In a previous article, we talked about deepfakes, AI models that attackers can use to fake audio, images, and videos. These technologies can be used for entertainment purposes (aging faces, replacing celebrities' faces, funny collages), but they can also be tools for attacking companies. Therefore, in this article we want to analyze various security tools and technologies that can be used to protect organizations and their employees.
Table of contents
1. The connection between deepfake and social engineering
2. Technical means of analysis and protection
3. Protection of biometric systems
4. What organizational and technical measures can be taken
5. How can I verify a fake video in the request-response format?
6. Why is it important to regularly update systems and how to automate it
7. Conclusions and extension of the zero-trust methodology
The connection between deepfake and social engineering
First of all, let's briefly say that deepfake itself is one link in social engineering techniques. The attack is successful because it exploits three fundamental aspects of human psychology:
1. Trust in authority: if the order comes from the supervisor;
2. Trusting visual information: The human brain is programmed to trust what it sees;
3. Trusting the social consensus: if scammers create deepfakes of several executives, the victim will be in the minority, which will suppress the last doubts.
Technical analysis and protection tools
Now let's focus on the technological aspect.
There is a tool developed by Microsoft Research – Microsoft Video Authenticator. This is a technology that analyzes a static photo or video and outputs a "confidence score" in percentages, indicating the likelihood that the media file has been artificially altered. In the case of video, this assessment can be provided in real time for each frame, or it can be complex for the entire file.
This tool searches for traces that are invisible to the human eye.: she is trained to detect the "mixing boundaries" of a deepfake. When the AI overlays one face on another, it "mixes" pixels around the edges to make the transition smooth. And Video Authenticator finds these areas of blending, as well as the "subtle fading or gray elements" that remain after this process. In fact, he is looking for microscopic "scars" at the pixel level, left over from the digital "operation" of substitution.
Intel has developed a technology that demonstrates a second, more advanced approach, the search for the "pulse of life." Intel FakeCatcher, instead of looking for errors, is looking for positive confirmation that there is a live person in the video. He does this by analyzing the "blood flow".
Domestic developers have also made a great contribution to the protection of the ringers. For example, MTS Web Services released a detector this year that combines sound analysis using MWS AI, a fake detector from VisionLabs and other developments. A distinctive feature is the focus on media, social networks and instant messengers, which helps to prevent the spread of dangerous fakes and their impact on the mass audience.
For journalists and media professionals, there is a WeVerify plugin for browsers that does not need to be installed as a separate program. It is often used in OSINT and for fact-checking, as well as for detecting deepfakes in the form of pictures and videos.
Another web application, Deepware Scanner, allows you to check a video by simply copying a link to it.
And for commercial users and criminology specialists, there are solutions on the market like Truepic and Sensity, which are also based on technologies for analyzing face replacement, generating text scripts, and cloning voices.
Manufacturers of information security tools also offer AI-based solutions, some of which, like the McAfee Deepfake Detector, help detect scam emails and pages, analyze video materials and audio files by simply playing audio with an interactive scanner enabled.
When the human heart beats, it pumps blood through the veins. This process causes microscopic, invisible to the eye changes in the color of the skin of the face. Conventional video cameras are able to capture these subtle changes in pixels (this method is called photoplethysmography, or PPG). Despite the fact that the creators of deepfakes spend all their computing power on accurately imitating facial expressions, hair and lighting, they cannot simulate the heartbeat and blood flow under the skin. If there is no "pulse of life" in pixels, it is a deepfake.
In the banking and financial sectors, a broader class of technologies known as Liveness Detection is used to protect biometric authentication. These systems (for example, those included in the Luna Pass platform) are designed to determine that there is a real person in front of the camera, and not an imitation of him.
They can use a combination of analysis methods: 3D facial structures (to cut off a 2D photo), textures and reflections (to cut off a mask), micro-eye movements and special challenges.
Finally, there are proactive methods such as Digital Watermarking. The idea is not to detect forgery, but to prevent it when an invisible digital label is embedded in the original, authentic content (for example, in a video of a politician's speech). If someone tries to use this video to create a deepfake, the tag will be damaged or destroyed, which will immediately prove the fact of falsification.
Protection of biometric systems
The AI Security Group of the European Telecommunications Standards Institute (ETSI) has already issued a warning that the level of protection of existing biometric systems and their ability to withstand deepfake attacks varies greatly. Research shows that about 40% of companies or their clients have already experienced fraud attempts using AI images.
Losses from deepfake attacks can be prevented not by the best antivirus, but by the best protocols:
What organizational and technical measures can be taken?
Training and protocols
Conduct regular training, tell your employees, especially in the financial and HR departments, about the existence of deepfakes. Take the Arup case out of the last article on the topic with them. They should know that a video call from a scammer is a reality.
Multifactor authentication (MFA) for transactions should become an immutable law. No major or unusual financial transaction should ever be approved based on just one communication channel, be it an e-mail, a call, or even a video conference. Implement a strict protocol that requires confirmation through a second, independent and pre-established channel (for example, through a secure banking portal or an internal ERP system).
How can I verify a fake video in the request-response format?
Request-response challenges
This is the most effective and low-tech way to defeat deepfake in real time: if you need to use video or audio to verify your identity, implement a request-response protocol that breaks static or pre-recorded forgery. For example, ask the person on the other end of the "wire" to perform a non-trivial, random action in real time. Not just a "nod your head," but something that deepfake can't generate on the fly. "show three fingers of your right hand," "slowly turn your head 90 degrees to the left," "name the object that stands to your left in the room," etc.
For voice identification, ask them to pronounce a complex, randomly generated phrase. Not "I confirm the operation," but something like: "A pink hippopotamus eats lilac blackberries." Voice cloning models will not be able to synthesize this instantly with the correct intonation.
Why is regular system updates important and how to automate them?
Auditing and updating of systems
If your company uses biometric authentication, contact your suppliers. Ask them a direct question: how do their systems resist deepfake attacks? Update the authentication system and use autopatching if we are talking about software that you can control in the perimeter (as it is, for example, arranged in the asset and vulnerability management modules of Security Vision AM and VM).
Support and implement technologies that help label AI-generated content. This is part of a broader corporate and government policy to combat disinformation, but it can prove effective with the growing capabilities of artificial intelligence.
Conclusions and expansion of the zero trust methodology
We have officially entered an era when the principle of Zero Trust is applied to digital content. The old formula of "seeing is believing" no longer works: deepfakes are not just a fan technology for FaceSwap applications, but a powerful tool in the "arms race" of AI. They pose a direct and immediate threat, from financial scams like the Arup case to the fundamental undermining of biometric authentication systems on which digital trust is built.
The solution to this problem lies in a hybrid approach: on the technological front, companies and researchers will improve deepfake detection methods using the advanced tools described in the article, and at the household level, you can use other tips that we gave in the last review of deepfake technology for images, video and audio materials.
We wish you and your data maximum protection, and the systems that provide this protection maximum transparency and manageability so that they can adapt to new threats in time.
.jpg)
 2 - копия.jpg)