Imagine arriving at work one morning to discover all of your employees have received an important video announcement from you and are scrambling to comply with the instructions it contains. Their responsiveness would be impressive if not for one thing: You never recorded or sent the video, and now you somehow have to undo the resulting damage.
Improvements in artificial technology (AI) and machine learning (ML) could soon make such flawless deceptions possible. Called “deepfakes,” these videos have the potential to undermine security at every level from small businesses to global governments.
How Deepfake Videos Work
A deepfake is a video made by employing AI and ML to create an exact likeness of a person saying or doing things he or she never actually said or did. The deception plays on the human tendency to believe what is seen and can be very effective in making it appear as though the contents of a video is genuine.
These videos aren’t simply fakes created by hackers skilled in forgery. Deepfakes rely on a form of machine learning in which two networks are fed the same data sets and pitted against each other in a back-and-forth battle of generation and detection. Known as generative adversarial networks (GANs), these systems consist of one network creating fakes and another evaluating the fakes for flaws. The data set consists of hundreds or thousands of images and videos of the person to be imitated, and a forgery is considered good enough when the detection network no longer rejects the results.
Hackers and Malicious AI
When deepfakes first appeared on Reddit, people mostly used the technology to goof off and create fake pornographic videos. However, the software to produce such videos is readily available to everyday users, making it simple for hackers to employ deepfake tactics and use realistic false content to manipulate their targets.
Deepfake videos are prime candidates for viral status and can spread rapidly across social media. Because fake rumors can take as long as 14 hours to be recognized and debunked, a well-produced deepfake could become entrenched in the public mind as truth long before the deception was detected. Hackers can take advantage of the popularity of viral fakes to spread videos containing malware or record messages designed to entice users to click on links as part of a phishing attack.
Videos may also be used to draw people to websites in which malicious code has been embedded, turning their computers into tools for mining cryptocurrency. Known as cryptojacking, this kind of attack can also be launched on mobile devices and run undetected in the background as users go about their daily tasks.
Deepfake Deceptions and Access Control
Deepfake technology hasn’t yet progressed to the point of perfection, but rapid advances in AI and ML mean scenarios like the one described above can no longer be relegated to the realm of science fiction. Using deepfakes, hackers could trick employees into giving away a great deal of information, including access credentials, financial records, tax documents, customer profiles and proprietary company data.
Because GANs require a significant number of images to create realistic deepfakes, this kind of attack isn’t likely to become the norm overnight. However, the internet in general and social media in particular provides a wealth of pictures and videos posted by users and could theoretically be mined for the data sets necessary to train GANs to produce convincing results.
Employees tricked by deepfakes or those who indulge in viral videos on company time could easily open the door for hackers to access business networks and fly under the radar or launch large-scale attacks. Such a prevalent threat to access control and compliance requires an updated approach to security.
Preparing for Deepfake Security Threats
To get your network and your employees ready to stand up against the potential risks posed by deepfake videos:
• Develop and deploy ongoing security training
• Monitor employee activities on company devices
• Update your BYOD policy to prevent infected devices from spreading malware to your network
• Invest in security software with deep learning capabilities to predictively detect malware threats
Combining employee training with machine learning software minimizes the likelihood of human error and leverages the power of artificial neural networks to protect your company from sophisticated threats.
The rise of deepfake videos in a world where fake news is already a concern signals a future in which it could be nearly impossible to trust anything you read, hear or see. Detecting falsehoods requires an updated approach to security, including employing the same technologies used to create deepfakes. The future of security may boil down to beating hackers at their own games, and learning to identify and outsmart threats launched using fake video content could be just the start of a new wave of necessary security upgrades.