Frightening Truth of Synthetic Media

Frightening Truth of Synthetic Media. Deepfake.

This episode explores the frightening truth of synthetic media, recent FBI warnings of synthetic media, and common examples to watch for today. Key topics: frightening truth of synthetic media, scary truth about synthetic media, truth about synthetic media, frightening truth of synthetic media, what deepfake can do to us

terrifying story of synthetic media, terrifying truth about deepfake, scary truth of synthetic media, deepfake what it can do to us, deepfake vs reality, terrifying truth about synthetic media,

Audio Podcast (available everywhere): https://cybercrimejunkies.buzzsprout.com

Want more true cyber crime? More interviews with global leaders? Unique insight into emerging trends, news, and other shocking stories? Check out Https://cybercrimejunkies.com

 Please consider subscribing to our YouTube Channel for ALL Video episodes. It's FREE. It helps us help others. Our YouTube Channel @Cybercrimejunkiespodcast https://www.youtube.com/channel/UCNrU8kX3b4M8ZiQ-GW7Z1yg

[00:00:00] Hi, cyber Crime junkies. So in this episode we're going to discuss deepfake, and it's known as synthetic media. We're gonna talk about the real world applications, how easy it is to generate these, the advancements in technology and how it's rapidly evolving every single week. And the dangers that opposes to each one of us individually are families as well as the organizations and the brands that we work for or build on our own.

And it has gotten the attention of the US Congress as well as, international law enforcement. So let's check it out and, I'm interested in hearing your feedback on it because it is, Absolutely the most advanced threat, and it is the cyber crime tactic of [00:01:00] the future.

 Welcome Mark. Welcome to the studio buddy. How are you? Wonderful, David. How are you? Doing fine, doing fine. So you know, you, have you ever heard of the term synthetic media? Synthetic media? Yeah. Yes, I've heard, yeah. I've heard the term, but I would struggle absolutely to define it for you.

Okay. So you may not know the term synthetic media, but you're likely have heard of the phrase deep fake. Yes. From social media and TV entertainment news. Well, today it's far beyond Photoshop and celebrity impersonations. There are real cyber crimes which have occurred with devastating consequences in real life.

In fact, the US military Congress and federal law enforcement have now all gotten involved today. They certainly know all about it, and they're paying careful attention monitoring advances in synthetic [00:02:00] media, deep fake things like that regularly. And it's time, our listeners are aware of it too, so they can protect themselves, their families, and the organization's, brands that we all serve.

So w what is it and, and how is it used to commit cyber crimes? Great question. So back in March, 2021, the FBI put out a public service announcement warning. , they warned, private industry u US citizens and their families advising us of the very real threat that foreign governments, Russia, China, North Korea, others are putting out.

Synthetic profile images, videos, and live disguised media, creating deepfake journalists, media personalities, IT engineers, business owners and social media influencers across lots of platforms, even on LinkedIn and [00:03:00] connecting with people with full profiles, lots of connections, and these people. Weren't even real.

Their goal in this instance was to spread anti-US propaganda for political purposes later on in 2021. And then earlier this year, US Military Congress and US National Security teams have been addressing deep, fake, aggressively, and congressional hearings have even been held in it. Have you seen any of those?

Wait, now they're actually having congressional hearings. Yeah, I can Artificially intelligence, I. Created synthetic fake people. Yes, they are. And there's even future ones scheduling. What's key to understand here is, synthetic media that the, the, the advancement in technology there. It's just getting started, right?

This technology is at its inception or incubator life stage and it, but it's [00:04:00] growing exponentially with technology advances every single week. So, It caused. Check this out, mark. It caused 220 million in damages last year. 220 million. Yeah. And this year it's expected. You think it's going down? No. But if you were, if you were a betting person, if you were a betting person, you think it's going down, I would bet you dollars to donuts.

It's going up, right? It's, this year it's expected to triple. Okay. And this, my friends, is the true cybercrime story. Of deep fake. Lucky to work for a great group of people you really believe in. Find yourself making an impact. Technology is a river that flows through every aspect of an organization, and today is different.

We put ourselves and our organizations literally at risk of complete destruction every single time we get online. One click, one Distraction [00:05:00] is all it takes. Hi, saber Crime Junkies. This is your host, David Morrow, along with co-host Mark Mosher. Come join us as we explore our research into these blockbuster true crime stories, along with interviews of leaders who built and protect great brands.

So in this part of the episode, we discuss generative adversarial networks. They're called dance. Don't get Lost in the technical terms. The point is, this is how deep, fake and synthetic media is created. It's basically two computers fighting against each other until things are undetected by the human eye.

So let's figure this out. It's pretty shocking. So generated or generative AI refers to programs that make it possible for machines to use things like text, audio files and images in order to create content. And synthetic media is really like a [00:06:00] catchall term for the artificial production manipulation, the modification of data.

By automated means, especially through the use of artificial intelligence algorithms, such as for the purpose of misleading people or changing an original media, synthetic media is commonly referred to interchangeably with deep fake. It's highly convinced. I mean, it's really, really good content. The ongoing development of deep fake tech makes it more and more difficult to discern between real and fake content.

And that gets to the heart of security. It gets to the heart of brands, it gets to the heart of the people behind who is claiming to, to, to be shown by video or by image. Right. Well, and David, isn't this some of the information that we've seen recently from federal law enforcement? Around remote workers.

Right. Doesn't this parallel? Or, or It absolutely does. Yeah. It absolutely does. So, deep fake tech, it's relatively new, but it's an [00:07:00] emerging fraud in cyber crime. Tell it's about that. Yeah. It's been a growing concern among consumers and organizations as they've exploit The deep fake technology has been exploited by criminals to carry out social engineering attacks and to spread misinformation in fraud scams.

The way it advances is through this process. Let's get a little geeky here for a second. It's called gans. Have you ever heard of gans? No. I'm not familiar with that. So that is generative adversarial networks. So key technology leveraged. , through gans is to produce DeepFakes in other synthetic media.

It's based on this content called gans. It's generative adversarial network. In a GaN, two machine learning networks are used and they develop synthetic content through adversary. Like, like bidding against each other, right? So the first network is the generator data that represents the type of content to be created.

It's fed into the first network, so it can learn the characteristics [00:08:00] of that type of data. For example, when they want to make someone like a C E O, a business owner, a leader, or a, you know, socially, right? Somebody that we know, a neighbor, a mother, something like that, right? They feed that information to the first.

Machine. Right? Everything, every video we have, every, like we have, every post we do, all of that is fed into that machine. The generator then attempts to create new examples of that data, which exhibit the same characteristics of the original data, right? So it's going to sound just like him or her. It's going to.

Have the inflection in the voice. It's gonna have the batting of the eyelids, the nodding of the head, the movement when they move from left to right, exactly like the first one, right? These examples are then presented to the second machine learning network, which also has been trained, but through a different approach to learn the same [00:09:00] identity.

The second network, which is called the Adversary network. Attempts to detect flaws in the first one and rejects those that it considers as fake. These fakes are then returned to the first network. Okay? It shoots back to the first network so that it can learn through machine learning and artificial intelligence to improve its process of correcting the and creating the new data.

This back and forth goes and continues until, This GaN network, the combination of both of them produces fake content that is undetectable by the human eye and human ears. Wow. Shock. Well, that, that ex, that explains the level of detail and why it actually looks real. Yeah, and it does. It absolutely does.

So you're saying these two, teaching each other, finding the flaws in the design, feeding it back to the design. Correcting that, spitting [00:10:00] out a new product, having that other machine review it, and this goes back and forth, back and forth until it's undetectable, correct. Undetectable by humans. By humans.

Right, right. Wow. So in recently in 2022, a lot of security experts through our research, they've been on high alert for this, for like the next evolution of social engineering. Right. Which is the deep fake employment interviews. Yes, that's what I was talking, that's, yeah, we were talking about that the other day.

That's, yeah. Let's maybe touch on that. Yeah. That's the latest trend. It offers a glimpse into like the. Future arsenal criminals can use to create the the fake persona. Now in this section, we show up on the screen for people watching the video, the FBI public warning about deep fake and synthetic media and how it's been used to gain access to hundreds of different companies throughout the United States.

And they're warning people about it. They've been able to thwart some of 'em, but some of 'em have [00:11:00] gotten through. And now we're gonna walk through what that means to all of us. Every time we get on a Zoom or a WebEx, or a WebEx, it's really, really disturbing. But the concern in the security industry came when a new advisory was issued just this past June, I mean me this just a couple months ago.

Yep. And the FBI's Internet Crime Complaint Center, the IC three warned of increased activity from fraudsters trying to game the online interview process for remote work positions. So in their warning, the FBI's warning, they gave an advisory that said criminals are using the combination of deep fake videos and stolen personal data, which is for sale on the dark web to misrepresent themselves and get a job in an organization in the us.

And so, wait a minute. So they're using social engineering, which is basic research. Yep. And then they're [00:12:00] using this artificial intelligence machine learning synthetic media types to pose as potential workers. Yes. And, and they're doing it live. So what's happening is this picture, the scenario, you know, we, you and I, we've interviewed tons of people in the last year.

A lot of them have been by Zoom, correct? Yeah. Well, we don't know. We haven't taken the blood test or met the person in In person, right. Live in, in front of them. Right? And what's happening is the deep fake technology is having someone's different face be on the video while we're watching it live. Wow.

And federal law enforcement officials said in this advisory, they've received a rash of complaints from businesses all over the US with this. So this isn't just a rare one-off scenario. It's, it's really pretty shocking. They're, they're trying to gain [00:13:00] employment in a range of work from home positions that include it, computer programming, database maintenance, and software related job functions.

Why do you think that is? So it. If they're able to pass this off, they get through the interview process. Now they could be on the network, they could be it the database manager. That's a scary thought. Yeah, exactly. Like everything that, like they have stolen credentials and the person, the interview, like they have a fake LinkedIn profile and when they meet the person, it looks just like the person on the LinkedIn profile.

Right. And when they meet the person live by Zoom, it looks just like that person. Even though in real life they look totally different. I've seen some of the videos. It's shocking, right? Like you can't tell. You can't tell what, what they were able to find is there were a couple instances, the reason they got alerted is because in one or two of them, mark, somebody like sneezed in reality.

But the sneeze didn't happen [00:14:00] over the video. Wow. So they caught it. They caught it, but it was just because they had a, a HR person that was just really keen. There was just something about this interview that just seemed off right. But the technology itself, you can't discern from the human eye. That's why they brought it.

I mean, it's one thing for someone to kind of have a suspicion, right? Or think maybe my. Video glitched or something. Cuz I heard a sneeze, but I didn't see them crouched down or put their hand in a fist over their mouth or anything like that. Right. But it was to the point where they were seeing it so often that they actually contacted federal law enforcement.

And this is not just one company, tens of 'em, like all over the place, all over the us. So the, the, the belief here is right, they wanna use this deep fake synthetic media to gain access to the company systems. Right as a fraudulent employee to capture p i i, private, [00:15:00] you know personal information, p h i, private healthcare information, intellectual property and related information never meant for the public to be used so that way they could use it in extortion campaigns or to gain premium yield in Bitcoin by selling that data on the dark web.

Once they're in. Right. Once they are issued a company laptop or just access to company systems, right? The platforms, the SAS programs, the Salesforce programs the HR programs, the coding programs, the servers, right. Once they have access to those databases, they can use things like key loggers, like our favorite, like rubber ducky, rubber duck, key logger, things like that, and download gigs and terabytes of private data.

So it's really, this is just another. It means, you know, we talk about the tactics all the time that people, that hackers use bad actors and whatnot. This is, this is probably the most unique tactic that has come down the pike in quite some time. So they will use this to gain access that they otherwise wouldn't be [00:16:00] granted to.

Someone's network with the ill intent of stealing either information, proprietary information, whatever it may be, personal data, HR information, financial records. Yep. And nobody even know. And, and they let them in. They actually gave them the password. Right. Wow. And some of 'em, some of them made it past the interviews.

So some of 'em what, what the F B I Advisory said is some of the complaints also noted that the criminals have been using stolen personal identification information. P i i, right? In conjunction with the fake videos. To impersonate applicants, but later background checks dug up discrepancies between the individual who interviewed and the identity presented in the application.

Ah-huh. So some of 'em, yeah, they caught it because the HR person was very observant watching for this. Right. This is why we talk about this as a sense of awareness. Right. It's, it's, it's the state of total awareness of being, you know, aware of our [00:17:00] surroundings, especially by video when we're working remotely.

Right. And they even ma they made it past that. It was just the, the follow background check where they caught someone. The issue is, you know, they didn't catch 'em all. Right. Right. Yep. So, well this, you know, this, this takes me back to your earlier comment about congressional hearings, right? So are are, is law enforcement playing catch-up?

Are they ahead of this, you know, why is Congress involved? Are we prepared for this yet? What. What does that landscape look like? Yeah. Well, the F B I security warning's, one of many that's been reported by federal agencies in just in the past year, believe it or not. So this is not just a very rare, limited thing, the US Treasury, US State Department, and the F B I released an official warning, again in 2022, indicating the companies must be core cautious of North Korean IT workers pretending to be freelance contractors in order to infiltrate companies and collect revenue for their country.

Because you remember, we have sanctions against North Korea, but if they can work for a [00:18:00] private company that might have a European base, a a base in the us, they can generate revenue. All that revenue will just flow right to the hermit kingdom there. So UN organizations are unknowingly paying North Korean hackers.

And what's interesting is if they do this, They themselves. What, what they mentioned in, in these advisories from the US Treasury and State Department, mark, is they said organizations that knowingly or even unknowingly, like they don't even have to know they're doing it. If they unknowingly pay North Korean hackers, they could potentially face legal consequences and violate government sanctions.

Yep, that is correct. Pretty, pretty serious stuff. So on May 16th, 2022, the US Department department of State, US Department of the Treasury, and the F B I issued an advisory for the international community, the private sector, and the public warning of attempts by North Korea that they are using these [00:19:00] IT workers to obtain employment.

And they pointed out the reputational risks. To the private companies, right? I mean if something like this came out, it would absolutely destroy the reputation and the trust, cuz customers won't wanna do business with them. Exactly. That's and that's exactly what it always comes down to, isn't it? Yeah, that's exactly right.

Now, previously in a congressional hearing, last year or so on deep fake threats from countries and the IT industry and hackers as a whole, Congressman Ben SaaS from Nebraska asked Dan Coates, the director of National Security, whether the US is prepared to deal with this. And in that congressional hearing, representative Ben SaaS asked, when you think about the catastrophic potential to public trust and to markets, That could come from deep fake attacks.

Are we organized in a way that we could possibly respond fast enough? Shockingly, in reply, director Dan Coates said, we need to [00:20:00] be more agile and it poses a major threat. And then he says, it is something that the intelligence community needs to be restructured in order to combat. So check that out. So what we just heard was, let's unpack that a second.

The answer was, yeah, no, we're not ready, and the intelligence community needs to be restructured in order to address it.

That's, that's pretty severe in there. Like, what, what does that even, that answers my question. Yeah. What does that even mean? What do you mean? What do you like? Like, I, I saw that and I was like, whoa, whoa, whoa. What do you mean? Like, I. It needs to be restructured, like we're not ready for this. Right. The, the, the technology's advancing so fast.

It's pretty crazy. I mean, deepfake overall so far has been used for things like this. Let me show you and listeners that are watching online and watching the video, you'll be able to [00:21:00] see this. But usually it's been used for like lip syncing, dubbed movies. It's been used for translated lectures, right?

Or g c I, like you mentioned earlier. It's been used for live translations and press conferences, right? You know, when they do these deep fakes, they do 'em in up to 64 different languages, so you can make the lips move perfectly and the head gestures, everything else. They also do it to generate missing video in segments, right?

So when they record a whole video, right, but oh, they forgot to add this one minute segment. Well, we can't bring the person back. Right. So what do they do? They take the person and they generate it through deep fake. So these are like the commercial uses of it. Okay. This is like, or the innocent uses where they have talking memes, stickers, gifs, stuff like that.

And, and the technology and, and how they do it, they, they use this like wave to lip framework where it takes the audio. When you think about, you [00:22:00] know, like, When there's a recording, think about like the recording for this podcast, right? There's the audio and there's the video and it syncs it up. But then what it does is it watches the target, it captures their movements, and then you type in what you want them to say and it takes what they have and what they know about it through artificial intelligence and machine learning.

And then it makes it say that. It's pretty shocking. So let me, let me walk you through and, and, and I'm telling you there are hundreds of companies out there. There's a list that we found with literally like 300 different companies all over the world that openly advertise for this, and they give you demos.

So I went on and I even did a demo of tool. I wanna share that with you. So here's, here's a, here's a couple samples. Here's one where it's called AI Studios, and they just said, here, go ahead and just try, try this out. Tell us if you think that it works. Check their lips. Check the, check. This human right as they say.

What you want them to say. And I could have typed in [00:23:00] anything here. Right. And I just went in and I just typed in, you know, I love Cyber Crime Junkies podcast, right? And then I got an account, it's a free account, and this is what came out of it. So it what's shocking too is you're able to, are able to see the video here where you're, you're able to, Have it be a female, have it be any nationality, any type of inflection you can adjust.

The speed, the cadence, the pauses, the head movements, all of that. It's openly available. So I got this guy to mention our podcast. I love Cyber Crime Junkies podcast. I love Cyber Crime Junkies podcast. Which is pretty wild because he looks, he's standing like a real human being. He looks real, and now there's a background there, but that background is a green screen.

You can have him sitting, standing at a coffee shop. You can place him anywhere. Right. What was, what was the other one you did with the girl? That one looked [00:24:00] real. I mean, not that that one didn't look fake, but now, now that I'm sitting here looking for it, what was the other one that you did? Well, here's the other one.

So here's here, here's, here's another one where you are able to go in and do a demo and have it go along anything that you want. So listen to this. Welcome to Colossian Creator. I am synthetic media and not a real human, but if I were a real human, you can bet I would spend my time watching and listening to the Cybercrime Junkies podcast.

It's my absolute favorite podcast, filled with true cybercrime stories, interviews with leaders who build and protect great brands and filled with best practices so that I can, as well as my family and my organization can stay safe when online.

So that's, it's crazy now for those listening you, you weren't able to see it, but we were able to place. This human who, if you watched her lips and her body [00:25:00] movements and her hand moving, her hands even move, it was on track. It was, she was moving her mouth and, and persing her lips and articulating exactly with the content that we placed on there and we just threw our logo up there, et cetera.

But what is that was from a free account. That was from a free account. I did it in like five minutes. Imagine if you paid for it, what you get. Yeah, and imagine if you really wanted to have somebody demonstrate this for, for a nefarious cause, right? Like that's, that's where it, it, it really gets, it really gets scary.

And I mean, it it, it happened in real life. I mean, think about what this means for society and families. There's a cyber bullying scenario where DeepFakes were implicated, but lemme tell you about this story. Cyber bullying, as you know, it's a common issue. Especially among, among younger generations due to the high usage that younger generations have on social media.

Right. Rumors can be [00:26:00] easily spread through social media and online platforms, and then when coupled with fake images and videos to suggest that the rumor is true, it can make the rumor more believable. Right? Yep. And it could ruin reputations and. Data supports, which causes psychological effects that could lead to victims hurting themselves and social issues.

Correct. So back in March, 2021, this actually happened. International news brought to light an incident where charges were filed involving alleged DeepFakes after a cyber bullying. Attack in Pennsylvania, a mother allegedly manipulated images and videos of her daughter's cheer squad teammates.

The DeepFakes showed members of that cheer squad drinking vaping and posing nude. Oh my gosh. All of which could get them cut from [00:27:00] cheerleading. Oh my gosh. Yeah. It's like a, it's like a cheer mom. Going insane with technology. Right. Several of the victims came forward about the cyber bullying one victim claim that the mother went as far as encouraging suicide, furthering the harassment outside of the alleged DeepFakes.

Pretty shocking now. I mean, I don't know what happened with that case. We could look it up and update the the episode later, but that was just one involving society, right? Just one that, that, that just involves cyber bullying. But it, it, it also really addresses how easily and how accessible these tools and resources are to the public.

I created those two avatar videos in like five minutes. Right. If somebody wa has bad purpose, it can be used as so many different, it can bolster false rumors and be used in social engineering to compromise an organization. So yeah, so, so check this out. What I'm [00:28:00] showing online here now is here, let me share my screen.

Mark. You'll be able to check it out. So what I'm showing online is that public service announcement from this past June, June 28th, 2022, from the F B I talking about how the deep fakes and the sole stolen private information has been used to apply for those remote job positions that we were talking earlier.

Yep. To the right of that, there are two sites. It's called This Person Does Not exist.com, and which face is real.com. You see those people there? Yep. They're not real. Really they don't exist. It never existed. They are AI generated. Look at the detail. That's the sweat glistening. Look at the, they don't look like avatars.

They look like family. They look like people. Right? I think I know that one guy. Yeah, I know. It's dis It's, it's, it's unmistakable and it's er by, by, by the human eye. It's really, really shocking. And then you know, [00:29:00] here's the information on what the US government has issued on the actors leveraging this technology from, from foreign governments.

But when we think about some of the other times, like how has this happened in real life? Well one case study is there was an energy company, A C E O was deep fake by phone and video to his employees. And got 'em to wire $243,000 within one hour. Yep. So they compromised, they, they did that business email compromise that we talk about in other episodes.

We talked about it earlier and instead, right. What do we always tell people? Verify, right? Yeah. All your boss. Right. But if you got a, if you got a video from your boss, but if your boss calls you and sounds exactly like them, Right. And gets on Zoom and looks exactly like them. Right? What is the power of a criminal hacker at that point?

Right? [00:30:00] Also another case study was 35 million was stolen by audio of an attorney who targeted a branch manager of a company that was involved in mergers and acquisition. Got a ton of documents and transferred the funds. Wow. As part of a, a merger and acquisition. But the funds went to the Hacking Organization and they got away with 35 million.

Wow. That was this year. Wow. That was all this year. That's incredible. Which is why that all led to the F B I warning of last month or a month and a half ago. And then some of the congressional hearings. It's all starting to make sense now. Yeah. It's pretty shocking stuff. So, I mean, look, the cost of deep fake scams exceeded 250 million last year or in 2020 actually in 2020.

2021. Right. And the form of technology. It's in its early inception incubator stages, right? Yeah. I'm thinking this hasn't even found its apex point. It hasn't even, it's not even in the regular toolkit that criminal [00:31:00] organizations are using yet, so forget about the fact. Well, and one other thing is they do have companies, Just like all those hundreds of companies that, that create the DeepFakes, they have companies that, there's hundreds of them now that are popping up to discern DeepFakes.

Right? Right. It's a platform that when this flag goes off, they'll be able to tell that it's a deepfake. Right. There's, there's platforms out there, but let me ask you, you and I deal with this every day. I've never met a single company that has that technology. No. Right and that technology, what the industry research is showing that technology is not up to speed.

It's not advancing as fast as the technology to develop it, right? The technology that's using the gans process and things like that, they're clearly in the lead right now. Hopefully that other technology A catches up, but B becomes more mainstream, so that small to bus, mid-sized businesses and even larger organizations can leverage it.

But there's no doubt that as deepfake technology evolves, so will the [00:32:00] sophistication of how criminals exploit the technology to attack businesses and consumers alike. There've been specific, costly examples that have happened when used in cyber attacks. Fraud in, in hackers should be barred from them.

But the the, the warnings on DeepFakes, they're, they're just getting started. Right. The issue here at the end of the day, like, tell me what you think about it. Like at the end of it all, like it goes to the very heart of what is and what is not believable. Right. Well, you know, David, something tells me that this is probably not the last episode we're gonna have to do on this subject.

No, I think it's just getting started. I mean, when our own eyes and ears are deceived whether we're distracted, whether we're busy at work or at home. Right. It creates a societal cynicism. Of what's even believable. Well, we'll have to be sure and have all the cybercrime junkie followers evangelize this new message of artificial intelligence, synthetic media, deep fake [00:33:00] cyber crimes that is now taking over.

Yep. Absolutely. Well, thanks everyone for listening to the True Cybercrime story of Deepfake.