Using photographs, hackers (and anyone with enough time) can impose someone's face onto the body of someone else, effectively creating controversial videos that look and sound real. Numerous celebrities have been targeted, including Barack Obama and Mark Zuckerberg.
Seemingly harmless, the danger of a deepfake video is that millions of people share these videos, effectively perpetuating the cycle of 'fake news.' New deepfake apps are popping up rapidly, allowing anyone to create a fake video in minutes. Thousands of counterfeit videos exist, and that number increases daily.
But that's not why you should be concerned about deepfake technology when it comes to your organization. Voices can be impersonated, too, resulting in serious data leaks that can cripple your network.
The Telephone Game
In 2019, the CEO of a large energy corporation transferred €220,000 to a Hungarian supplier. The CEO believed he was talking to his boss and acted swiftly to transfer the funds as directed. Only he wasn't talking to his boss.
Hackers successfully impersonated his boss's voice, and the CEO believed it to be him. Most people think that they could tell the difference between someone's real voice and an impersonation, but voice skins sound nothing like putting a piece of cloth over the phone or using a voice muffler to make a call. Voice skins sound precisely like the individual being impersonated.
How A Voice Skin Is Made
To mimic someone's voice, recordings of that person's voice must exist, and you'd be surprised at how often someone in your organization is recorded. Webinars, YouTube videos, speeches, Ted talks, company training sessions -- there are many soundbites out there.
The pitch, cadence, and subtle nuances a person makes when speaking are what separates one voice from another, and hackers can snag these recordings and use them in conjunction with AI-based programs to create a voice that sounds exactly like someone you know.
Ways to Spot a Deep Fake
If done correctly, spotting the difference between a real video or voice recording and a fake one can be tricky. But, there are some ways you may be able to tell if you're watching or listening to something that's not quite right.
Video: look for facial expressions. If someone is blinking too much or too little, moving their eyebrows often or not often enough, and appears too perfect (blemish-free, no wrinkles, no movement), you may be looking at a deepfake.
Voice: voice skins are a lot harder to spot, mainly if someone is talking to you over the phone. You can try to ask questions that only the person calling you would know the answer to (in fact, it's a good idea to have some security questions precisely to spot imposters).
The other thing that's highly recommended is to train teams to understand the potential threats of deepfakes and engage them in watching and listening to some examples of imposter recordings and videos (MIT has a fun deepfake test here that's worth viewing) during regular training seminars.
Deepfake technology might seem intimidating, but your organization can adapt by staying ahead of the trend.