CS Nov-Dec 2022

More documents

Recommendations

Info

deepfakes THE DYSTOPIAN WORLD OF DEEPFAKES BBC'S RECENT DRAMA, 'THE CAPTURE', WAS AN ALARMING TAKE ON THE GROWING THREAT OF DEEP FAKES. WE ASK MATT LEWIS, COMMERCIAL RESEARCH DIRECTOR AT NCC GROUP, TO CONSIDER WHAT THREATS THESE MIGHT POSE IN THE 'REAL WORLD' Recently, we have seen how deepfake technology has become more sophisticated and readily available. The BBC recently released a second series of UK TV series 'The Capture', a thriller exploring the use of deepfakes for political deception and criminal framing, demonstrating the impact deepfakes are capable of making in day-to-day life. Within the series, deepfake technology is used to fabricate a statement from a British politician whereby they announce a major policy change regarding Chinese artificial intelligence technology. This mirrors something that's already happened in real life with Ukrainian President Volodymyr Zelensky, where he was portrayed to be surrendering in the country's conflict with Russia. Another sinister and sadly fatal case relating to deepfakes came earlier this year, with a young Egyptian girl taking her own life after she was allegedly blackmailed with deepfake pornography, created using her imagery. In early 2020, NCC Group partnered with University College London (UCL) on a research project investigating the capabilities of various free and open-source deepfake toolkits. It has now been over two years since this research and, since then, deepfake technology has become more sophisticated and is used more readily. So, let's revisit today's deepfake landscape, looking at technological developments and societal implications. HOW CAN DEEPFAKE TECHNOLOGY BE USED IN THE REAL WORLD? The technology of deepfakes has advanced and there are now many online apps available for users to create and play around with it. Improvements to leading opensource deepfake toolkits, such as DeepFaceLab, have also continued, rendering the technology more performant and realistic. As well as the technology being more readily available, we are also seeing more real-time generation of deepfakes. This includes hooking up to a computer's webcam to allow impersonation as other people in real time - for example, on video conferencing calls. 'The Capture' also does a good job of demonstrating this, as in series two a British politician's likeness is digitally recreated using deepfake technology, whilst he is supposedly live on TV, making it look and sound like he's said something else. HOW CAN WE PREPARE THE WORLD AGAINST DEEPFAKES? There is an urgent need for deepfake detection and blocking. More deepfakes are 20 computing security Nov/Dec 2022 @CSMagAndAwards www.computingsecurity.co.uk
deepfakes being used in harmful or offensive contexts by all level of threat actor, from disgruntled lover seeking revenge, all the way up to organised crime groups and hostile national states. In 2021, the European Parliamentary Research Service (EPRS) released a study on tackling deepfakes in European policy. The study summarised a range of categories of risks associated with the technology, ranging from psychological, financial and societal harm. It includes risks from extortion, bullying and defamation, to stock-price manipulation, election interference and damage to national security. Various approaches are emerging from academia on deepfake detection and blocking, such as active illumination of a person's face during a video call and selfblended images. However, it can take time for new research to find its way into commercial and mainstream use; in the meantime, deepfake technology might find a way to bypass detection mechanisms. Propagation of deepfakes heavily relies on social media sharing. With this in mind, social media platforms ought to provide a level of deepfake detection and blocking. Facebook (Meta AI) has been researching methods to detect deepfakes and identify where they originate. When it comes to Business Identity Compromise (BIC), in addition to detection, businesses may also need to consider changes to current approval and workflow process. For example, where a process may allow for execution of a crucial operation or high-end financial transaction, requiring a two-person rule (if performing over video conferencing) might make it that much harder for a successful deepfake attack. Similarly, requiring an in-person physical presence, particularly now that most global pandemic restrictions are lifted, may be a necessity to mitigate the risks in this domain. In terms of advice on how to combat deepfakes, using state-of-the-art anti-fake technology, good security procedures and watermarking genuine videos should always be top of the list when looking at identifying and blocking deepfakes. Other, more soft, measures are to ensure employees and family are familiar with deepfakes, update and use different/strong passwords, perform regular backups and updates of data; also, using a good security package can always provide a barrier against deepfakes. DEEPFAKE LEGISLATION AND REGULATION Deepfakes pose many potential risks, such as manipulation of civil discourse, interference with elections and national security, alongside the erosion of trust in journalism and public institutions. It is therefore essential that legislation surrounding deepfakes is reviewed constantly, as this technology grows ever more popular. The UK law currently does not have a specific set of legislation for the use of deepfakes. However, there are established laws that may be more applicable when attempting to look at preventing deepfakes being used in an unwanted or manipulative way. It is also worth noting that, whilst specific legislation and regulation around deepfake abuse won't stop motivated attackers, it is still necessary to ensure that people abusing the technology can and will be identified and prosecuted for doing so. Despite the demand for legislation in this domain, concerns exist on a lack of progress across the EU and UK. The National Law Review writes: "In the UK, the answer is that English law is wholly inadequate at present to deal with deepfakes. The UK currently has no laws specifically targeting deepfakes and there is no 'deepfake intellectual property right' that could be invoked in a dispute. Similarly, the UK does not have a specific law protecting a person's 'image' or 'personality. It's created circumstances where people living in the UK will need to rely on a combination of different rights and laws, in order to try and protect themselves against deepfakes. However, these laws may currently not go far enough to protect those dealing with the malicious use of their image through deepfakes; as ever with rapidly advancing technology, we must ensure these advances do not outpace legislative and regulatory frameworks protections. Now we know deepfakes are here for good, how do we ensure they are safe to use? It's clear deepfakes are no longer confined to shows like the BBC's 'The Capture'. The technology is here to stay and it being used in the real world, continuing to advance in its ease of use, accessibility and realism. We therefore need urgent and continued research on deepfake detection and blocking mechanisms, whilst legislation and regulation need to catch up, in order to prevent and prosecute individuals abusing the technology. Matt Lewis, NCC Group. www.computingsecurity.co.uk @CSMagAndAwards Nov/Dec 2022 computing security 21
Page 1 and 2: Computing Security Secure systems,
Page 3 and 4: comment WHY DATA ETHICS MATTER Data
Page 5 and 6: We focus on your cybersecurity thre
Page 8: news Bogdan Botezatu, Bitdefender.
Page 11 and 12: 2023 predictions Meanwhile, EU Digi
Page 13 and 14: 2023 predictions zero-day exploit.
Page 15 and 16: ook review YOU AND YOUR DATA ARE TH
Page 17 and 18: 2022 CS Awards THE 2022 WINNERS: Em
Page 22 and 23: data management YOU AND YOUR DATA A
Page 24 and 25: ansomware RANSOMWARE ON THE RAMPAGE
Page 26 and 27: ansomware Dan Turner, Forcepoint: c
Page 28 and 29: ansomware Steve Forbes, Nominet: pa
Page 30 and 31: legislation EU CYBER RESILIENCE ACT
Page 32 and 33: packet data BUILDING A CAPTIVE AUDI
Page 34 and 35: data threats WHY RANSOMWARE IS 'MOV
Page 36 and 37: eaches MAJOR BREACH, HARSH LESSONS
Page 38 and 39: GDPR REGULATORS MEAN BUSINESS! THE
Page 40 and 41: GDPR Dan Middleton, Veeam: Business
Page 42: Strengthen your data resilience wit

CS Nov-Dec 2022

Create successful ePaper yourself

Delete template?

Save as template?