Here's how crooks will use deepfakes to scam your biz All of the materials and tools needed to make deepfake videos – from source code to publicly available images and account authentication bypass services – are readily available and up for sale on the public internet and underground forums. Cyber criminals are taking advantage of this easy access to resources, and using …
"increasing numbers of complaints relating to the use of deepfake videos during interviews for tech jobs that involve access to sensitive systems and information"
Even in the absence of deepfake tech, you'll never know whether the person at the other end of zoom is the person you should really be talking to. So make a physical face to face interview a mandatory part of the recruitment process. I'd never engage even a commercial subcontractor without having a real physical meeting (preferably on their premises).
It's hard to believe that companies can get scammed out of money just by someone calling up and saying "transfer some money here, please". I get invoices bounced all the time because the P/O reference format is wrong, the line item description doesn't match, the delivery hasn't been matched in the system, I'm not "on the system", etc. Similarly, I've worked on installing ERP systems and no money or product moves without a purchase req., a P/O, an order acceptance, goods receipt, inspection, etc. and all the records have to match before anyone will cut a payment. None of the companies I've worked for would send money or product anywhere just cos the boss told them to or on the basis of a zoom call with a VIP client, so what sort of companies are these that just send money willy-nilly to someone who looks like someone they know?
It happened to us. FD received an email apparently from the MD, asking him to transfer some money, and he did it, before clocking that something was fishy. Unfortunately I never got to see the message, so I don't know how convincing it was, or what reason was given for requesting the transfer. We did get the money back, fortunately. I guess some confluence of events can cause you to drop your guard momentarily, and just forget to ask "is this legit?"
Procedures. I guess if the FD had called the MD on his known phone to confirm, that scam wouldn't have worked.
Obviously disturbing your manager on his "managerial retreat", because you're doubting his all-powerful word, could be a career killer, but who would want to work for that kind of jerks anyway?
"FD received an email apparently from the MD" -- there's a tech fix for that: encrypted and authenticated emails, ALL the time. If you do this and get a cleartext email from "the boss", you automatically know it's not really from the boss. That works for internal stuff. It doesn't work for external stuff, because not everyone, not every business, and not every government agency knows how to do it, or chooses to do it.
We also need is a good way to authenticate phone and video calls -- a way which shouty bosses and salespeople would be willing to use.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
