back to the office using the fig leaf of concern over fraud.
discordance 4y ago
The personas might be fake but the bank accounts are not. Surely that would ring alarm bells?
b1n 4y ago
Remote workers probably should not have access to large amounts of PII/financial data/etc. in the first place! There seem to be a few separate issues with remote work: 1. Identification of real people (solvable with SSI's Verifiable Credentials or a traditional KYC company) 2. Employee holding multiple remote jobs (solvable by focusing on productive output rather than number of hours worked) 3. If rogue employee gets 20 jobs they only need to 'work' unproductively for a short time before getting fired. (solution? maybe reduced pay for initial months with the following months of employment overpaying until initial underpayment is made up?)
deleted 4y ago
[deleted]
knodi123 4y ago
I get tons of email like "Thanks for the application, you're the kind of person we're looking for, please come interview at such-and-such a time, and bring the following documentation..." If I was looking for entry-level QA or IT jobs, I'd probably explore one just for laughs. I suspect it's less of a hacker/pii problem, and more my own fault for having the kind of email address that random weirdos are likely to type in when they are doing something hinky on employment websites.
b20000 4y ago
looks like that leetcode garbage doesn’t work after all.
TheGigaChad 4y ago
sun_machine 4y ago
Only slightly related, but a Japanese friend of mine has a story of interviewing a few engineering candidates for their remote crypto company. They all applied under Japanese names, claiming they were Japanese citizens in Japan. When the interview came around, they all spoke English with a Korean accent, and when asked if Japanese would be better they admitted they could not speak Japanese. When my friend asked around it sounded like many founders in the space have encountered this profile of applicant, and many suspect these are people working for the North Korean state. If this is indeed North Koreans trying to get remote jobs, I've been wondering if their game is: - Getting a job for themselves to bring income to their own household - Getting a job for themselves to bring income to the North Korean state. - Getting a job in a crypto company with plans of figuring out vulnerabilities and siphoning funds to themselves/the state. - Getting a job for others, and selling the service of passing the interview.
- crumpled 4y ago
  Episode 119 of Darkness Diaries (podcast) is about North Korean crypto hackers, and it touches on that. Basically, if you have the freedom to wander the internet, it's because the government provides your connection for their own government purposes.
  - r12343a_19 4y ago
    > Basically, if you have the freedom to wander the internet, it's because the government provides your connection for their own government purposes. This sounds so cynical. What if your freedom to wander the internet fills the same purposes?
- gkanai 4y ago
  Alert (AA22-108A) TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies https://www.cisa.gov/uscert/ncas/alerts/aa22-108a https://www.cisa.gov/uscert/ncas/alerts/aa22-108a
- astura 4y ago
  It's number 2 - Getting a job for themselves to bring income to the North Korean state and number 3 - Getting a job in a crypto company with plans of figuring out vulnerabilities and siphoning funds to t̶h̶e̶m̶s̶e̶l̶v̶e̶s̶/the state. The FBI has put out a warning - https://www.theguardian.com/world/2022/may/17/dont-accidentally-hire-a-north-korean-hacker-fbi-warns https://www.theguardian.com/world/2022/may/17/dont-accidenta... Normal people are only allowed to go online in North Korea on state business.
mauriciolange 4y ago
Reading the title my first thought was "wow! they are still using this Pentium II CPUs". Then I learned what PII is...

295 points by mikece 4y ago

We've been very concerned earlier about what deepfaking a world leader might result in. Still a concern on that, but we can have endless amounts of additional fun with realistic deepfaking B- and C-list celebs and all "influencers" who have left enormous trails of audio and video. Picture an adversary setting up a large deepfake campaign involving hundreds or thousands of fakes, esp coordinated with their use of the hundreds or thousands of curated social media profiles that have been raised on a media farm.

mmebane 4y ago
With social media influencers, you don't even have to worry much about the deepfakes glitching - the usage of filters is rampant enough that glitches have been completely normalized.
- treeman79 4y ago
  Had an influencer make me up crap about a her work. Hundreds of people calling her out on it. Her fans did not care. Comments all got buried or deleted. The fans would come up with dumbest possible rebuttals. Basically they liked her she was pretty therefore she was right about everything. And all the easy to verify facts were not important.
  - Dan_Sylveste 4y ago
    Any halfway competent social media management team has enough bots on standby to be able to sweep anything but an absolute stone cold dead-body-in-the-trunk scandal under the rug in seconds. Step 1 of managing any celeb's social media profile is to add 15k of bots to their followers so you can 'forum slide' any criticism away at will.
- tluyben2 4y ago
  There are entire subreddits devoted to how incredibly fake instagram and TikTok people make themselves look with filters so yes, this is already normal with real people. It would not take much.
sva_ 4y ago
You could probably grow a farm of deep fakes on some social media site, talking to each other about peculiar niche things using language models, and once that farm is big enough use it to shift opinions/attack. It's scary how small groups of people, or even an individual could do that.
- ramesh31 4y ago
  >You could probably grow a farm of deep fakes on some social media site, talking to each other about peculiar niche things using language models, and once that farm is big enough use it to shift opinions/attack. It's scary how small groups of people, or even an individual could do that. You've just described half of Twitter's MAUs.
  - pempem 4y ago
    It also feels very like ender's game near the end of the book
- tablespoon 4y ago
  > You could probably grow a farm of deep fakes on some social media site, talking to each other about peculiar niche things using language models, and once that farm is big enough use it to shift opinions/attack. It's scary how small groups of people, or even an individual could do that. Wouldn't that be fairly easy to detect because the accounts would belong to an isolated, tightly-connected cluster?
  - quantified 4y ago
    State actors can design societies with lots of different clusters. It's all in the simulator you design. And a large actor could easily require that its humans engage with members of this society to connect them with humanity.
  - deleted 4y ago
    [deleted]
  - sva_ 4y ago

lemoncookiechip 4y ago

This is both fascinating and a scary reminder of what the future has in store for us in a deepfake world.

Melting_Harps 4y ago
> This is both fascinating and a scary reminder of what the future has in store for us in a deepfake world. Social engineering has always been a thing, check out this Darknet Diary podcast about the Lazeraus hacking collective group (suspected to be N. Korean digital Army) and how they have try/tried to infiltrate their way into crytocurrency based exchanges--and have succeeded in the past--using all kinds of methods including hijacking CVs from Linkedin. The truth is that while the advent of deepfakes and even text to image AI/ML based tech has muddled the waters even more, it's always been a challenge to not encounter some level of difficulty when dealing with verification. Fraud is and will always remain a component in daily operations of any organization. We have a saying in the Bitcoin space that i think applies here: Do not trust, verify. And this is why I think people need to understand that the usecases for an immutable ledger can and will go beyond just a digital token (it's only the backbone), and these usecases (the limbs and appendages to continue with the body metaphor) will become more imperative in the 21st Century: you can manipulate all you want via social media and many have, but if verified sources with proper validation is stored on an immutable ledger with a cryptographic proof of work blockchain that is impossible to alter then you can essentially have the closest thing to verifiable truth Online. Jacob Applbaum said it best when he said that to maintain security online you'll likely have to adopt 2 or more identities separate from each other to continue to have some level of assurance that your personas are not traceable to your real ID in a World where Doxxing became 'a thing' Online. I wonder hat he has to say about the OPSEC/INFOSEC space now that we have the ability to mimic people Online so closely with very little resources. 0: https://darknetdiaries.com/episode/119/ https://darknetdiaries.com/episode/119/
chrisco255 4y ago
What's scary to me isn't the scammers using deep fakes to get jobs, but the mid managers dumb enough to fall for it.

mistrial9 4y ago

from this point of view -- it says more about the "job market" and forgery-for-pay than the deepfakes .. it was one year ago I saw a video documentary on young men from various places, in the keep of handlers who charged them rent and maintenance while they applied for remote tech jobs. The handlers were show to clean-up or embellish skill sets, claim English skills or write responses for the applicants, and other fraudulent activity. Meanwhile, on the other side of that, investors have put money into hiring companies who want to follow in the Monster dot com path but more specialized skills or particular clients. The work of outsourcing is just never done it seems, and apparently pays investors and handlers well enough to do these things. Deepfakes makes it part show-business, which is not new either, really.

goatcode 4y ago
I was recently approached by a firm that it seems does a similar thing to what you've described. As a native english speaking tech professional, they wanted me to assist others in initial video interviews for tech positions. I don't know how any amount of spin or perspective could sell such a thing as anything but fraud. I honestly couldn't even put together how it would work long term, but I suppose with the nature of some remote work, it might be possible by a committed actor or agency. It's creepy as heck, and reminds me of that movie "Gattica."
- jstarfish 4y ago
  > I don't know how any amount of spin or perspective could sell such a thing as anything but fraud. It might be fraud, it might not. This sounds like SOP for literally every "recruitment" outfit I've ever encountered. Every single one encouraged candidates to tailor their credentials to the job requirements.
  - goatcode 4y ago
    I was being asked to pretend to be someone I was not, in order to fool a company to which an applicant was applying. I may not have described it well and perhaps this lead to the confusion, but what I was approached for was most definitely fraud. Tailoring applications certainly makes sense, so long as the output still reflects the skills and qualifications of the applicant.

Magi604 4y ago

I know there is a growing movement of people who are doubling up on remote jobs, trying to work two of them (or more!) at the same time to hack the income game. Surely some of these people are using deepfakes to help avoid detection that they are doing those things.

moneywoes 4y ago
Why go through all that hassle of faking another persons ID? Another resume etc
- walrus01 4y ago
  People outside the US/Canada who might not be otherwise eligible to be hired as a W2 or T4 equivalent employee. If you have a US resident's stolen PII and can somehow set up a bank account to receive ACH direct deposits, and are a good enough social engineer, can possibly get hired under that name.
- kevin_thibedeau 4y ago
  Equifax will narc on you. Bow down before your data broker overlords.
  - mardifoufs 4y ago
    Hireright can also be nasty with the background checks, to the point of asking you to correct irrelevant minor typos (say, a space) in you credit file before validating your identity.
dontbenebby 4y ago
What industry? Over in infosec, they seem to just do courtesy interviews to suss out if I did some ecrime the feds are sniffing about, find out they were incorrect, then not even have the common courtesy to drop the act and offer to pay me as a consultant rather than treat job interviews as fishing expeditions.
- 4y ago

tablespoon 4y ago

> While some of the deepfake recordings used are convincing enough, others can be easily detected due to various sync mismatches, mainly spoofing the applicants' voices. > "Complaints report the use of voice spoofing, or potentially voice deepfakes, during online interviews of the potential applicants," the US federal law enforcement agency added. Something about this doesn't smell right: 1) Don't video deepfakes require lots of high-quality input video (which is why they were often made of Obama)? Where would an attacker get this for some rando? 2) Why would voice deep-fakes even be necessary, given the interviewee is very unlikely to be known by the interviewer? I suppose it could be used to fake accents, but I don't think that would be an issue for a "remote tech job" -- just steal an identity that could plausibly have your accent.

mirker 4y ago
Regarding 1) and following 2) you only need to make realistic-enough video that it passes as a person and is similar enough to the target person. For example, you can have a pretrained model (e.g., using zero targeted data) and search for some configuration that is closest to the target person. You only need to match a few variables (e.g., ethnicity, gender, hair color, age) before the fake is plausible.
jstarfish 4y ago
> Why would voice deep-fakes even be necessary, given the interviewee is very unlikely to be known by the interviewer? I suppose it could be used to fake accents, You have it backwards-- the point is accent elimination. You don't need to sound like someone else, but you do need to not sound like someone of your own locale.
- hgsgm 4y ago
  Accents can only be changed, not eliminated.
  - Calavar 4y ago
    That's a strange dichotomy to make. How is accent elimination different from an accent change from a nonstandard accent to a standard accent?

taylorfinley 4y ago

Relevant twitter thread from a hiring manager who had one of these interviews: https://twitter.com/jonwu_/status/1520072367069876224 https://twitter.com/jonwu_/status/1520072367069876224

deadbunny 4y ago
Doesn't sound like any of the techniques used in the article were used in that thread, no deep fake vide, no deep faked voice. Just some Korean person (possibly) trying to gain access via remote working policies, and not very well by the sounds of it.
whimsicalism 4y ago
Seems like scant evidence to conclude that you were interviewing a North Korea hacker but I guess many on blockchain twitter are more credulous than I am. > The "Okay?" is a DEAD FUCKING GIVEAWAY this guy is Korean. ....right.
- mhh__ 4y ago
  Well I can tell someone is dutch based on their accent, it's not that far fetched.
- notahacker 4y ago
  An interviewee speaking quite formal English quite badly, punctuating sentences with question words and having an accent that isn't Korean-American but sounds a bit like it, and interviewing somewhere with lot of background noise because he apparently doesn't have an independent space to work in is actually pretty consistent with him being from Hong Kong like he said he was...
- superfrank 4y ago
  I agree. The guy posted that tweet even admits that he's jumping to conclusions. First tweet: > No bullshit I think I just interviewed a North Korean hacker. 21st tweet: > In reality, I have no idea if these even were North Korean hackers. Bobby could've been, well, just a really incompetent dude.

frereubu 4y ago

An amusing short story related to this problem from This American Life, where the employers allow themselves to be fooled for a while, even without deepfakes: https://www.thisamericanlife.org/770/my-lying-eyes/prologue-2 https://www.thisamericanlife.org/770/my-lying-eyes/prologue-... Edit: and this technique is mentioned in one of the replies: https://twitter.com/staringispolite/status/1520093967559249920 https://twitter.com/staringispolite/status/15200939675592499...

99_00 4y ago

1. Secure a bunch low skill remote jobs. 2. Have low pay foreign workers work the jobs 3. Keep 50% of the salary give worker 50% and run Heath insurance scams.

mellavora 4y ago
1) Secure a bunch of low skill remote jobs 2) automate git co-pilot 3) keep 100% of salary and run health insurance scams

hijohnnylin 4y ago

MANAGER: “hey uh, my friend at a different company said you applied for a job there this week?” EMPLOYEE: “uhhhhhh…. that was… uhhh… a deepfake who also stole my information?” MANAGER: “oh okay. yeah of course you would never try to double/triple your salary by taking multiple remote tech jobs with zero oversight. my friend said it seemed so real haha. deepfake are so good now. im gonna report this to the FBI, people need to know.” EMPLOYEE: “yea haha amazing. anyway i gotta get back to not-my-other-job”

roflyear 4y ago
Lots of people are doing it!
- DoingIsLearning 4y ago
  Lots of people claim to do it on a fringe sub-reddit for internet points. If you are doing it as a non-hourly contractor, more power to you. But advertising OE as common place really hinders the paradigm of remote work.
  - roflyear 4y ago
    Yeah I agree, I was half joking.
  - SwanRonson 4y ago
    I know of one person who does it right now (not in the tech field). It seems possible in certain positions in some fields but requires a lot of planning, some luck, and a lot of work. As long as it’s a salaried position and you’re getting the job done at/above expectations, the company shouldn’t care as much as some of them seem to.
  - aaaaaaaaata 4y ago
    It more so hinders the concept of seniority and credentials vs merit.
vsareto 4y ago

landryraccoon 4y ago

I didn’t know having multiple remote jobs simultaneously wasn’t kosher. Why resort to Hollywood? I do it all the time. It’s called being a contractor.

WalterBright 4y ago
It isn't kosher if you were hired as a full time employee.

WalterBright 4y ago

Soon AI bots will be applying for remote jobs.

tflinton 4y ago

I've had remote candidates in India lip sync an interview, but I don't think it was deep fakes, but rather the audio was coming from someone off screen while the person on screen was trying to mimic them. My guess is someone was trying to help them get the job, i'm not sure to what end though and regardless, we didn't hire the person.

deleted 4y ago
[deleted]

johndhi 4y ago

I'm not sure this is a greater risk than currently exists with in person interviews.

coredog64 4y ago
With in-person interviews you can check IDs as part of the “sign in through building security” process. And in fact, if you’re flying the candidate in, your travel department can get their passport details.

samstave 4y ago

Without DeepFakes: I know several people in tech in the bay area who locally interviewed for contracts, got the job, then outsourced all tasks to eastern-eu folks whom they hired as a sub and project managed them. Basically, hiring an consulting company masked as an individual.

Reason077 4y ago

Makes you wonder how many jobs out there are already being done by deepfakes.

donatj 4y ago

I recently had a person using my photo and work experience to get side gigs on Upwork. A customer of theirs contacted me directly for help which is how I found out about it. Upwork removed the profile after some prodding. I feel like I should report identity theft to the police or something but I don't know if it's worth the bother? https://twitter.com/donatj/status/1529266972403585024 https://twitter.com/donatj/status/1529266972403585024

Nextgrid 4y ago
Reporting it is only worth it to have a paper trail in case the identity theft then brings you into legal trouble such as taking out credit in your name, etc. If they’re only using publicly-available info I wouldn’t bother.
__derek__ 4y ago
Yes, you should report it: this person committed multiple crimes, and Upwork has a duty to avoid facilitating fraud.
gzer0 4y ago
Why do this at all when websites such as https://this-person-does-not-exist.com/en https://this-person-does-not-exist.com/en already exist? Available for anyone to take and utilize. I have a (hidden) suspicion that a greater proportion of LinkedIn's reported "active users" are, in fact, a group of people with these profile images and fraudulent profiles.
- yjftsjthsd-h 4y ago
  Maybe it helps in the hiring process to have a real person's history?
- donatj 4y ago
  I think part of it is Upwork let's you just point a new profile at ANY LinkedIn profile and import it. I suspect they just pointed it at mine and were off to the races.

tehjoker 4y ago

Wherever the FBI announces something you have to ask what political purpose are they trying to scare people? In this case I assume to try to give justification to managers that want to bring people back to the office using the fig leaf of concern over fraud.

discordance 4y ago

The personas might be fake but the bank accounts are not. Surely that would ring alarm bells?

b1n 4y ago

Remote workers probably should not have access to large amounts of PII/financial data/etc. in the first place! There seem to be a few separate issues with remote work: 1. Identification of real people (solvable with SSI's Verifiable Credentials or a traditional KYC company) 2. Employee holding multiple remote jobs (solvable by focusing on productive output rather than number of hours worked) 3. If rogue employee gets 20 jobs they only need to 'work' unproductively for a short time before getting fired. (solution? maybe reduced pay for initial months with the following months of employment overpaying until initial underpayment is made up?)

deleted 4y ago

[deleted]

knodi123 4y ago

I get tons of email like "Thanks for the application, you're the kind of person we're looking for, please come interview at such-and-such a time, and bring the following documentation..." If I was looking for entry-level QA or IT jobs, I'd probably explore one just for laughs. I suspect it's less of a hacker/pii problem, and more my own fault for having the kind of email address that random weirdos are likely to type in when they are doing something hinky on employment websites.

b20000 4y ago

looks like that leetcode garbage doesn’t work after all.

TheGigaChad 4y ago

sun_machine 4y ago

Only slightly related, but a Japanese friend of mine has a story of interviewing a few engineering candidates for their remote crypto company. They all applied under Japanese names, claiming they were Japanese citizens in Japan. When the interview came around, they all spoke English with a Korean accent, and when asked if Japanese would be better they admitted they could not speak Japanese. When my friend asked around it sounded like many founders in the space have encountered this profile of applicant, and many suspect these are people working for the North Korean state. If this is indeed North Koreans trying to get remote jobs, I've been wondering if their game is: - Getting a job for themselves to bring income to their own household - Getting a job for themselves to bring income to the North Korean state. - Getting a job in a crypto company with plans of figuring out vulnerabilities and siphoning funds to themselves/the state. - Getting a job for others, and selling the service of passing the interview.

crumpled 4y ago
Episode 119 of Darkness Diaries (podcast) is about North Korean crypto hackers, and it touches on that. Basically, if you have the freedom to wander the internet, it's because the government provides your connection for their own government purposes.
- r12343a_19 4y ago
  > Basically, if you have the freedom to wander the internet, it's because the government provides your connection for their own government purposes. This sounds so cynical. What if your freedom to wander the internet fills the same purposes?
gkanai 4y ago
Alert (AA22-108A) TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies https://www.cisa.gov/uscert/ncas/alerts/aa22-108a https://www.cisa.gov/uscert/ncas/alerts/aa22-108a
astura 4y ago
It's number 2 - Getting a job for themselves to bring income to the North Korean state and number 3 - Getting a job in a crypto company with plans of figuring out vulnerabilities and siphoning funds to t̶h̶e̶m̶s̶e̶l̶v̶e̶s̶/the state. The FBI has put out a warning - https://www.theguardian.com/world/2022/may/17/dont-accidentally-hire-a-north-korean-hacker-fbi-warns https://www.theguardian.com/world/2022/may/17/dont-accidenta... Normal people are only allowed to go online in North Korea on state business.

mauriciolange 4y ago

Reading the title my first thought was "wow! they are still using this Pentium II CPUs". Then I learned what PII is...