Hackers are combining deepfake videos and emulators to bypass biometric security solutions and breach people’s online services, new research has claimed.
A report from iProov has claimed the method’s use among criminals surged by 353% between the first and second halves of 2023.
“Generative AI has provided a huge boost to threat actors’ productivity levels: these tools are relatively low cost, easily accessed, and can be used to create highly convincing synthesized media such as face swaps or other forms of deepfakes that can easily fool the human eye as well as less advanced biometric solutions. This only serves to heighten the need for highly secure remote identity verification,” said Andrew Newell, Chief Scientific Officer, iProov.
Sharing knowledge
Here’s how it works: the crooks would use Artificial Intelligence (AI) tools, some of which are cheap, offtheshelf solutions, to create relatively convincing faceswaps and deepfake videos. Then, they would use emulators to create virtual cameras. So, when a biometrics solution asks for a person to authenticate via a face scan, they can bring up the fake camera with the faceswap video on it, and thus trick the tool and authenticate.
The mobile platform seems particularly vulnerable to this threat. Injection attacks against mobile web increased by more than twofold (255%) between H1 and H2, 2023. The numbers are even worse when you exclude emulators and look solely at deepfake and faceswap attacks. Between H1 and H2 2023, there’s been a 704% increase in these attacks. Finally, the use of deepfake media together with metadata spoofing (for example, IP address spoofing) rose 672% between the two halves of last year.
The report also states that the hackers are tightly collaborating to improve and evolve this technique. Apparently, there’s been a “significant growth” in the number of groups that are exchanging information on bypassing human identification and video identification systems.
Of the groups identified by iProov’s analysts, almost half (47%) were created in 2023, the company said.