A recent incident involving a Hong Kong bank highlights the serious risks posed by deepfake technology. In this case, a bank employee was deceived into transferring $25.6 million to criminals after a video call with what appeared to be the bank’s CFO and other colleagues. However, these individuals were not real; they were convincingly created deepfakes generated by artificial intelligence.
This situation underscores how deepfakes can be used by cybercriminals to perpetrate fraud and manipulate individuals. It also raises significant concerns about the potential threats deepfakes pose to biometric authentication systems.
Biometric authentication, which uses unique biological traits to verify identity, has become increasingly popular over the past decade. This technology is expected to grow by more than 20% annually through 2030. However, as biometric systems advance, so do the techniques used by attackers.
Deepfakes can replicate various types of digital data, including images, videos, audio, and text, making them a versatile tool for cybercriminals. With readily available software and public datasets, even novice users can create realistic deepfakes.
Deepfake attacks on biometric systems generally fall into two categories: presentation attacks and injection attacks.
Presentation Attacks: These involve presenting fabricated biometric data to a sensor or camera. Examples include:
- Print Attacks: Using photos printed on paper or displayed on a screen.
- 2D and 3D Masks: Employing masks or facial prosthetics.
- Deepfake Techniques: Such as face swapping, lip syncing, voice cloning, and gesture or expression transfers.
Injection Attacks: These involve manipulating the communication channel between the biometric sensor and the authentication system. This can be similar to man-in-the-middle attacks and may include:
- Synthetic Media Injection: Uploading fake biometric data.
- Streaming Media: Using virtual devices to simulate biometric data.
- Data Manipulation: Intercepting and altering data between a browser and server.
Defending Against Deepfakes
To protect against deepfake threats, organizations can employ several countermeasures, primarily focused on ensuring that biometric data comes from a live person.
Liveness Testing: This technique verifies the presence of a live person through various methods:
- Passive Liveness Testing: Operates in the background without user interaction, though it may offer less robust protection.
- Active Liveness Testing: Requires user actions, such as smiling or speaking, to confirm the presence of a live individual and provides stronger security but can affect user experience.
Organizations need to decide when to implement active liveness testing based on the sensitivity of the assets being protected. Compliance standards increasingly demand liveness detection, and this trend is likely to continue.
Best Practices Against Deepfakes:
1. Anti-Spoofing Algorithms: Use algorithms to detect and differentiate between genuine and fake biometric data. For example, Intel’s FakeCatcher analyzes pixel changes to identify fake videos.
2. Data Encryption: Ensure biometric data is encrypted during transmission and storage to prevent unauthorized access and man-in-the-middle attacks.
3. Adaptive Authentication: Incorporate additional verification methods based on contextual factors, such as device or network, to enhance security.
4. Multi-Layered Defense: Combine static and dynamic analysis with verified digital credentials to protect high-risk transactions. For instance, supplement video calls with digital verification markers.
Strengthening Identity Management Systems
Replacing passwords with biometric authentication alone is insufficient. A comprehensive identity and access management strategy is crucial to address transactional risks, fraud prevention, and spoofing attacks.
Organizations must integrate advanced detection and encryption technologies into their identity and access management systems. This proactive approach will enhance the security of biometric systems and improve overall resilience against emerging cyber threats.
Prioritizing these strategies is essential for safeguarding against identity theft and ensuring the reliability of biometric authentication in the long term.