Many financial institutions and their platforms are now asking users for selfies and videos as proof of facial verification or 'proof of life'. The problem is that these checks have proven highly vulnerable to deepfake attacks. In other words, a malicious actor can replace their face with another in real time, stealing identities or creating fake accounts. Security firm Sensity tested the robustness of these systems with a tool called the Deepfake Offensive Toolkit, and if you have some experience with the topic, you can download a copy from GitHub…
Take a photo, turn your head to one side, turn to the other, smile! This ritual is mandatory in many mobile apps and platforms for dating, crypto, or home banking to "know your customer", or KYC as they call it on the other side of the pond. Users with basic computer security knowledge inevitably wonder what institutions do with that data and how they protect it, but there's another problem: the overall integrity of these systems.
Security firm Sensity specializes in generating attacks using AI-created faces… deepfakes. These deepfakes are used to forge identity documents and are injected into a video stream with a virtual camera that bypasses facial verification. Sensity tested the top 10 providers (protected by non-disclosure agreements), and its attacks succeeded in 90 percent of the cases. The key behind such a result is Dot, the Deepfake Offensive Toolkit.
Deepfake Offensive Toolkit: A deepfake generator for security audits
One of the things that surprised the company was the poor response from providers, probably associated with the natural difficulty of installing, running, and configuring Dot. Anyone looking for a "one-click solution" with a nice, user-friendly interface will be very disappointed, but we've seen in the past what some experts can do with a little code. What today seems like a nightmare of files and dependencies may tomorrow become a ready-to-use tool.
Now, it's true that not all environments are vulnerable. Any facial verification system that can use depth sensors (Apple's Face ID comes to mind) will be immune to these attacks, but that 90 percent effectiveness is still worrying. Dot's code has been released for "demonstration and research" purposes, and all relevant technical details are published on its official GitHub profile. Finally, I recommend a bit of patience, because the total download is about three gigabytes.
Official site and download: Click here
Source: The Verge
