President of Univention North America, making sure you stay in control of your data, your company and your future.
For billions of users, social media is an innocent way to stay connected with friends and family. We share parts of our lives and enjoy the successes of our friends. While the risks of addiction, cyberbullying and feelings of inadequacy are accurate and well-documented, they only affect a minority of users.
But there’s another dark side that’s getting less attention. With advances in AI, image recognition and language processing, the wealth of data available in social media is becoming a new gold mine for cybercriminals. Automatically scanning through billions of datasets for a couple of cents can reveal patterns and attack vectors that previously required manual work or user actions to provide the information a scammer needs.
In my work, I have identified three specific attack vectors that AI supercharges, making them more dangerous and requiring us to take countermeasures quickly.
Look At My Car!
Since the dawn of the internet, security questions such as “What was your first car?” “Where did you meet your spouse?” or “What was the name of your first pet?” have been part of our password reset policy. For the past 20 years, experts have warned users not to answer them honestly or reuse the answers. Yet, most of us aren’t good enough to remember our passwords. Remembering the wrong answers to three questions is almost impossible unless you write them down, which opens another door to abuse.
And there’s another problem. Most of us like to show off pictures. We post photos of us standing in front of our first car instead of “My first car was an XYZ.” For a couple of years, apps have recognized the make and model when you carefully photograph the back or front of a car. With the advancements in AI-assisted image recognition, though, several companies can now detect the car’s make and model from any angle, even when a person obstructs parts of its features. Combine it with a text recognition trained on sweet-16 presents, driver’s license celebrations or similar events, and we have an answer for the first of the three notorious questions. The same is true for the wealth of information contained in digital wedding albums, pet pictures and finding the house number of your first apartment.
Consequently, it is now possible to automate recognizing images and finding the answers to standard security questions.
Object recognition and classification have improved for recognizing backgrounds in images. Deep learning has enhanced the automated recognition of places and locations, especially tourist hot spots. Security experts have long warned that the metadata in pictures can increase your risk, online and in real life. Combined with image recognition, you don’t need the metadata anymore.
My Voice Is My Password, But Not Really
Even new technologies aren’t safe from AI-based attacks. Over the past three years, banks worldwide have introduced biometrics to enhance security. The two most common attributes were face profiles and voice samples.
Unfortunately, faking a voice has become good enough for researchers to break into their own accounts. While these experts deliberately provided the voice samples used, millions of us also do so as we go about our daily online lives, albeit without realizing the risks involved. From TikTok videos to podcasts, the world is full of training material to clone your voice.
Combining it with cloud computing and large data operations, one can now download millions of audio samples, build a corresponding model and let it loose to create deep fakes for entertainment or more nefarious uses.
Trust Me, I’m An Engineer!
If you search your favorite video site for scams, technical support is among the most common and somewhat hilarious attempts at deception. Typically, the posted clips involve a cybersecurity researcher fighting back or stringing the scammer along, wasting their time. These types of ruses are popular enough that the FBI regularly updates their warnings about the latest tactics used.
All these videos have one thing in common: The scammers do most of the talking to try to convince potential victims of the legitimacy of their request. Anyone who ever did tech support, including myself, knows that real tech support staff prefer that the customers do the talking (or, better yet, put them on hold) while solving the issue.
AI is about to change that, letting scammers up their game. New tools are fast enough to generate realistic talking points on the fly. When read out by a scammer, those scripts make them sound like support engineers. AI scripts can quickly adapt to someone’s experience, company and positions shared on social media. If your support company is XYZ, it is much more likely that you will accept an unsolicited call to provide assistance for your company laptop or phone, even if they’ve never called you before.
What’s next? Combining those pernicious scripts with deep fake AI means the hackers no longer have to place those scam calls themselves. Technology has come full circle for maximum damage.
The Same, Yet New
To be fair, all social engineering scams predate social media’s rise and the invention of AI. Our trust in social connections and hierarchies has developed over millions of years. But while none of these scams are new, the combination of different subsets of AI and massive amounts of data available from our social media profiles presents a greater risk to our digital identity than ever before.
Therefore, building guardrails and safety mechanisms that require a human touch to pass is important. For starters, how about banning the well-worn three security questions and not relying on voice identification when there are other, better options out there that are not as easily fooled? And finally, what about putting a higher burden of proof on tech support calls? Two-factor authentication and other enhanced security options have made enterprise app use safer. Why not apply it to those scenarios as well? Technology is inherently dual use, so let’s make sure it serves us, the legitimate users, not the bad actors.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
Read the full article here
