8 ms·

> “(In the) multi-person video conference, it turns out that everyone [he saw] was fake,” This could be totally real, but also could one employee saying 'the C

> “(In the) multi-person video conference, it turns out that everyone [he saw] was fake,” This could be totally real, but also could one employee saying 'the CFO was on a call' and claim deepfake to make it an excuse? I guess it was a matter of time before this occurred. How long before scammers do bulk video calls to parents/grandparent pretending to be the kids saying they are in trouble and need $$$ ASAP. The even better question, is how can this be stopped or reduced and is there a new business there?

cornholio 3y ago
Seems like it can be stopped dead with standard crypto, smart cards and multifactor tokens, multiparty authorization etc. Ideally, issued by public authorities together with any other official ID, leveraging the strong security governments have already built around that process. The generic type of vulnerability referenced in the latter part of the article has sprung up after fintech tried to emulate traditional offline auth and KYC with things like scanned images of ID documents, face recognition and liveness detection. Anyone in the know could see these attacks coming miles away.
- loceng 3y ago
  Could you elucidate how exactly "standard crypto" would stop such a thing?
  - sargun 3y ago
    I think the poster meant the prior meaning of the word 'crypto' -- cryptography, in which the CFO could sign and encrypt some message and then the message's authenticity could be verified.
    - YetAnotherNick 3y ago
      How does crypto add anything that just verifying email ID/phone number doens't provide. If you solution is to whitelist some certificates or key, you can as easily or even easier whitelist email IDs/phone number.
      - pastage 3y ago
        Cryptography can and should be done on hardware tokens that should directly be reported as stolen. A video call with email/phone is easy to fake. I work with people who all have hardware crypto, you are right that we do not have the organizational knowledge to verify everything with crypto. Even if the tech is 60% there.
        YetAnotherNick 3y ago
        Most company only allows logging in email in work devices, which is as easy to report stolen. What other kind of verification are we talking about which standard email DKIM doesn't have.
        acdha 3y ago
        Email means I got access to your device or something you’ve configured to be able to send email, which is probably a lot of servers unless you have an entire domain dedicated to financial messages everyone knows not to trust any other domains. A message signature means I got you to do something like tap a Yubikey and enter a PIN, touch a fingerprint sensor, etc. That can still be socially engineered, of course, but it can’t happen by accident and you could add some safeguards against routine by having a dedicated “major transactions” key used only for that purpose to add a physical speed bump. The problem is that “ignore my gmail, I list my phone” will defeat that training more often than we’d like, so you really need to have process safeguards which make it a requirement and management backing to say even the CEO will follow the lost device process rather than asking someone to bypass process, and that has to be so carefully enshrined that nobody questions whether their job is on the line if they tell the real CFO that they can’t bypass the process.
        YetAnotherNick 3y ago
        > Yubikey and enter a PIN, touch a fingerprint sensor, etc Laptops and mobiles have all the same sensors. Most big companies have organization wide password, fingerprint and auto screen turn off requirement. Obviously not all companies follows good security practices or doesn't give secure devices(with sensors and encryption), but if that is the case Yubikey isn't going to save them.
    - computerfriend 3y ago
      This is a current, not prior, meaning of the word.
      - subtra3t 3y ago
        I think many people would expand the word crypto to cryptocurrency and not cryptography. We can argue on and on about which is the "correct" expansion but in my opinion a word's current meaning should be the most popular association people have of it.
        MeImCounting 3y ago
        Only on HN do I see people saying crypto actually mean like bitcoin or whatever. The rest of the technical world still knows crypto as cryptography.
        subtra3t 3y ago
        Only on HN do I find people who actually know what cryptography is. Almost all the people I know have never heard of it, but all of them have heard of bitcoin, and most have heard the word crypto being used with reference to cryptocurrencies. That's not to say that my experience somehow means more than yours or is more valid. But I personally think my experience is more representative of the average layperson. You're welcome to disagree.
        MeImCounting 3y ago
        Sure the non technical world is (sadly) more familiar with Bitcoin. I specifically said the technical world. Most people I know are technical to some degree and almost all of them would assume cryptography when they hear the word "crypto".
    - thwarted 3y ago
      phone beeps with SMS message from CEO "Can you buy $1000 worth of egift cards and text me back with the redemption codes? Our jobs depend on this. I'm in a very important meeting, otherwise of so it myself, left my private key at office and can't sign this message right now." The human element remains the weakest link.
      - Aeolun 3y ago
        Hard to buy 25M worth of gift codes though.
        loceng 3y ago
        "Challenge accepted!"
  - chrisco255 3y ago
    You require that people sign messages cryptographically, including video calls, to validate their identity. You can't fake that.
    - coffeebeqn 3y ago
      Do any video call clients support this ?
  - kwhitefoot 3y ago
    Everyone in the call has a cryptographic ID that can be authenticated with a trusted authority. Your device would just ask all the others for a one time token that it then submits to the ID server. The server tells you public identifier of the person associated with that token. We already have infrastructure for bus and rail tickets, for logging in to banks, tax authorities, health services, etc. in Norway and other countries that could easily be extended to cover this use case..
  - cornholio 3y ago
    By using it? This was a social engineering attack against an otherwise unprotected service, if you manage to trick the security guard, you are in.
  - Karellen 3y ago
    It's easy. We just generate our own key pairs, establish a web-of-trust by signing each others public keys at in-person meetups, and then use those signed keys to authenticate all the digital communication we do with each other. You know, like we've been doing with our emails since PGP was developed in 1991. You can tell how simple the process is, by how ubiquitous it has become in a mere 30 years!
    - DANmode 3y ago
      Publish it in your Twitter bio, or as a Nostr note, for cool kids to share with other cool kids. Defeatists get defeated!
    - denton-scratch 3y ago
      > like we've been doing with our emails since PGP was developed Who is this "we"? I know personally exactly one person with a web-of-trust keypair.
- hobofan 3y ago
  I don't know. Based on how it is described in the article, you could detect it via the means you mentioned and raise them as warning flags to the user, but as a last instance there will still be users that ignore all the warning signs and be convinced by a good scam story.
  - sverhagen 3y ago
    ...such as a person much higher up in the organization giving you a direct "urgent" order. It shouldn't be hard to find corporate employees who really fear their superiors.
    - cornholio 3y ago
      Then it's the fault of those superiors for setting up a culture of fear and mindless subservience, instead of one of strong rules even they themselves are expected to follow. Cryptography without strong social rules is just cargo-cult religion.
      - psychlops 3y ago
        A culture of fear and mindless subservience has strong social rules. Would it work there?
      - mmvasq 3y ago
        Fear culture eats security for lunch. Good points.
- lupire 3y ago
  The article mentions a pile of stolen ID cards used in another fraud.
- deleted 3y ago
  [deleted]
dist-epoch 3y ago
It's a lose-lose situation. If you refuse and it's an actual emergency with the real CFO, it might be a career limiting move, if you don't get fired. If you accept, it might be a deepfake CFO and you might get sued.
- acdha 3y ago
  > If you refuse and it's an actual emergency with the real CFO, it might be a career limiting move, if you don't get fired. This is really the crux of it: senior management needs to take the lead setting up policies which are efficient enough not encourage people to try to bypass them and the culture that everyone in the company should feel comfortable telling the CEO “I’m not allowed to do that”. This is possible but it has to be actively cultivated.
  - MichaelZuo 3y ago
    It might not matter in the extreme case as there could always be a sufficiently serious emergency that will force their hand to bypass every policy. e.g. if they get a National Security Letter.
    - acdha 3y ago
      That’s not Joe CPA’s problem, though, beyond verifying that the men in black have valid government ID. If the FBI raids your office, you’re not the one in trouble for it. Let’s not ascribe too much power to those, either: NSLs can compel release of certain types of information but they can’t force you to do things like transfer money or even disclose the contents of private messages.
  - lmm 3y ago
    Just as every major company now sends out fake phishing emails, we'll need to normalise sending out fake emergency emails from your boss saying that you need to transfer money somewhere.
  - citizenpaul 3y ago
    >tell the CEO Good luck with that. I've had a CFO that didn't talk to tech people except through proxy have a "tell your mom to pass the potatoes" style meeting with his secretary as medium. Yes I stood there he talked to his secretary and repeated what each of us said 5 feet away from each other. This was a large bank. I've had a general council yell with spittle at me because I suggested that it was probably a bad thing that the IT Dept was effectively acting as power of attorney for the company by doing digital signing for him and he should probably learn how to do it himself for legal reasons.
_lvbh 3y ago
> scammers do bulk video calls to parents/grandparent pretending to be the kids saying they are in trouble and need $$$ ASAP Especially when a high percentage of people post their face and voice on social media. I find this especially crazy in the age of AI. I trained a Stable Diffusion LORA with photos of a friend and showed it to them (with permission) and they were completely shocked. Showed it to one of their friends and they were fooled for at least a minute and took some careful looks to find discrepancies
- ghaff 3y ago
  The reality is that if you speak at a conference there's a decent chance there's video of that on YouTube. If you have any sort of public presence as part of your job, your voice and likeness are probably out there whether you put it out yourself or not. Keeping yourself anonymous isn't compatible with a lot of even moderately senior-level jobs out there.
  - mprovost 3y ago
    CFOs of public companies typically do quarterly earnings conference calls with Wall St. So there's potentially plenty of recordings of their voices using the same kinds of language that it would take to fake something like this.
    - ghaff 3y ago
      One of the tradeoffs you make as you move up the ladder is that you increasingly can't be an anonymous person. That may be a good tradeoff or bad depending upon your perspective.
    - internet101010 3y ago
      You would think that executives would clone their own voices for the earnings call script readings like a lot of video essay YouTubers do now. But no, they still use terrible conference call systems for earnings calls rather than decent microphones that would be used in a podcast. That could actually be a silver lining here when it comes to creating quality training data.
fuzzfactor 3y ago
>it was a matter of time before this occurred. I would assume the matter of time for it occurring has elapsed a while ago, and now we are in the place where it's not only being detected, but further, actually revealed, regardless of how embarassing that is.
pas 3y ago
recently a group targeted expat/temp students and their families. they somehow coerced the kid to go camping don't pick up to anyone, and then they told the family the kid is with them. the family paid. https://abcnews.go.com/US/utah-missing-foreign-exchange-student-cyber-kidnapping/story?id=106032547 https://abcnews.go.com/US/utah-missing-foreign-exchange-stud...
abdullahkhalids 3y ago
> How long before scammers do bulk video calls to parents/grandparent pretending to be the kids saying they are in trouble and need $$$ ASAP. Unfortunately, this is why we need open access to some deepfake tech. The only way to convince people who are not immersed in tech how convincing deepfakes can be is to sit with them, and create their own deepfakes. Then memorize and practice security protocols like verbal passwords.
- deleted 3y ago
  [deleted]
- staunton 3y ago
  The issue with people disregarding security protocols goes much deeper than them being unaware of what's possible. People just hope nothing will happen and avoid thinking about it. You're facing "Who's got time for that stuff? We have actual work to do!" and "What's so important about our data/access privileges/whathaveyou anyway? Nobody will bother stealing it."
bagels 3y ago
That's already happening successfully without deepfakes. Scammer calls and says "grandma I'm in trouble, they are holding me in jail unless you buy gift cards"
jimmySixDOF 3y ago
There was an old theory you needed to be holding today's newspaper or mention current events to at least show that a media was not prepared earlier but this advice is out the window given enough dedication from the adversary.
mrguyorama 3y ago
>I guess it was a matter of time before this occurred. How long before scammers do bulk video calls to parents/grandparent pretending to be the kids saying they are in trouble and need $$$ ASAP. Umm where have you been the last decade? The "Grandma help me I'm in a foreign prison and need you to buy iTunes gift cards" scam is extremely lucrative.
- Gustomaximus 3y ago
  Just some well meaning feedback. Opening with the line "Umm where have you been the last decade?" feels like throwing insults, and not conducive to a positive enviroment to learn from one another. You probably didnt mean it that way but though Id point out this style. Regarding the last decade,, the pertinent part of the comment you responded to is "do bulk video calls to parents/grandparent pretending to be the kids" - more referring to when these existing scams hit a higher level.
lemming 3y ago
> How long before scammers do bulk video calls to parents/grandparent pretending to be the kids saying they are in trouble and need $$$ ASAP. A friend of mine in the US actually personally knows two people that this has already happened to, albeit with audio only. With video it's going to be nuts.

cornholio 3y ago

Seems like it can be stopped dead with standard crypto, smart cards and multifactor tokens, multiparty authorization etc. Ideally, issued by public authorities together with any other official ID, leveraging the strong security governments have already built around that process. The generic type of vulnerability referenced in the latter part of the article has sprung up after fintech tried to emulate traditional offline auth and KYC with things like scanned images of ID documents, face recognition and liveness detection. Anyone in the know could see these attacks coming miles away.

loceng 3y ago
Could you elucidate how exactly "standard crypto" would stop such a thing?
- sargun 3y ago
  I think the poster meant the prior meaning of the word 'crypto' -- cryptography, in which the CFO could sign and encrypt some message and then the message's authenticity could be verified.
  - YetAnotherNick 3y ago
    How does crypto add anything that just verifying email ID/phone number doens't provide. If you solution is to whitelist some certificates or key, you can as easily or even easier whitelist email IDs/phone number.
    - pastage 3y ago
      Cryptography can and should be done on hardware tokens that should directly be reported as stolen. A video call with email/phone is easy to fake. I work with people who all have hardware crypto, you are right that we do not have the organizational knowledge to verify everything with crypto. Even if the tech is 60% there.
      - YetAnotherNick 3y ago
        Most company only allows logging in email in work devices, which is as easy to report stolen. What other kind of verification are we talking about which standard email DKIM doesn't have.
        acdha 3y ago
        Email means I got access to your device or something you’ve configured to be able to send email, which is probably a lot of servers unless you have an entire domain dedicated to financial messages everyone knows not to trust any other domains. A message signature means I got you to do something like tap a Yubikey and enter a PIN, touch a fingerprint sensor, etc. That can still be socially engineered, of course, but it can’t happen by accident and you could add some safeguards against routine by having a dedicated “major transactions” key used only for that purpose to add a physical speed bump. The problem is that “ignore my gmail, I list my phone” will defeat that training more often than we’d like, so you really need to have process safeguards which make it a requirement and management backing to say even the CEO will follow the lost device process rather than asking someone to bypass process, and that has to be so carefully enshrined that nobody questions whether their job is on the line if they tell the real CFO that they can’t bypass the process.
        YetAnotherNick 3y ago
        > Yubikey and enter a PIN, touch a fingerprint sensor, etc Laptops and mobiles have all the same sensors. Most big companies have organization wide password, fingerprint and auto screen turn off requirement. Obviously not all companies follows good security practices or doesn't give secure devices(with sensors and encryption), but if that is the case Yubikey isn't going to save them.
  - computerfriend 3y ago
    This is a current, not prior, meaning of the word.
    - subtra3t 3y ago
      I think many people would expand the word crypto to cryptocurrency and not cryptography. We can argue on and on about which is the "correct" expansion but in my opinion a word's current meaning should be the most popular association people have of it.
      - MeImCounting 3y ago
        Only on HN do I see people saying crypto actually mean like bitcoin or whatever. The rest of the technical world still knows crypto as cryptography.
        subtra3t 3y ago
        Only on HN do I find people who actually know what cryptography is. Almost all the people I know have never heard of it, but all of them have heard of bitcoin, and most have heard the word crypto being used with reference to cryptocurrencies. That's not to say that my experience somehow means more than yours or is more valid. But I personally think my experience is more representative of the average layperson. You're welcome to disagree.
        MeImCounting 3y ago
        Sure the non technical world is (sadly) more familiar with Bitcoin. I specifically said the technical world. Most people I know are technical to some degree and almost all of them would assume cryptography when they hear the word "crypto".
  - thwarted 3y ago
    phone beeps with SMS message from CEO "Can you buy $1000 worth of egift cards and text me back with the redemption codes? Our jobs depend on this. I'm in a very important meeting, otherwise of so it myself, left my private key at office and can't sign this message right now." The human element remains the weakest link.
    - Aeolun 3y ago
      Hard to buy 25M worth of gift codes though.
      - loceng 3y ago
        "Challenge accepted!"
- chrisco255 3y ago
  You require that people sign messages cryptographically, including video calls, to validate their identity. You can't fake that.
  - coffeebeqn 3y ago
    Do any video call clients support this ?
- kwhitefoot 3y ago
  Everyone in the call has a cryptographic ID that can be authenticated with a trusted authority. Your device would just ask all the others for a one time token that it then submits to the ID server. The server tells you public identifier of the person associated with that token. We already have infrastructure for bus and rail tickets, for logging in to banks, tax authorities, health services, etc. in Norway and other countries that could easily be extended to cover this use case..
- cornholio 3y ago
  By using it? This was a social engineering attack against an otherwise unprotected service, if you manage to trick the security guard, you are in.
- Karellen 3y ago
  It's easy. We just generate our own key pairs, establish a web-of-trust by signing each others public keys at in-person meetups, and then use those signed keys to authenticate all the digital communication we do with each other. You know, like we've been doing with our emails since PGP was developed in 1991. You can tell how simple the process is, by how ubiquitous it has become in a mere 30 years!
  - DANmode 3y ago
    Publish it in your Twitter bio, or as a Nostr note, for cool kids to share with other cool kids. Defeatists get defeated!
  - denton-scratch 3y ago
    > like we've been doing with our emails since PGP was developed Who is this "we"? I know personally exactly one person with a web-of-trust keypair.
hobofan 3y ago
I don't know. Based on how it is described in the article, you could detect it via the means you mentioned and raise them as warning flags to the user, but as a last instance there will still be users that ignore all the warning signs and be convinced by a good scam story.
- sverhagen 3y ago
  ...such as a person much higher up in the organization giving you a direct "urgent" order. It shouldn't be hard to find corporate employees who really fear their superiors.
  - cornholio 3y ago
    Then it's the fault of those superiors for setting up a culture of fear and mindless subservience, instead of one of strong rules even they themselves are expected to follow. Cryptography without strong social rules is just cargo-cult religion.
    - psychlops 3y ago
      A culture of fear and mindless subservience has strong social rules. Would it work there?
    - mmvasq 3y ago
      Fear culture eats security for lunch. Good points.
lupire 3y ago
The article mentions a pile of stolen ID cards used in another fraud.
deleted 3y ago
[deleted]

dist-epoch 3y ago

It's a lose-lose situation. If you refuse and it's an actual emergency with the real CFO, it might be a career limiting move, if you don't get fired. If you accept, it might be a deepfake CFO and you might get sued.

acdha 3y ago
> If you refuse and it's an actual emergency with the real CFO, it might be a career limiting move, if you don't get fired. This is really the crux of it: senior management needs to take the lead setting up policies which are efficient enough not encourage people to try to bypass them and the culture that everyone in the company should feel comfortable telling the CEO “I’m not allowed to do that”. This is possible but it has to be actively cultivated.
- MichaelZuo 3y ago
  It might not matter in the extreme case as there could always be a sufficiently serious emergency that will force their hand to bypass every policy. e.g. if they get a National Security Letter.
  - acdha 3y ago
    That’s not Joe CPA’s problem, though, beyond verifying that the men in black have valid government ID. If the FBI raids your office, you’re not the one in trouble for it. Let’s not ascribe too much power to those, either: NSLs can compel release of certain types of information but they can’t force you to do things like transfer money or even disclose the contents of private messages.
- lmm 3y ago
  Just as every major company now sends out fake phishing emails, we'll need to normalise sending out fake emergency emails from your boss saying that you need to transfer money somewhere.
- citizenpaul 3y ago
  >tell the CEO Good luck with that. I've had a CFO that didn't talk to tech people except through proxy have a "tell your mom to pass the potatoes" style meeting with his secretary as medium. Yes I stood there he talked to his secretary and repeated what each of us said 5 feet away from each other. This was a large bank. I've had a general council yell with spittle at me because I suggested that it was probably a bad thing that the IT Dept was effectively acting as power of attorney for the company by doing digital signing for him and he should probably learn how to do it himself for legal reasons.

_lvbh 3y ago

> scammers do bulk video calls to parents/grandparent pretending to be the kids saying they are in trouble and need $$$ ASAP Especially when a high percentage of people post their face and voice on social media. I find this especially crazy in the age of AI. I trained a Stable Diffusion LORA with photos of a friend and showed it to them (with permission) and they were completely shocked. Showed it to one of their friends and they were fooled for at least a minute and took some careful looks to find discrepancies

ghaff 3y ago
The reality is that if you speak at a conference there's a decent chance there's video of that on YouTube. If you have any sort of public presence as part of your job, your voice and likeness are probably out there whether you put it out yourself or not. Keeping yourself anonymous isn't compatible with a lot of even moderately senior-level jobs out there.
- mprovost 3y ago
  CFOs of public companies typically do quarterly earnings conference calls with Wall St. So there's potentially plenty of recordings of their voices using the same kinds of language that it would take to fake something like this.
  - ghaff 3y ago
    One of the tradeoffs you make as you move up the ladder is that you increasingly can't be an anonymous person. That may be a good tradeoff or bad depending upon your perspective.
  - internet101010 3y ago
    You would think that executives would clone their own voices for the earnings call script readings like a lot of video essay YouTubers do now. But no, they still use terrible conference call systems for earnings calls rather than decent microphones that would be used in a podcast. That could actually be a silver lining here when it comes to creating quality training data.

fuzzfactor 3y ago

>it was a matter of time before this occurred. I would assume the matter of time for it occurring has elapsed a while ago, and now we are in the place where it's not only being detected, but further, actually revealed, regardless of how embarassing that is.

pas 3y ago

recently a group targeted expat/temp students and their families. they somehow coerced the kid to go camping don't pick up to anyone, and then they told the family the kid is with them. the family paid. https://abcnews.go.com/US/utah-missing-foreign-exchange-student-cyber-kidnapping/story?id=106032547 https://abcnews.go.com/US/utah-missing-foreign-exchange-stud...

abdullahkhalids 3y ago

> How long before scammers do bulk video calls to parents/grandparent pretending to be the kids saying they are in trouble and need $$$ ASAP. Unfortunately, this is why we need open access to some deepfake tech. The only way to convince people who are not immersed in tech how convincing deepfakes can be is to sit with them, and create their own deepfakes. Then memorize and practice security protocols like verbal passwords.

deleted 3y ago
[deleted]
staunton 3y ago
The issue with people disregarding security protocols goes much deeper than them being unaware of what's possible. People just hope nothing will happen and avoid thinking about it. You're facing "Who's got time for that stuff? We have actual work to do!" and "What's so important about our data/access privileges/whathaveyou anyway? Nobody will bother stealing it."

bagels 3y ago

That's already happening successfully without deepfakes. Scammer calls and says "grandma I'm in trouble, they are holding me in jail unless you buy gift cards"

jimmySixDOF 3y ago

There was an old theory you needed to be holding today's newspaper or mention current events to at least show that a media was not prepared earlier but this advice is out the window given enough dedication from the adversary.

mrguyorama 3y ago

>I guess it was a matter of time before this occurred. How long before scammers do bulk video calls to parents/grandparent pretending to be the kids saying they are in trouble and need $$$ ASAP. Umm where have you been the last decade? The "Grandma help me I'm in a foreign prison and need you to buy iTunes gift cards" scam is extremely lucrative.

Gustomaximus 3y ago
Just some well meaning feedback. Opening with the line "Umm where have you been the last decade?" feels like throwing insults, and not conducive to a positive enviroment to learn from one another. You probably didnt mean it that way but though Id point out this style. Regarding the last decade,, the pertinent part of the comment you responded to is "do bulk video calls to parents/grandparent pretending to be the kids" - more referring to when these existing scams hit a higher level.

lemming 3y ago

> How long before scammers do bulk video calls to parents/grandparent pretending to be the kids saying they are in trouble and need $$$ ASAP. A friend of mine in the US actually personally knows two people that this has already happened to, albeit with audio only. With video it's going to be nuts.