Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

British engineering giant Arup revealed as $25M deepfake scam victim

cnn.com

Post reply on HN
Print view View original

81–90 of 109 posts

Re: British engineering giant Arup revealed as $25M deepfake scam victim

#81

Post by helsinkiandrew »

bartlettD wrote: post #4

> According to police, the worker had initially suspected he had received a phishing email from the company’s UK office, as it specified the need for a secret transaction to be carried out. However, the worker put aside his doubts after the video call because other people in attendance had looked and sounded just like colleagues he recognized. Regardless of the sophistication of the deepfake, surely this rings huge a…

> Regardless of the sophistication of the deepfake, surely this rings huge alarm bells, right?

Its a company with revenues of a couple of billion and that probably sub contracts thousands of other companies on projects around the world. The finance department is probably sending similar payments regularly.

Most payments will be "secret" in that the amounts won't be made public to employees that don't need to know. The company maybe, for example, be repeating work that has been already been done in house so doesn't want it known inhouse what companies are being paid.

Re: British engineering giant Arup revealed as $25M deepfake scam victim

#82

Post by noAnswer »

tompccs wrote: post #2

I said this over a year ago elsewhere: Electronic engineers spent decades overcoming thermal noise floors so that humans could communicate over vast distances with small amounts of energy. AI researchers, in a few short years, undid all that by making computer-generated chatter and images indistinguishable from messages sent by humans. Until such a time as we live in a Bladerunner-like world of Replicants, being in-p…

Cryptographically sign all the things!!!!! A L L T H E T H I N G S !!!!

Re: British engineering giant Arup revealed as $25M deepfake scam victim

#83

Post by ajsnigrutin »

Rinzler89 wrote: post #38
ajsnigrutin wrote: post #20

Earlier quoted context omitted.

There are many secrets in business, especially in realestate. Found out, from some "unnamed source" that there will be a new bus stop and a new aldi store across the street from a building where some apartments are for sale? Don't mention it to anyone, secretly buy them, because their value will go up a lot, and do it discreetely, so other companies don't notice.

That should be classified as corruption/insider trading and punished as such. In my country that's how politicians and their friends get filthy rich. They know ahead of time where a new highway will be planned so they buy up all the rural land in that area for cheap so that the government will have to buy it from them at inflated prices to build the highway. Then, if a new government comes to power before the highway…

Insider trading is only when you're the insider. If you happen to walk past a geodetist (land surveyer?) on the street measuring something, ask him what'll be built there, and he tells you, you're still not the insider.

Otherwise I agree, but in my country they do it differently,... government needs a building for X, someone close to someone in the government buys it for eg. 2mio eur, holds on it for a year or two, before a tender comes out (governments are slow), and 'coincidenetally' that building is the best match and the government buys it for eg. 7mio eur from that guy. (and then they split the difference).

Re: British engineering giant Arup revealed as $25M deepfake scam victim

#84

Post by _tk_ »

The article lacks details to discuss this particular incident. This could reasonably be a company with poor governance, insecure configuration and authentication - and then this is a non-story. OTOH, with the amount of money in question, a sophisticated attack is absolutely believeable, and even 2FA and better process governance will help you out. Maybe a PKI does, but as always, it depends.

Re: British engineering giant Arup revealed as $25M deepfake scam victim

#85

Post by dudinax »

jfoster wrote: post #52
ajsnigrutin wrote: post #20

Earlier quoted context omitted.

There are many secrets in business, especially in realestate. Found out, from some "unnamed source" that there will be a new bus stop and a new aldi store across the street from a building where some apartments are for sale? Don't mention it to anyone, secretly buy them, because their value will go up a lot, and do it discreetely, so other companies don't notice.

It's a bit surprising that Aldi (and other supermarket chains) generally don't invest in residential real estate.

That really would be insider trading.

Re: British engineering giant Arup revealed as $25M deepfake scam victim

#86

Post by wiradikusuma »

I think one way to verify legitimacy is by calling back. For example, "Ok boss, just protocol, but you wouldn't mind if I call you using your usual number?" (or just do it without informing in advance).

Ideally they screen-record (can you do that in Android/iPhone?), so at least if it's really scam, they can say "but I follow protocol, here's the evidence".

Btw we once had a similar scam attempt. "The CEO" emailed Finance in great urgency to transfer money. Good thing the CEO was sitting next to the Finance lady. I was sitting next to them watching the horror turned comedy.

Re: British engineering giant Arup revealed as $25M deepfake scam victim

#87

Post by ajsnigrutin »

lesuorac wrote: post #47
ajsnigrutin wrote: post #20

Earlier quoted context omitted.

There are many secrets in business, especially in realestate. Found out, from some "unnamed source" that there will be a new bus stop and a new aldi store across the street from a building where some apartments are for sale? Don't mention it to anyone, secretly buy them, because their value will go up a lot, and do it discreetely, so other companies don't notice.

If your business is easily (commonly?) going to wire $25M across 15 transactions you should have a process in place. This is pretty much the whole point of multi-factor; although I'd argue you want the multi to really represent two people. The requester attests that "yes I want $25M" and the sender attests that "yes I am this person". The wild west ways of the banking sector is finally catching up to them.

I co-own a lot smaller company, so it was more in a range of 4 figures (euros), but more than once I've been in a situation where I've just signed a deal for some business with some company, called one of the 'hardware guys' from the car (external companies that eg. import hardware, are distributers for lenovo/dell, whatever), got an offer for a set of hardware that we needed (a few servers, etc.), forwarded the email to our ceo, called him (without faked AI voice in my case... for now), told him "pay this today, so we can get them by the end of the month", and he did.

If someone knew I was negotiating some business that day, phished an email with whatever account number he wanted and AI faked my voice, he'd get the money transfered.

So yeah... another thing to worry about.

Re: British engineering giant Arup revealed as $25M deepfake scam victim

#88

Post by ajsnigrutin »

jfoster wrote: post #52
ajsnigrutin wrote: post #20

Earlier quoted context omitted.

There are many secrets in business, especially in realestate. Found out, from some "unnamed source" that there will be a new bus stop and a new aldi store across the street from a building where some apartments are for sale? Don't mention it to anyone, secretly buy them, because their value will go up a lot, and do it discreetely, so other companies don't notice.

It's a bit surprising that Aldi (and other supermarket chains) generally don't invest in residential real estate.

Who knows, maybe they do :)

Re: British engineering giant Arup revealed as $25M deepfake scam victim

#89

Post by GiveOver »

XorNot wrote: post #72
legel wrote: post #44

Earlier quoted context omitted.

This brings up an interesting “risk control” that one of my tech investors personally implemented with his family, in case a audio/video version of him ever asks to do anything crazy: secret passwords, agreed upon in person.

Technically Signal solves this problem with safety codes. The UI really could stand to be more assertive about what they mean though.

I notice every time somebody gets a new phone because it says "Your safety number with x has changed" but whenever I've spoken about it with friends, they have no idea what it means. An additional sentence could help here, such as "You might want to double check that you're really talking to x" or the classic "It's possible someone is doing something nasty". Although I understand that this would definitely scare a lot of people, maybe even push them into thinking Signal is insecure.

Re: British engineering giant Arup revealed as $25M deepfake scam victim

#90

Post by miohtama »

bartlettD wrote: post #4

> According to police, the worker had initially suspected he had received a phishing email from the company’s UK office, as it specified the need for a secret transaction to be carried out. However, the worker put aside his doubts after the video call because other people in attendance had looked and sounded just like colleagues he recognized. Regardless of the sophistication of the deepfake, surely this rings huge a…

If you are a boomer company that does not know how online works, then you can also afford a boomer-style business class flight tickets to do a secret $25M transaction face-to-face.
Post reply on HN