Deepfake attacks will become more sophisticated and harder to detect, Matthew Canham, a University of Central Florida research professor and cybersecurity consultant, told the Black Hat security conference last week.
Canham added that we may soon see phishing attacks using deepfakes on Zoom or other videoconferencing apps, which he dubbed "zishing," as well as deepfake attacks using biometric media like fingerprints or facial recognition.
- How to set up a Zoom meeting
- The best identity theft protection services
- Plus: Your Wi-Fi router might tell everyone where you live — what you can do
"My friend Dolores got a series of text messages from her boss to buy gift cards for 17 employees for the upcoming holiday party — and not to tell anyone," Canham said, "Dolores bought the gift cards, the party came, and the boss didn't know anything about it."
Dolores, Canham explained, had been the target of a text-message-based deepfake attack, in which an automated script or "bot" initially contacted her and impersonated her boss by "spoofing" her boss's cell number.
The bot exchanged several messages with Dolores to establish trust, and then a human took over on the other end and walked her through the rest of the scam.
Other deepfake scams
A well-publicized attack in the U.K. a few years ago involved phone calls, Canham said. A computer-generated voice application — or maybe a skilled human impersonator — that mimicked the boss's voice called a company posing as the chief executive, and then ordered that wire transfers be made to a specific account.
This happened two or three times before the company got suspicious and asked the "boss" to verify his identity.
Canham calls these "synthetic media" attacks, in which the deception involved a combination of real and fake information. He's come up with a classification framework that gauges five factors: medium (text, voice, video or a combination), control (run by a human, a bot or both), familiarity (how well does the target "know" the fake person), interactivity (are communications slow, fast or instant?), target (a particular individual, or anyone?).
Canham cited a wave of virtual-kidnapping scams that took place in Indiana. People would receive calls from a family member, only to speak to a scammer who said he had abducted their family member and demanded ransom. One man even got a such a call about his daughter, even as his own son got a ransom call from someone pretending to be the father.
The only "proof" was that the calls seemed to be coming from a loved one. However, it's not difficult to "spoof" a phone number.
What the future holds for deepfake video scams
More video-based scams are coming, Canham said. We've already seen the deepfake video that comedian and director Jordan Peele did in which former President Barack Obama seems to comment on the movie Black Panther and insults then-President Donald Trump.
In that case, Peele impersonated Obama's voice himself, then used a deepfake program to alter existing video of Obama so that the mouth movements matched the words.
More alarming, though it may not be obvious, Canham said, was the "I'm not a cat" Zoom video from 2020 in which a Texas lawyer found himself stuck with a kitten avatar during a court hearing.
In this case, the kitten avatar perfectly matched the Texas lawyer's mouth and eye movements in real-time. It may not be long before similar overlays and avatars can make videoconferencing participants convincingly look like completely different people.
"Give it a few years, and I think we'll soon see Zoom-based phishing attacks," Canham said, "Take that lawyer kitten video — imagine it wasn't a cat, but the image of a different lawyer."
After that, he said, the next frontier is biometric-based phishing attacks, although that might involve "Mission Impossible"-style physical creations.
"You could argue that a 3D-printed fingerprint might qualify," Canham said.
However, there could be a digital component to that too. A few years ago, German researchers showed that a high-resolution photo of Chancellor Angela Merkel's eyes might be good enough to fool an iris scanner, and that a similarly precise photo of another German politician's raised hand could be used to create convincing fake fingerprint.
To stop a deepfake attack before it goes too far, Canham said, some surprisingly low-tech solutions might be effective. He said he'd heard of one company boss who told his staffers he would never ask them to buy gift cards.
In other instances, pre-shared code words might be required for an authorized person to transfer large amounts of money, or the approval of more than one person might be necessary.
He also suggested fighting a bot with a bot, as it were. There's already the Jolly Roger Telephone project, Cahnam said, a computer program that's designed to draw telemarketers into pointless conversations and waste their time. Maybe the best defense against deepfakes is another deepfake.
You can view Canham's Black Hat presentation slides here, as well as a related white paper.
