In 2019, 50% of all global organizations fell victim to ransomware, compromised accounts, or spoofed credentials, many due to falling for a phishing attack. In the same year, Australians reported $61.6 million lost due to investment scams. As alarming as these statistics are, we expect cybersecurity threats for 2020 to increase. Indeed, with the start of this new year, cybersecurity experts have been coming together to predict the targeted attack vectors and how to protect against them. Some of the most highly discussed topics include an increase in deepfakes, ransomware, and the standardization of MFA (multi-factor authentication).
Deepfakes a Cybersecurity Threat for 2020
As technology advances, we’re hearing the term ‘deepfake’ more frequently. This word encompasses everything from 1920’s filmmakers animating earthquakes, to the modern day politicians “saying” controversial things. At the core, today’s deepfakes use AI-based technology to create fake videos and audio that look and sound real.
Deepfakes are not all bad. In fact, there is a whole online community that use deepfakes as an art form. Even snapchat has a filter that lets us combine a celebrity’s face with our own. This can make deepfakes appear fun and harmless, and they can be! However, not all of them are. For example, many of us remember the altered video of Nancy Pelosi. This video was slowed down to make her appear to be intoxicated. Unfortunately, the altered video was widely circulated, and damage was done to Pelosi’s reputation before the truth became known.
Cybercriminals Leveraging New Threats
The ease and accessibility of deepfakes has opened a new realm of potential social engineering attacks that corporate cybersecurity systems may not be ready for. Cybercriminals can utilize deepfakes easily and without having to go through the grind of targeting your systems. By utilizing things like social media and email, an individual doesn’t necessarily have to have any special “hacking skills” to deploy these cyber-attacks. What we need to be aware of though, is that a skilled social engineer can leverage deepfakes during an attack in ways that make them much more real. These attackers play not only what you see and hear, but also on how you feel.
The opinions on how much deepfakes will affect the cyber community vary. Marco Rubio compared the threat to that of a nuclear weapon, while Tim Hwang doubts deepfakes will affect the community as much as some suspect. While we wait to see how much of an affect Deepfakes will have, Chris Hadnagy (aka @HumanHacker) of Social-Engineer, LLC. warns, “As the technology gets easier to use and expands from pictures to voice and other mediums, I think we will see an increase in these attacks.”
How to Spot a Deepfake
Whatever the threat level ends up being, without a doubt, deepfakes are something we need to be aware of and guard against. Because of the threat deepfakes present, in September of 2019 a bill passed the house committee to attempt to combat deepfakes. Since they are becoming more advanced and the technology to produce them more readily available, they will become harder to identify. Here are some tips that can help you spot them:
- Blinking is one of the more difficult things to replicate with deepfakes. Look out for rapid blinking or lack of it.
- Facial movements may not be completely smooth. Keep an eye out for jerky or robotic facial movements.
- There may be strange shifts in lighting and skin tone. If it looks like bad graphics, it could be a fake.
- A weird mixture of two faces, almost like a snapchat filter slipping off.