The real issue here is a lack of proper risk controls around business processes involving money. Regardless of if it’s £3 for a coffee or £25m for a Secret acquisition there should be an agreed process that everyone involved in business transactions should be aware of so that if they are suddenly privy to a deal they can navigate and validate the authenticity of their involvement.
British engineering giant Arup revealed as $25M deepfake scam victim
41–50 of 109 posts
Re: British engineering giant Arup revealed as $25M deepfake scam victim
#42> According to police, the worker had initially suspected he had received a phishing email from the company’s UK office, as it specified the need for a secret transaction to be carried out. However, the worker put aside his doubts after the video call because other people in attendance had looked and sounded just like colleagues he recognized. Regardless of the sophistication of the deepfake, surely this rings huge a…
Yeah, this would at least cause me to email my boss and say "Can you just confirm, you want me to transfer $25 million to this account? I'll hold off until you give me confirmation in writing" hell i do this if our tester hasn't managed to go over some aspect of our release. That way i get in writing from the product owner that he has OKd it, and if he sends me a teams message i ask him to email me confirmation.
Yep sometimes I go so far as printing the email and sticking it in a meatspace folder on my desk. Just depends on how important that sign off really is and the consequences of not being able to produce it.
Re: British engineering giant Arup revealed as $25M deepfake scam victim
#43Earlier quoted context omitted.
I guess a scammer can sell it as "we're buying something significant [another company?], this will affect our share price if the info goes out, so you need to sign this NDA and keep this quiet, you're only 1 out of 10 people who knows this...". They could also sell it as payment for an e.g. consulting firm for the above secret deal...
Secret doesn't mean they can't use internal authenticated communication channels, at the very least to send a redacted confirmation.
You can send out free zoom and Google meet links.
Idk if most people would tell the difference
Re: British engineering giant Arup revealed as $25M deepfake scam victim
#44The real issue here is a lack of proper risk controls around business processes involving money. Regardless of if it’s £3 for a coffee or £25m for a Secret acquisition there should be an agreed process that everyone involved in business transactions should be aware of so that if they are suddenly privy to a deal they can navigate and validate the authenticity of their involvement.
This brings up an interesting “risk control” that one of my tech investors personally implemented with his family, in case a audio/video version of him ever asks to do anything crazy: secret passwords, agreed upon in person.
Re: British engineering giant Arup revealed as $25M deepfake scam victim
#45I said this over a year ago elsewhere: Electronic engineers spent decades overcoming thermal noise floors so that humans could communicate over vast distances with small amounts of energy. AI researchers, in a few short years, undid all that by making computer-generated chatter and images indistinguishable from messages sent by humans. Until such a time as we live in a Bladerunner-like world of Replicants, being in-p…
When I'm on a company video call, the people I'm meeting with are logged into their company accounts, through the fancy company authentication system. Large warnings are displayed if there are any external participants, and I wouldn't be surprised if it's possible to disable the ability to even have guests. Third-party video conference software is banned and blocked from installation on work computers.
I am not in the finance department, but in software engineering and operations, two-party controls are everywhere. I can't check in code without reviews. I can't access production systems or make changes without approval from another team member. I would think that similar processes could be put into place for transferring tens of millions of dollars.
In other words, there are ways to deal with this that don't come down to "mistrust all technology and revert to face-to-face meetings and handing cash to each other".
Re: British engineering giant Arup revealed as $25M deepfake scam victim
#46Earlier quoted context omitted.
What's wrong with good ol' private keys?
The ability to make an infinite number of them. And that most people have no idea how to verify any ID, so they need a system that turns any given form of ID into a nice and simple "yes" or "no". I'm not at all clear what kind of ID is going to be genuinely useful for video calls, given we should only be trusting existing contacts anyway? But those things are why "private key" isn't sufficient in isolation.
What's wrong with making an infinite number? You just need to check it against one public key.
Re: British engineering giant Arup revealed as $25M deepfake scam victim
#47Earlier quoted context omitted.
"in secret" is the issue
There are many secrets in business, especially in realestate. Found out, from some "unnamed source" that there will be a new bus stop and a new aldi store across the street from a building where some apartments are for sale? Don't mention it to anyone, secretly buy them, because their value will go up a lot, and do it discreetely, so other companies don't notice.
If your business is easily (commonly?) going to wire $25M across 15 transactions you should have a process in place. This is pretty much the whole point of multi-factor; although I'd argue you want the multi to really represent two people. The requester attests that "yes I want $25M" and the sender attests that "yes I am this person".
The wild west ways of the banking sector is finally catching up to them.
Re: British engineering giant Arup revealed as $25M deepfake scam victim
#48I said this over a year ago elsewhere: Electronic engineers spent decades overcoming thermal noise floors so that humans could communicate over vast distances with small amounts of energy. AI researchers, in a few short years, undid all that by making computer-generated chatter and images indistinguishable from messages sent by humans. Until such a time as we live in a Bladerunner-like world of Replicants, being in-p…
I know it's a meme and all, but doesn't blockchain solve this? Ok, Mr. Guy who looks like my boss on Video Call, I can send those funds, just sign the transaction with your private key and it'll all be done.
Re: British engineering giant Arup revealed as $25M deepfake scam victim
#49Earlier quoted context omitted.
Big transactions happen and it’s some people’s jobs to execute them
"in secret" is the issue
"Confidentiality" is entirely normal; since many deals such as takeovers rely on your competitors not knowing until it's happened, it's not unusual for this information to be restricted within the company on some sort of need-to-know basis.
Authenticating transactions is going to be an increasing problem in the presence of deepfakes, though.
Re: British engineering giant Arup revealed as $25M deepfake scam victim
#50I said this over a year ago elsewhere: Electronic engineers spent decades overcoming thermal noise floors so that humans could communicate over vast distances with small amounts of energy. AI researchers, in a few short years, undid all that by making computer-generated chatter and images indistinguishable from messages sent by humans. Until such a time as we live in a Bladerunner-like world of Replicants, being in-p…
I know it's a meme and all, but doesn't blockchain solve this? Ok, Mr. Guy who looks like my boss on Video Call, I can send those funds, just sign the transaction with your private key and it'll all be done.
That's just regular Crypto stuff not Cryptocurrency